isc.sans.edu 7/31/2026, 1:48:14 PM · external

zipdump.py: Metadata Encoding, (Fri, Jul 31st)

zipdump.py: Metadata Encoding, (Fri, Jul 31st)
CyberSIXT Evidence Panel Source marked as original reporting

THE blog post by Didier Stevens discusses the use of `zipdump.py` for analyzing ZIP files, specifically focusing on metadata encoding of filenames. The script utilizes Python libraries `zipfile` and `pyzipper` to parse ZIP files and decode metadata accurately. It introduces the `--metadata_encoding` option, which allows users to specify the codec for converting byte strings to readable filenames, important for handling different encodings like UTF-8 or ASCII.

The author highlights the necessity of knowing the correct encoding based on ZIP file flags, particularly flag 0x0800 for UTF-8. A demonstration of the tool’s capabilities using example screenshots illustrates how incorrect codec specifications can lead to misinterpretation of filenames.

View full article

Article by CyberSIXT