create a directory D containing directory E. In E create files F1 and F2. Turn D into a zip file.
Examining this zip file using python and the zipfile module, or 7zip using the CLI flag to get technical info (ie. 7z -l -slt D.zip) shows you the same thing, two files and a directory. Using the 7z CLI, I get something like this:
Path = DE
Folder = +
Size = 0
Packed Size = 0
Modified = 2024-05-11 19:32:56
[...]
Path = DEF1.txt
Folder = -
Size = 2
Packed Size = 2
Modified = 2024-05-11 19:26:06
[...]
Path = DEF2.txt
Folder = -
Size = 5
Packed Size = 5
Modified = 2024-05-11 19:26:24
[...]
So the two files F1 and F2 have a ‘Modified’ metadata field, but the important point here is, so does the folder E (the first in the list above).
Now the interesting stuff. I received a .zip file which is supposed to contain legal evidence. When extracted, it creates eight files in three subdirectories. The eight files have plausible ‘Modified’ metadata dates, but the three subdirectories have no date metadata (or any other), whether I look with python+zipfile or 7zip.
I am extremely interested in the creation dates of these three directories because I’m wondering if someone unzipped the original, deleted a file or two and then zipped them back up and sent them to me, stripping off the directory creation time to hide the fiddle.
Reading up on the format, it seems that metadata in .zip files is stored in two places
“The .ZIP format … includes two copies of each entry metadata to
provide greater protection against data loss”
https://en.wikipedia.org/wiki/ZIP_(file_format). So I guess the files are being read back using the local header data, but the directory/folder info would only live in the zipfile’s Central Directory (CD).
I guess the CD is missing.
So the questions are:
-
does this (CD absent) seem like a plausible explanation for not being albe to get the directory/folder metadata?
-
very importantly, is there any common compression utility that would produce a .zip file without the Central Directory? The 7zip and Windows zip (built into Explorer) do make a CD.