ZIP File Header Analysis
ZIP headers answer useful triage questions before you search for a password: is the container recognisable, which entries are encrypted, and is an AES extra field present? Read the metadata on a copy, and treat it as evidence rather than a recovery result.
The metadata worth checking
A ZIP local file header and central directory record describe each entry's flags, compression method, sizes and extra fields. The general-purpose bit flag can indicate encryption, while WinZip AES metadata uses an extra field associated with method 99.
A parser that cannot find a consistent local header, central directory or end record may be looking at a truncated file or a different format. Do not infer encryption from random bytes alone.
Entry flag
Encryption indicator
Method
Stored / deflated / AES marker
Extra field
May describe AES
End record
Container integrity clue
Why headers can mislead
A ZIP can contain both encrypted and unencrypted entries, and the central directory can be damaged even when a local header survives. Some tools recover a listing from partial metadata; others refuse the file entirely.
Use a trusted utility and compare several entries. Header evidence should guide the next step, then a real extraction or integrity test must confirm it.
Keep sensitive evidence private
Headers may reveal filenames, paths, timestamps and sizes even when the file contents are encrypted. Avoid posting hex dumps that include names or proprietary data to public forums.
Frequently asked questions
How can I tell if a ZIP entry is encrypted?
What does ZIP method 99 mean?
Can header analysis recover a ZIP password?
Primary references
Format behavior changes over time. These references are the starting points for the technical details on this page.
Need a second opinion on this file?
Run the free local check first. If the file is healthy and you are authorized to recover it, you can compare the evidence with a specialist's supported workflow.
Related guides
For authorized owner use only. Recovery depends on the exact file and password; no outcome is guaranteed. FilesUnlock is a separate product from the recovery service that processes submissions.