RAR Archive
| Format | RAR Archive |
|---|---|
| Short name | RAR |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The RAR archive format (versions 1.5–4.x and 5.0): headers with file names, sizes, modification (and optionally creation and access) times and attributes; RAR 5.0 stores times as Unix time (optionally with nanoseconds) or Windows FILETIME. Supports solid compression, multi-volume sets and recovery records. RAR 5.0 uses AES-256 with PBKDF2, RAR 3.x–4.x AES-128, while RAR 2.x used a proprietary cipher; encryption can cover the data or the headers too. With encrypted headers even the file names are hidden. Self-extracting (SFX) archives carry the RAR signature not at offset 0 but after an executable module and are therefore initially identified as executables.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 52 61 72 21 1A 07 00 | Rar!... | RAR 1.5–4.x signature |
| offset 0 (0x0) | 52 61 72 21 1A 07 01 00 | Rar!.... | RAR 5.0 signature |
| offset unknown | 52 45 7E 5E | RE~^ | Signature of RAR versions before 1.5 (sparsely documented) |
Known extensions
.rar, .r00
References
- RAR 5.0 archive format (RARLAB) https://www.rarlab.com/technote.htm
- ForensicsWiki — RAR https://forensics.wiki/rar/
Cite this entry
Crush Format Reference, “RAR Archive”. https://kalink0.github.io/crush-forensics/formats/rar/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction