I have a zip file and want to know as much as possible about it. Some information is obvious like creation date etc. But what kind of information could be found by a forensic analysis?

  • 3
    It is hard to tell what you are exactly expecting which makes this question too broad. But, take a look at the zip file format to get a feeling for the kind of information you might get when analyzing a ZIP file. – Steffen Ullrich Apr 1 '17 at 7:41
  • What do you mean by 'forensic analysis'? The term is undefined. Are you asking what are all the ways to analyse a zip file to gain useful information? – schroeder Apr 1 '17 at 12:46
  • Perhaps you could mention some specific information you would like to gain from the analysis? – Anders Apr 3 '17 at 9:33
  • I could retrieve some information about the source file system. It states NTFS. So the system packing the zip runs probably under Windows. But how to determin the packer? – honze Apr 3 '17 at 21:00

You can use 'unzip' from fx. cygwin. unzip -l Archive.zip in a terminal/cmd.exe. While it will list dates of the files archive (CTIME and MTIME, perhaps) these are attributes that can be changed by anyone. The creation date of the zip-file is just the time at which it was downloaded/copied to your PC.

Not the answer you're looking for? Browse other questions tagged or ask your own question.