How to check compression type by reading header file not by extension

Without the compression tool itself, we can identify the type of compression file by its extension, whether it’s a ZIP, RAR, 7Z, etc.

And the other way is by reading some bytes of the top part of the file. Each compression tool’s type has its own signature, usually in the first some bytes, which we can see if we open the file in Hex View as image above.

As shown above, files created in ZIP format will have signature “PK…”, RAR format will begin with “Rar!..” and SevenZip (7z) will has “7z…”

Using this information, we will create a function to open a file, read some bytes, compare with above information, and produce the result.

Below the snippet, coded in Delphi XE2 (should work with other Delphi, taking care of the “string” type);

function CompressionType(pFilename: TFileName): integer;
  lS: AnsiString;
  if FileExists(pFilename) then begin
    with TFileStream.Create(pFilename, fmOpenRead or fmShareDenyWrite) do
        SetLength(lS, 10);
        Read(lS[1], 10);
    if Copy(lS, 1, 5) = #$52 + #$61 + #$72 + #$21 + #$1A { "Rar!." } then // rar r00 r..
      Result := 1
    else if Copy(lS, 1, 5) = #$37 + #$7A + #$BC + #$AF + #$27 { "7z..." } then // 7z
      Result := 2
    else if Copy(lS, 1, 5) = #$50 + #$4B + #$03 + #$04 + #$14 { "PK..." } then    
      Result := 3
      Result := 0; // Not Supported
    Result := -1; // Not Existing file

By calling CompressionType() we will have:

Return Value   Description
-------------  ------------------------------------------
   -1          for some reasons, file could not be found
    0          file is not recognized
    1          RAR file
    2          7z file
    3          Zip file

Using the code above, we can check other type of file eg. PDF, ACE, by first identified their signatures.

Files .jar, .xpi, .docx are some files that actually created in ZIP format.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top