[ale] unzipping an encrypted zip file

[Greg Freemyer]

On Thu, Aug 6, 2009 at 4:20 PM, Michael H. Warfield<mhw at wittsend.com> wrote:
> On Thu, 2009-08-06 at 15:36 -0400, Greg Freemyer wrote:
>> All,
>
>> I need to unzip an encrypted zip file.  What tool should I use.  (And
>> yes windows is available, but I hate to give in and ask a co-worker to
>> do it for me.)
>
>> First attempt:
>> $ unzip fileserver_sec_log.zip
>> Archive:  fileserver_sec_log.zip
>>   End-of-central-directory signature not found.  Either this file is not
>>   a zipfile, or it constitutes one disk of a multi-part archive.  In the
>>   latter case the central directory and zipfile comment will be found on
>>   the last disk(s) of this archive.
>> unzip:  cannot find zipfile directory in one of fileserver_sec_log.zip or
>>         fileserver_sec_log.zip.zip, and cannot find
>> fileserver_sec_log.zip.ZIP, period.
>
>        What is it "encrypted" with?  I deal with encrypted zip files all the
> time (generally malware samples to study) and simply running unzip -l on
> the archive will still give you a listing of the archive (the "central
> directory" is not encrypted) but you need the password to extract the
> files.  This sounds like it's either externally encrypted or corrupt or
> there's a new zip encryption method in town.
>
>> Greg
>
>        Mike

Mike,

Turns out the zip file was corrupted when I pulled it off the email somehow.

How I get:

# unzip fileserver_sec_log.zip
Archive:  fileserver_sec_log.zip
   skipping: fileserver_genetics_sec_log.txt  unsupported compression method 99

The file was zipped with a current version of winzip I believe.  I
actually gave up and unzipped it via my co-workers pc / winzip.  It
worked fine, but I'm still curious.

Greg
-- 
Greg Freemyer
Head of EDD Tape Extraction and Processing team
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
Preservation and Forensic processing of Exchange Repositories White Paper -
<http://www.norcrossgroup.com/forms/whitepapers/tng_whitepaper_fpe.html>

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com