Inspect an archive before you extract it
5 min readUpdated May 2026
Most archives are exactly what they look like. The ones that are not tend to give themselves away in the listing, and reading a listing takes about as long as reading an email. This is the checklist we run before extracting anything that arrived from outside — short enough to actually use, and specific enough to catch the common cases.
1. Start with who sent it and why
Context beats technology here. Were you expecting this file? Does the sender normally send you archives, and does the reason given match something you actually did? An unexpected invoice.zip, scan_0432.zip or CV.zip from an address you do not recognise is the single most reliable warning sign there is.
Be sceptical of an archive that arrives with its password in the body of the same message. There is no security benefit — anyone reading the mail has both halves — and the only thing that changes is that the mail gateway can no longer scan the contents. That combination is a technique, not a precaution.
2. List the contents without extracting
Every archive tool can show the listing without writing anything to disk: unzip -l archive.zip on the command line, the preview pane in most GUI archivers, or a browser-based viewer like this one. Listing reads only the index at the end of the file, so it is fast and it never runs anything.
Look at the shape first. How many entries are there, and does that match what the sender described? A one-page invoice should not be 400 files. A photo album should not contain a bin/ directory. Names that are meaningless strings, or one deeply nested path leading to a single file, are both worth a pause.
Then read the names literally. Anything containing .., starting with / or C:\, or using backslashes is malformed on purpose. A well-behaved archiver cannot produce those names, so their presence means someone edited the archive by hand.
3. Check the extensions, including the ones you cannot see
Windows Explorer hides known file extensions by default, so an entry named invoice-2026-04.pdf.exe appears in the extracted folder as invoice-2026-04.pdf with a slightly odd icon. This trick is thirty years old and still works, because the setting is still on by default.
Beyond .exe, treat .scr, .com, .pif, .bat, .cmd, .msi, .vbs, .js, .jse, .wsf, .hta, .ps1 and .lnk as executables, because Windows does. A .lnk shortcut is particularly easy to underestimate: it carries a command line, and clicking it runs that command.
On macOS and Linux the equivalents are .app bundles, .pkg and .dmg installers, and shell scripts with the executable bit set in the archive's Unix mode field. The bit survives extraction, so a script in an archive can arrive ready to run.
4. Compare the sizes
A listing shows both the packed and the unpacked size of each entry. Add up the unpacked column and make sure you actually have that much free space, then look for individual entries whose ratio is extreme — more than a hundredfold expansion in a file that is not a log or a disk image deserves an explanation.
The opposite signal is also useful. An archive whose entries are all stored uncompressed is either full of media, or was assembled by something that did not bother to compress — which is common in automatically generated malicious archives.
5. Notice archives inside archives
A ZIP containing a ZIP containing a RAR is not how people share holiday photos. Layering exists to defeat scanners that only look one level deep, and it costs the sender nothing. One nested archive is ordinary; three levels of them, each with a single child, is a pattern.
A viewer that can open a nested archive in place is useful here, because you can keep reading names downwards without ever writing the intermediate layers to disk.
6. If you still need to open it, make it disposable
When the archive has to be opened and you are not comfortable with it, extract into a new empty directory rather than your Downloads folder — that limits what an overwrite can reach and makes it trivial to delete everything afterwards. Do not extract into a synced folder; a malicious file replicated to every device is a worse problem than a local one.
For anything you genuinely suspect, use a disposable environment: a virtual machine you can roll back, a container, or a service like a sandboxed analyser. Windows Sandbox and a throwaway VM snapshot both take a couple of minutes to set up and remove the question entirely.
And if you only need one file out of the archive — a single PDF, one image, one config — take just that one. Extracting a single entry cannot create directories, cannot follow a symlink and cannot overwrite anything you did not choose.
The takeaway
Listing an archive costs seconds and answers most of the questions: who sent it, how many files, what extensions, how much it expands to, and whether any name is trying to escape. Extract only after that — and, when you can, extract only the one file you actually need.
Open an archive and look inside before you extract it
More guides
How ZIP compression works: DEFLATE explained
What is actually inside a .zip, how DEFLATE finds repetition, why a folder of JPEGs barely shrinks, and what ZIP64 and the encryption schemes change.
6 min read
Zip Slip, zip bombs and malicious archives
An archive entry is not a file — it is an instruction a program chooses to follow. How that gets abused, from path traversal to 42.zip, and the defences.
6 min read