Archives

Send an archive and livewells opens it, lists every file inside and hands each file to the reader for its type. All files from one archive stay in one case.

Send an archive

Send the archive on the Upload a file tab, or through the API.

livewells reads the type from the content of the file, whatever the extension says.

Locked archives

Many teams lock a suspicious archive with the password infected. This holds for ZIP, 7z and RAR files. Send the password with the archive. livewells uses it on the archive and on every locked archive inside it.

• You can send up to 3 passwords. livewells tries them in the order given.
• livewells keeps a password in memory for one check.
• When the password is missing or wrong, the case shows This file is locked. Every file stays closed until a password works.

For a locked archive of a kind that livewells cannot open, the case shows the flag "This archive is locked in a way livewells cannot open." Send an unlocked copy or a ZIP copy.

What you see

For every file that livewells opens, the case shows:

• the name, with every dot and at-sign broken (for example invoice[.]example[.]com.txt),
• the type, read from the content,
• the size,
• the start of the SHA-256 hash. The full hash is in the case indicators.

Each opened file becomes an item of the same case. The matching reader opens it: email, QR code, HTML, PDF or Office. livewells hashes and lists a file of any other type.

Names and links

livewells opens a file only when its name stays inside the archive. A file with one of these names is listed with a flag and stays closed:

• a name that starts at the top of a disk, such as /etc/x or C:\x,
• a name that climbs out of its folder with ..,
• a name that holds a hidden end mark.

A link, a hard link, a device or another special file in an archive is listed with a flag. livewells leaves it where it is.

An archive that holds two files with one name, files that share the same bytes, or a directory that disagrees with its file headers gets the flag "This archive is built to confuse programs that open it." Its files stay closed.

Limits

When an archive passes a limit, the report says so. The case shows the flag "This archive is larger or deeper than livewells opens. Some files were not opened."

Flags