Is this ZIP file safe to open? Check it before you extract
Check a ZIP before you extract it. Its table of contents lists every file with its name, its size and how much it shrank. Five things show up there when a ZIP is trying to cause trouble: a size that balloons when unpacked, names that climb out of their folder, a second extension hiding the real type, an encrypted entry, and a file whose real type does not match its name. Look inside the ZIP first, and unpack only what you expected.
ZIP viewerWhat is inside this ZIP?Do it freeWhat a ZIP's table of contents shows
A ZIP stores each file as an entry. At the end of the archive it keeps a list, called the central directory, with one record per entry. Each record holds the entry's name and path, its size before and after compression, the compression method, a checksum called CRC-32 (a short number computed from the contents, used to spot damage), and whether the entry is encrypted.
Extraction tools read this list first. The ZIP viewer reads only the list, so you can see what is inside without unpacking anything. Nothing in the archive runs.
Zip bombs: small files that unpack huge
Compression works by replacing repeated data with short codes, so the more repetition, the smaller the result. The compression ratio is the uncompressed size divided by the compressed size. Long runs of repeated data compress extremely well. The usual ZIP method can shrink a long run of identical bytes about a thousand times.
A zip bomb uses that. It is a small archive that unpacks to many gigabytes, sometimes with archives nested inside archives to multiply the size. Extracting one fills the disk and can freeze the computer.
Ordinary files give you a sense of the normal ratio. Text and code shrink a lot. Photos, videos and files that are already compressed, such as .docx, .xlsx and .jpg, barely shrink. A ratio in the hundreds on something that should be a plain document is a warning sign.
Names that climb out of the folder
Each entry name can include folders. A name such as ../../Startup/update.bat tells the extractor to go up two levels and write into a startup folder, where the program would run each time you log in. This is called path traversal, or "zip slip". Careful extractors strip the ../ parts. Older tools and home-made scripts may not.
A name that starts with a slash, such as /etc/... or C:\..., is the same problem: it tries to write to a fixed place on your disk. The viewer shows names exactly as they are stored, so you can read them before anything is written.
Double extensions and hidden types
The last extension of a file name tells the system what kind of file it is. invoice.pdf.exe ends in .exe, so it is a program, even though it starts with a name that looks like a PDF. Windows hides the extension of known file types by default, so the name can appear as "invoice.pdf".
Check the real type from the first bytes
Every file type begins with a few signature bytes. The extension is only a label, and anyone can change it. Check a file's real type reads those first bytes and compares them with the name.
| Type | First bytes (hexadecimal) |
|---|---|
| PDF document | 25 50 44 46 (the text %PDF) |
| PNG image | 89 50 4E 47 |
| JPEG image | FF D8 FF |
| ZIP, and Word or Excel files (they are ZIPs inside) | 50 4B 03 04 (the text PK) |
| Windows program | 4D 5A (the text MZ) |
A mismatch does not prove a file is harmful. It does mean the file is not what its name claims, and that is reason enough to stop and check where it came from.
Encrypted entries
A password-protected entry hides its contents. The viewer can still show the names and sizes, but nothing inside can be inspected here, and scanners cannot read inside it either. That is why attackers use encrypted archives to carry files past filters. Bank statements and tax forms are also often encrypted on purpose. If the sender is someone you know, ask for the password through another channel, and open the archive only when you know who sent it.
Mac and Windows junk
Two systems add files you did not create:
- macOS stores extra data for each file in a hidden
__MACOSXfolder, with._names beside the files, and writes.DS_Storefiles that keep Finder's view settings. - Windows adds
Thumbs.db, a thumbnail cache, anddesktop.ini, which holds folder display settings.
They are harmless, but they clutter the archive and confuse the person who receives it.
Clean an archive before you send it
Clean the ZIP gives you a new archive without the Mac and Windows files. Your original stays as it was. A safe sequence:
- Open the archive in the ZIP viewer and read every name.
- Check any file whose name or type looks wrong with the file type checker.
- Clean the archive, then open the cleaned copy to confirm it still holds what you meant to send.
- Send the cleaned copy.
Edge cases
- Archives inside archives. The viewer shows the outer list. Open the inner archive separately and check it the same way.
- Damaged archives. The central directory sits at the end, so a broken end can stop a ZIP from opening at all. That is a damage problem, not proof that the archive is safe. Check it for damage.
- Self-extracting files. An archive with a program attached, often named .exe, is a program. Do not run it unless you trust the source.
- A clean list is not a guarantee. A tidy list shows that the names and sizes look normal. It does not prove each file is harmless. Do not run a program from an archive you do not trust, even after checking it.
Comments
No comments yet. Be the first.
