The extra area at the end of a header is
a list of records. Each record is a vint size (counted from the type field
to the end of the record), a vint type and the data. A reader skips
records whose type it does not know. The meaning of a type depends on the header it is
in.
Main archive header records
Locator (type 01)
| Field | Type | Description |
|---|---|---|
| Flags | vint | 0001 quick open offset present; 0002 recovery record offset present. |
| Quick open offset | vint | Only with 0001: distance from the start of the main archive header to the quick open service header. 0 means none; the field may be left at 0 if the space reserved for it was too small. |
| Recovery record offset | vint | Only with 0002: distance from the main archive header to the recovery record, with the same rules. |
Metadata (type 02)
| Field | Type | Description |
|---|---|---|
| Flags | vint | 0001 archive name present; 0002 creation time present; 0004 the time is Unix format, otherwise Windows FILETIME; 0008 the Unix time has nanoseconds, otherwise seconds. |
| Name length | vint | Only with 0001. |
| Name | … | The archive’s original name, UTF-8 with no NUL. Space reserved but unused is filled with zeros, so the name ends at the first zero; a zero first byte means no name. |
| Time | 4 or 8 bytes | Only with 0002: the archive’s original creation time. Unix seconds take 4 bytes; Unix nanoseconds and FILETIME take 8. |
File and service header records
| Type | Record |
|---|---|
01 | File encryption |
02 | File hash |
03 | File time |
04 | File version |
05 | Redirection |
06 | Unix owner |
07 | Service data |
File encryption (01)
| Field | Type | Description |
|---|---|---|
| Version | vint | 0: AES-256. |
| Flags | vint | 0001 password check data present; 0002 tweaked checksums: the data CRC32 and hash are changed using the key, so they reveal nothing about the plain data. |
| KDF count | byte | Binary logarithm of the PBKDF2 iteration count. |
| Salt | 16 bytes | |
| IV | 16 bytes | AES initialisation vector. |
| Check value | 12 bytes | Only with 0001; as in the archive encryption header. |
File hash (02)
| Field | Type | Description |
|---|---|---|
| Hash type | vint | 0: BLAKE2sp, the only one defined. |
| Hash data | 32 bytes | The BLAKE2sp hash of the unpacked data; for a split file, every part but the last holds the hash of that volume’s packed data. |
File time (03)
| Field | Type | Description |
|---|---|---|
| Flags | vint | 0001 Unix time_t format, otherwise Windows FILETIME; 0002 mtime present; 0004 ctime present; 0008 atime present; 0010 Unix format with nanosecond precision. |
| mtime | uint32 or uint64 | Modification time: uint32 in Unix format, uint64 FILETIME otherwise. |
| ctime | uint32 or uint64 | Creation time. |
| atime | uint32 or uint64 | Last access time. |
| mtime nanoseconds | uint32 | Only with 0001, 0002 and 0010. |
| ctime nanoseconds | uint32 | Only with 0001, 0004 and 0010. |
| atime nanoseconds | uint32 | Only with 0001, 0008 and 0010. |
File version (04)
| Field | Type | Description |
|---|---|---|
| Flags | vint | None defined; 0. |
| Version number | vint | The file’s version, when the archive keeps older versions of files. |
Redirection (05)
| Field | Type | Description |
|---|---|---|
| Redirection type | vint | 1 Unix symbolic link; 2 Windows symbolic link; 3 Windows junction; 4 hard link; 5 file copy (the data is a copy of another file in the archive). |
| Flags | vint | 0001: the target is a directory. |
| Name length | vint | |
| Name | … | The link target, UTF-8, no NUL. |
Unix owner (06)
| Field | Type | Description |
|---|---|---|
| Flags | vint | 0001 user name present; 0002 group name present; 0004 numeric user ID present; 0008 numeric group ID present. |
| User name length, user name | vint, bytes | Only with 0001; in the system’s own encoding, no NUL. |
| Group name length, group name | vint, bytes | Only with 0002. |
| User ID | vint | Only with 0004. |
| Group ID | vint | Only with 0008. |
Service data (07)
Data whose meaning depends on the service header it belongs to.
Service headers
A service header (type 3) has the fields of a file header; its name says what it holds.
| Name | Holds |
|---|---|
CMT | The archive comment, UTF-8. Stored (method 0), packed and unpacked sizes equal. Placed after the main archive header, before the first file. |
QO | Quick open data, below. Stored. Placed after all file headers and before the recovery record; the locator record can point to it. |
ACL | NTFS permissions of the file before it. The layout is not described in the note. |
STM | An NTFS alternate data stream of the file before it. The layout is not described. |
RR | The recovery record. The layout is not described. |
Quick open data
The QO service data is an array of records that cache copies of headers, so a program can list a large archive without reading all of it.
| Field | Type | Description |
|---|---|---|
| Structure CRC32 | uint32 | CRC-32 of the record from the size field on. |
| Structure size | vint | Size from the flags field to the end; at most 3 bytes. |
| Flags | vint | Currently 0. |
| Offset | vint | Distance from the start of the quick open header back to the archive data this record copies. Offsets increase through the array. |
| Data size | vint | |
| Data | … | The copied bytes, usually file and service headers. |
If a cached header is missing or its CRC is wrong, the reader goes to the original position. A program must use the quick open data for both listing and extracting, or for neither, or it could show one name and extract a different file.