ZIP File Header Analysis
ZIP headers can answer useful triage questions before you search for a password: is the container recognizable, which entries are encrypted, and is an AES extra field present? Read metadata on a copy and treat it as evidence, not a recovery result.
The metadata worth checking
A ZIP local file header and central directory record describe each entry's flags, compression method, sizes, and extra fields. The general-purpose bit flag can indicate encryption, while WinZip AES metadata uses an extra field associated with method 99.
A parser that cannot find a consistent local header, central directory, or end record may be looking at a truncated file or a different format. Do not infer encryption from random bytes alone.
Entry flag
Encryption indicator
Method
Stored / deflated / AES marker
Extra field
May describe AES
End record
Container integrity clue
Why headers can mislead
A ZIP can contain encrypted and unencrypted entries, and the central directory may be damaged even when a local header remains. Some tools recover a listing from partial metadata, while others refuse the file entirely.
Use a trusted utility and compare multiple entries. Header evidence should guide your next step, then a real extraction or integrity test must confirm it.
Keep sensitive evidence private
Headers may reveal filenames, paths, timestamps, and sizes even when file contents are encrypted. Avoid posting hex dumps that include names or proprietary data to public forums.
Frequently asked questions
How can I tell if a ZIP entry is encrypted?
What does ZIP method 99 mean?
Can header analysis recover a ZIP password?
Primary references
Format behavior changes over time. These references are the starting points for the technical details on this page.
Need a second opinion on your archive?
Run the free local analyzer first. If the archive is healthy and you are authorized to recover it, you can compare the evidence with a specialist's supported workflow.