5

I have a very large number of files (tens of thousands) who's binary all begins with 0x00 0x06. They do not open with 7-ZIP. I notice also that all Office files seem to share the same next 32 bytes.

A03D8B002E542C0DE10000C41EF0016000007FFF120030483E09F883AD3C0362

It is a very old format, so I cannot find a decompression program, and do not even know how to confirm that it is the indeed an old PKZIP format.

The compressed file is indeed compressed by about 50%.

3
  • Do the file contents start with PK?
    – Avery3R
    Commented Jan 7, 2020 at 21:36
  • 1
    No, with 0x00 0x06 Commented Jan 7, 2020 at 21:39
  • Do you have the application that created those files ? Can you share one of them ? There are plenty of pkzip-like compression programs out there, so we would need more context to actually provide something meaningful.
    – tibar
    Commented Jan 13, 2020 at 8:20

2 Answers 2

2

On Linux, creating a fake file using

perl -e 'print "\x00\x06\xde\xad\xbe\xef";' > foo

and running file foo yields

foo: TTComp archive data

Then it's easy: http://fileformats.archiveteam.org/wiki/TTComp_archive which says that it used the early PKWARE "implode" algorithm

DCL Implode is not the same format as ZIP's old "implode" compression method (#6). It is unfortunate that there are two formats named "implode" associated with the same company. It can be used in ZIP, as compression method #10, but support for this is limited.

The terms "blast" and "explode" are sometimes used in association with this format.

There are decoders for it, for example this one written in Go.

1

I would first confirm the file format. Without the entire file this is difficult. Recommend you run the application through a signature based identification program to identify matches.

For example TridNet which detects over 12,000 different file types:

TriDNet Online TriDNet

Based on the file bytes provided (which may not be sufficient to determine) expect file type is TTComp archive compressed (bin-4K).

If TTComp format, the first byte 0x0 indicates binary file; 0x06 indicates a 4096 byte dictionary which was the most common size dictionary for this file type. These files can be decompressed with TTDecomp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.