Identifiying a zip file that is not really a zip file

7-zipzip

I have several files that a 3rd party program generated that have a .zip extension, however neither windows nor 7zip can extract it. In 7zip it does show me the file name of the uncompressed file however when I try to extract it I get the error

An attempt was made to move the file pointer before the beginning of the file.

I ran the file through TrID.NET, however it had not even a partial match on what the file was.

Here is the fist 51 bytes of the file.

offset: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
   hex: 14 00 08 00 08 00 C2 43 C6 3E 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 31 30 35 36 30 36 2D 32 30 31 31 30 36 30 33 31 33 34 31 34 36 2E 65 6E 63
 ascii: .  .  .  .  .  .  .  C  .  >  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  1  0  5  6  0  6  -  2  0  1  1  0  6  0  3  1  3  4  1  4  6  .  e  n  c

Here are the things I have figured out looking at severial files and comparing the headers:

  • Bytes 0-5 are always 14 00 05 00 08 00 in the examples I checked
  • Bytes 6-9 change per file, I don't think it is the uncompressed file size as it is much to big.
  • Bytes 10-21 are always 00 in the examples I checked
  • Bytes 22-25 is the length of the filename of the compressed file.
  • Bytes 26-50 is the compressed file name (105606-20101020162359.enc in this example)

Everything after the file name appears to be different per compressed file.

Does anyone know what this fileformat is?

Best Answer

I did some searching, and it appears that it might be a .JAR.

A .JAR's identifier is: 50 4B 03 04 14 00 08 00 08 00 (source, search for JAR)

Which is the only partial match I could find.

This could also explain why you can't read it; part of the identifier is missing.

Related Question