ZIP Archive
| Format | ZIP Archive |
|---|---|
| Short name | ZIP |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (ZipVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Ubiquitous archive format and basis for many higher-level formats: APK (Android apps), IPA (iOS apps), DOCX/XLSX/PPTX (Office Open XML), JAR (Java), and many others are ZIP archives with specific internal structures. Dual-directory structure: Local File Headers precede each entry's data, Central Directory at end-of-file is the authoritative index — discrepancies between them can indicate tampering, polyglot files, or malware. EOCD (End of Central Directory) comment field may contain hidden data, tracker IDs, or malware markers — scan the last 64KB for the EOCD magic. Timestamps use DOS date/time format: 2-second precision, local time, no timezone information — unreliable for precise forensic timeline unless extra fields add UTC times (0x5455 extended timestamp, 0x000A NTFS modification/access/creation times). APK-specific: APK Signing Block v2+ inserts between the last Local File Header and Central Directory — presence indicates modern Android signing. ZIP structure variation (creator OS, compressor version, extra fields) can fingerprint the tool or OS used to create the archive. Encryption: ZipCrypto (legacy, weak — known-plaintext attack possible) or WinZip AES (128/192/256-bit, strong). Standard ZIP limited to 4GB — ZIP64 extension required for larger archives.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 50 4B 03 04 | PK.. | ZIP Local File Header signature ('PK\x03\x04') |
| offset 0 (0x0) | 50 4B 05 06 | PK.. | Empty archive (End of Central Directory record only) |
| offset 0 (0x0) | 50 4B 07 08 50 4B 03 04 | PK..PK.. | First segment of a split/spanned archive (span signature followed by Local File Header) |
| offset unknown | 50 4B 05 06 | PK.. | End of Central Directory record, within the last 64 KB of the file |
Known extensions
.zip, .apk, .ipa, .jar, .docx, .xlsx, .pptx
References
- ZIP format specification (PKWARE APPNOTE) https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
- ZIP format overview (Wikipedia) https://en.wikipedia.org/wiki/ZIP_(file_format)
- File fingerprinting of the ZIP format for identifying and tracking provenance (FSI: Digital Investigation, 2021) https://www.sciencedirect.com/science/article/abs/pii/S266628172100189X
- An Android Package is no Longer a ZIP — APK Signing Block (Fortinet, 2018) https://www.fortinet.com/blog/threat-research/an-android-package-is-no-longer-a-zip
- ForensicsWiki — ZIP format https://forensics.wiki/zip/
Cite this entry
Crush Format Reference, “ZIP Archive”. https://kalink0.github.io/crush-forensics/formats/zip/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction