zipfile-entries

Retrieves the list of file entries contained in the specified ZIP file. Returns metadata for each entry including file name, size, compressed size, and modification time.

Command properties

Property	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

zipfile-entries [charset=STR] FILE_PATH

Options

charset=STR: Character set for ZIP file entry names. Can also be specified using the cs alias. (Default: utf-8)

Target

FILE_PATH: Path to the ZIP file to query. You can use a wildcard (*) to specify multiple files.

Output fields

Field	Type	Description
`zip_path`	string	Absolute path to the ZIP file
`entry`	string	File name of the ZIP entry
`file_size`	long	Original file size in bytes
`compressed_size`	long	Compressed file size in bytes
`modified_at`	timestamp	File last modification time
`comment`	string	ZIP entry comment

Error codes

Parsing errors

N/A

Runtime errors

Error code	Message	Description	Post-processing action
-	-	The ZIP file cannot be read	Stops query execution

Description

The zipfile-entries command opens the specified ZIP file and retrieves metadata for all file entries inside it. The actual content of the files is not read; only information such as entry name, file size, compressed size, modification time, and comment is returned.

Using a wildcard, you can retrieve entries from multiple ZIP files at once. Because each entry includes a zip_path field, you can identify which ZIP file each entry belongs to.

If the character set option is not specified, the value of the logpresso.forensic.zip_charset system property is used. If that property is also not set, utf-8 is used as the default.

Examples

Retrieve the entry list from a ZIP file
```
zipfile-entries /opt/logpresso/evidence/logs.zip
```
Retrieves the list of all file entries in the specified ZIP file.
Retrieve entries with a specified character set
```
zipfile-entries charset=euc-kr /opt/logpresso/evidence/logs.zip
```
Correctly decodes entry names encoded in EUC-KR.
Retrieve entries from multiple ZIP files
```
zipfile-entries /opt/logpresso/evidence/*.zip
```
Retrieves entry lists from all ZIP files in the specified directory.
Filter entries by a specific extension
```
zipfile-entries /opt/logpresso/evidence/logs.zip
| search entry == "*.evtx"
```
Filters for entries with the EVTX extension from the ZIP file.