Archives and document containers as evidence

Mechanism

Office documents, application packages, and many media formats are structured containers. Their members may include relationships, revision metadata, thumbnails, embedded objects, scripts, and alternate representations. Inspect the container directly before opening it in an application that may render active content or update metadata.

Practical method

List members, compressed sizes, and paths. Extract selected members into a separate workspace while rejecting absolute and parent-relative paths. Follow document relationships and identify external resources. Compare visible text with embedded metadata and revision artifacts.

import zipfile
with zipfile.ZipFile("document.docx") as z:
    for info in z.infolist():
        print(info.filename, info.file_size, info.compress_size)

Interpreting evidence

A hidden object or external relationship is an analysis lead, not evidence of execution. Record the member path and bytes that support the finding, and distinguish active macros from ordinary document XML.

Pitfalls and limits

ZIP bombs exploit expansion ratios. Duplicate member names can confuse parsers. Archive traversal and symlink entries can escape naive extraction roots; do not unpack all entries blindly.