ZIP archive inspector

A ZIP stores each file twice in terms of metadata: once in a local header before the data, and once in a central directory at the end. Extraction tools read the central directory. That redundancy is exactly what challenges exploit.

Hiding by disagreement

If an entry exists in the archive with a local header but is omitted from the central directory, unzip will not list it or extract it - but the data is right there. Comparing the two listings surfaces anything hidden this way, and the mismatch is itself the signal that something was done deliberately.

• Entries in local headers but not the central directory - hidden files.
• Size or CRC mismatches between the two - tampering, or a corrupted archive to repair.
• A per-entry encryption flag - only some entries are encrypted, so the others come out for free.
• Compression method 0 (stored) - the data is uncompressed, so strings works directly on the archive.