Re: (tye)Re: How to tell if something is encrypted

You will often need to store some uncompressed information in a compressed file. Information about the compressed data (length, flags, etc.) is usually uncompressed. Integers within the header may contain a 0x00 because of an unused high order byte, and flags often use 0 as the default value. You can usually count on a header being at the beginning of the file, so you will probably find a few 0x00's at the beginning of a compressed file, and because there may be additional headers for additional compressed blocks throughout the file, there will not be a random distribution of 0x00's throughout the file.

Comment on Re: (tye)Re: How to tell if something is encrypted

Replies are listed 'Best First'.
(tye)Re2: How to tell if something is encrypted by tye (Sage) on Apr 18, 2001 at 23:31 UTC
"zip" files fit your description quite nicely (I can't believe that having 20 of the first 29 bytes of a file be zero makes sense when you are trying to compress things -- like I said, they aren't doing the best compression they could). The "gzip" files I checked had about 2 zero bytes in the first 10 bytes. This is much more reasonable in my book but also fits your description so... I conceed the point; you are right. (: - tye (but my friends call me "Tye")	[reply]
Re (tilly): (tye)Re2: How to tell if something is encrypted by tilly (Archbishop) on Apr 19, 2001 at 22:52 UTC
Think of zip as being taking a tar of gzipped files. Sure the compression is not as good as gzipping a tar. But you can list contents and extract any given file without having to decompress the whole thing. Sometimes space saved is not the only consideration when compressing things. :-)	[reply]