Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have several files that a 3rd party program generated that have a .zip extension, however neither windows nor 7zip can extract it. In 7zip it does show me the file name of the uncompressed file however when I try to extract it I get the error

An attempt was made to move the file pointer before the beginning of the file.

I ran the file through TrID.NET, however it had not even a partial match on what the file was.

Here is the fist 51 bytes of the file.

offset: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
   hex: 14 00 08 00 08 00 C2 43 C6 3E 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 31 30 35 36 30 36 2D 32 30 31 31 30 36 30 33 31 33 34 31 34 36 2E 65 6E 63
 ascii: .  .  .  .  .  .  .  C  .  >  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  1  0  5  6  0  6  -  2  0  1  1  0  6  0  3  1  3  4  1  4  6  .  e  n  c

Here are the things I have figured out looking at severial files and comparing the headers:

  • Bytes 0-5 are always 14 00 05 00 08 00 in the examples I checked
  • Bytes 6-9 change per file, I don't think it is the uncompressed file size as it is much to big.
  • Bytes 10-21 are always 00 in the examples I checked
  • Bytes 22-25 is the length of the filename of the compressed file.
  • Bytes 26-50 is the compressed file name (105606-20101020162359.enc in this example)

Everything after the file name appears to be different per compressed file.

Does anyone know what this fileformat is?

share|improve this question
    
I wonder if it's not a regular .ZIP file with the headers intentionally mangled as a form of protection? Have you tried running any "ZIP File Repair" tools on the archive? They might be able to rebuild the directory, find the data, and extract the files. –  afrazier Aug 3 '12 at 16:50

1 Answer 1

up vote 3 down vote accepted

I did some searching, and it appears that it might be a .JAR.

A .JAR's identifier is: 50 4B 03 04 14 00 08 00 08 00 (source, search for JAR)

Which is the only partial match I could find.

This could also explain why you can't read it; part of the identifier is missing.

share|improve this answer
    
Even so, 7zip (and windows) have no trouble with JAR, so I don't know. If it is a .JAR what can I use to extract it? –  Scott Chamberlain Aug 3 '12 at 16:48
    
You sir, are a genius, I used a hex editor to add in the missing 50 4B 03 04 and 7zip extracted the file. –  Scott Chamberlain Aug 3 '12 at 16:50
    
Google is the actual genius here :) But thank you for the nice words! –  Simon Verbeke Aug 3 '12 at 17:02
    
In case anyone was curious, after hooking Process Monitor to the program I found out that it was calling zip.dll from the Java SE Runtime, so that explains the .JAR connection! –  Scott Chamberlain Aug 17 '12 at 21:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.