Is it possible to determine which specific version of which specific program created a given ZIP archive, based on its metadata?
And also, is the outcome of a ZIP / RAR compression affected by the hardware/software (O.S. version) configuration of the computer used for the task?
The goal: On file-sharing networks, small files (pictures, e-books...) are usually shared as compressed archives. Over time, parts of these archives can become unavailable, and since most people who downloaded the original archive extracted the individual files and then deleted them, even someone who does have all the missing files can no longer share the original archive, so anyone attempting to download it at that point will get stuck with an unusable partial file. Some such archives can have many sources but not a single complete one. If someone who has all the files from the original archive creates a new archive, if it's different from the original archive even by a single byte it won't be identified by the same hash, and those people won't be notified so that new archive won't be shared efficiently.
I have already managed to re-create uncompressed ZIP / RAR archives, so as to share them again, by copying the contents of missing files and editing their metadata to match that of files in available parts, until the archive's hash matches that of the original; I have also managed to re-create a few not-too-old RAR archives. But I'm at a loss when it comes to compressed ZIP archives, as there are many utilities that can create them, each seemingly using its own set of algorithms and parameters. Also, some of those archives were created 10+ years ago, making it even more tricky to find out what was used to create them. And if the answer to the second question above is “yes”, then it would be next to impossible to re-create those 10+ years old archives on my ~2017 computer; if the answer is “no”, then I may have a shot, provided that I can actually track down the corresponding executable (preferably as CLI, or at least “portable” GUI, which is another caveat — I looked at old versions of WinZIP which I still have on CDs, they seem to require a full-blown install to be usable, no CLI version is included, contrary to WinRAR which includes rar.exe as a CLI equivalent).
Example: One such incomplete ZIP archive has a size of 372MB, with 18MB missing. Based on the files' timestamps, it was probably created around 2003. I identified a picture set contained within a missing part in another archive: fortunately, the timestamps seem to be exactly the same, but unfortunately, the compression parameters aren't the same, the compressed sizes are different and the binary contents won't match. So I uncompressed that set, and attempted to re-compress it as ZIP using WinRAR and 7-Zip (currently installed versions), testing with all the available parameters, and checked if the output matched (each file should have the exact same compressed size and the same binary content when examined with a hex editor), but I couldn't get that result. So the incomplete archive was probably created with different software and/or version, using a different compression algorithm.
Now, is it possible to know exactly, by examining the general header, individual files' headers, and other structures, what specific application was used to create it, and with which exact parameters, so as to re-create the original? Again, does the hardware have any bearing on the outcome, for instance, if using a mono-core or multi-core CPU, or a CPU featuring or not featuring a specific set of instructions?
The header of the ZIP file mentioned above is as follows :
50 4B 03 04 14 00 02 00 08 00 B2 7A B3 2C 4C 5D 98 15 F1 4F 01 00 65 50 01 00 1F 00 00 00
I tried to search for information about the ZIP format header structure, but so far came up with nothing conclusive with regards to what I'm looking for.
Yet another caveat with RAR archives is that they don't seem to have a complete index of their contents in the header or footer (contrary to ZIP archives), if I'm not mistaken, each file is referenced only by its own header, making it even more difficult to figure out what used to be in the missing parts, if the archive is a bit complex and has many subfolders.
EDIT: As I replied in a comment below, the goal is not so much to know with certainty which version of which program was used to generate a particular archive, but being able to re-generate that archive from a partial download and the individual files corresponding to the missing parts. If, for instance, the archive was created using WinZIP X.Y, but 7-Zip X.Y released a year later happened to implement the same version of the ZIP algorithm, while giving control over key settings which produced that specific compression outcome, then it should do the trick just as well. But so far, the few programs/versions I tested all produced different results.