2013-12-05_tcpflow-and-BE-update

zip.txt — potential zipfile headersZIP has become the defacto archive format.• zip, jar, docx, pptx, etc.• ZIP64 provides for files larger than 4GiB• Allows faster access to components that .tar.gzFOOBARFOOBARzipfilestructurebulk_extractor finds “local file headers.”LocalHeaderDatalocal file header signature 4 bytes (0x04034b50)version needed to extract 2 bytesgeneral purpose bit flag 2 bytescompression method2 byteslast mod file time2 byteslast mod file date2 bytescrc-324 bytes validation for accuracy!compressed size4 bytesuncompressed size4 bytesfile name length2 bytesextra field length2 bytesfile name(variable size)extra field(variable size)CentralDirectory49