Microsoft Cabinet (CAB)
| Format | Microsoft Cabinet (CAB) |
|---|---|
| Short name | CAB |
| Category | archive |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Microsoft's compressed archive format for installers, Windows updates and drivers. Holds file names, sizes, DOS date/time stamps and attributes for each file; the DOS timestamps have a 2-second resolution and no time zone and usually reflect the creator's local time. Data is stored uncompressed or compressed with MSZIP or LZX. Cabinets can be split across several files, each recording the names of the previous and next cabinet in the set, and can be signed with Authenticode, the signature being referenced from the reserved header area.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4D 53 43 46 00 00 00 00 | MSCF.... | Signature 'MSCF' followed by the zeroed reserved1 field |
Known extensions
.cab
References
- Microsoft Cabinet Format (Microsoft) https://learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)
Cite this entry
Crush Format Reference, “Microsoft Cabinet (CAB)”. https://kalink0.github.io/crush-forensics/formats/cab/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction