Usually, I unarchive things by $ mkdir newFolder; $ mv *.zip newFolder; $ cd newFolder; $unzip *.zip but sometimes I get lazy and just do in an arbitrary folder $ unzip *.zip so time-to-time messing up with other content. I will list here some methods -- some archive version surely have crappy-flags while others more spartan, I am more interested about the latter.

Some ways to de-unarchive, are there others?

  1. $ find . -anewer fileThatExistedBeforeUnarchieving -ok rm '{}' \; Weaknesses are that it lists the *.zip dirs, so you need to use slow -ok, slow with many *.zip matches and, for some reason, it does not seem to match everything extracted.

  2. If small amount of extracted files, one-by-one, slow, cumbersome and error-prone.

  3. When I want to make sure whether the content of the archieve is actually a folder, I sometimes check it with $ unzip -l *.bsd, works at least in obsd`s unzip-version.

If you are referring to certain archiving tools, please, state them when appropriate. Keep it simple though -- I am more interested about the WAYS how you do it, rather than a single tool.


6 Answers 6


By name

You can generate the list of files in the archive and delete them, though this is annoyingly fiddly with archivers such as unzip or 7z that don't have an option to generate a plain list of file names. Even with tar, this assumes there are no newlines in file names.

tar tf foo.tar | while read -r file; do rm -- "$file" done
unzip -l foo.zip | awk '
    p && /^ --/ {p=2}
    p==1 {print substr($0, 29)}
    /^ --/ {++p}
' | while …
unzip -l foo.zip | tail -n +4 | head -n -2 | while …  # GNU coreutils only
7z l -slt foo.zip | sed -n 's/^Path = //p' | while …  # works on tar.*, zip, 7z and more

Instead of removing the files, you could move them to their intended destination.

tar tf foo.tar | while read -r file; do
  if [ -d "$file" ]; then continue; fi
  mkdir -p "/intended/destination/${file%/*}"
  mv -- "$file" "/intended/destination/$file"

Using FUSE

Instead of depending on external tools, you can (on most unices) use FUSE to manipulate archives using ordinary filesystem commands.

You can use Fuse-zip to peek into a zip, extract it with cp, list its contents with find, etc.

mkdir /tmp/foo.d
fuse-zip foo.zip /tmp/foo.d
## Remove the files that were extracted mistakenly (GNU/BSD find)
(cd /tmp/foo.d && find . \! -type d -print0) | xargs -0 rm
## Remove the files that were extracted mistakenly (zsh)
rm /tmp/foo.d/**(:"s~/tmp/foo.d/~~"^/)
## Extract the contents where you really want them
cp -Rp /tmp/foo.d /intended/destination
fusermount -u foo.d
rmdir foo.d

AVFS creates a view of your entire directory hierarchy where all archives have an associated directory (same name with # tacked on at the end) that appears to hold the archive content.

## Remove the files that were extracted mistakenly (GNU/BSD find)
(cd ~/.avfs/"$PWD/foo.zip#" && find . \! -type d -print0) | xargs -0 rm
## Remove the files that were extracted mistakenly (zsh)
rm ~/.avfs/$PWD/foo.zip\#/**/*(:"s~$HOME/.avfs/$PWD/foo.zip#~~"^/)
## Extract the contents where you really want them
cp -Rp ~/.avfs/"$PWD/foo.zip#" /intended/destination

By date

Assuming there hasn't been other any activity in the same hierarchy than your extraction, you can tell the extracted files by their recent ctime. If you just created or moved the zip file, you can use it as a cutoff; otherwise use ls -lctr to determine a suitable cutoff time. If you want to make sure not to remove the zips, there's no reason to do any manual approval: find is perfectly capable of excluding them. Here are example commands using zsh or find; note that the -cmin and -cnewer primaries are not in POSIX but exist on Linux (and other systems with GNU find), *BSD and OSX.

find . \! -name '*.zip' -type f -cmin -5 -exec rm {} +  # extracted <5 min ago
rm **/*~*.zip(.cm-6)  # zsh, extracted ≤5 min ago
find . -type f -cnewer foo.zip -exec rm {} +  # created or moved after foo.zip

With GNU find, FreeBSD and OSX, another way to specify the cutoff time is to create a file and use touch to set its mtime to the cutoff time.

touch -d … cutoff
find . -type f -newercm cutoff -delete

Instead of removing the files, you could move them to their intended destination. Here's a way with GNU/*BSD/OSX find, creating directories in the destination as needed.

find . \! -name . -cmin -5 -type f -exec sh -c '
    for x; do
      mkdir -p "$0/${x%/*}"
      mv "$x" "$0/$x"
  ' /intended/destination {} +

Zsh equivalent (almost: this one reproduces the entire directory hierarchy, not just the directories that will contain files):

autoload zmv
mkdir -p ./**/*(/cm-3:s"|.|/intended/destination|")
zmv -Q '(**/)(*)(.cm-3)' /intended/destination/'$1$2'

Warning, I haven't tested most of the commands in this answer. Always review the list of files before removing (run echo first, then rm if it's ok).

  • I finally run into this problem today. As root! In the end I used a combination of "By name" and "By date"
    – phunehehe
    Jan 31, 2011 at 8:58

I'm feeling stupid, anyway I scratched my head to write up this script when I had a similar problem. I used cpio with the -it flag to get a list of files; you can use equivalent commands for other archivers. The tricky part is, the cpio archive is from an initrd and I extracted into /, so many folders and files have the same name as in a working system. Luckily cpio didn't overwrite any of my existing files. I use a time check to ensure not to delete anything that existed before the wrong command.

#! /bin/sh

files=$(cpio -it < /mnt/temp/lglive.cpio)

for i in ${files}
    name=$(stat -c "%n" ${i})
    time=$(stat -c "%Y" ${i})
    # Time of the creation of the mess: 1296457595
    if [[ ${time} -gt 1296457590 && ${time} -lt 1296457600 ]]
        if [[ -f ${name} ]]
        # If it is a file, it must have been created as part of the mess.
            echo "rm ${name}"
        elif [[ -d ${name} ]]
        # If it is a directory, it may have been part of the mess
        # or maybe some files underneath it is created as part of the mess.
            if [[ $(ls -A ${name}) ]]
            # If the directory contains something then don't delete it.
                echo "${name} is not empty"
            # If the directory is empty then assume it is rubbish.
                echo "rmdir ${name}"

echo "Files and directories still exist after the removal:"
for i in ${files}
    if [[ -e ${i} ]]
        echo ${i}

How about feeding the list of files in archive to xargs rm?

That would be tar -tf tarbomb.tar | xargs rm or unzip --list zipbomb.zip | xargs rm.

  • 2
    The commands as given won't work in the general case, and this is dangerous since you're removing files. xargs expects its input quoted in a peculiar way that find does not produce. Use xargs -I rm {} so that xargs processes one item per line instead. For the unzip command, what implementation do you have? Mine (Debian/Ubuntu) doesn't have --list, only -l, and it doesn't just print file names, so that extra processing is needed. Dec 24, 2010 at 13:53
  • @Gilles: 1) yes, it's dangerous, but since we've presumably overwritten the original files -- they're already gone. 2) I wasn't talking about find. 3) you are correct about unzip, I didn't test and there seem to be no option for undecorated listing. No --list on my Ubuntu as well -- I just didn't test.
    – alex
    Dec 24, 2010 at 18:52
  • Sorry about the canned response, substitute tar -t for find. But my other points stand. There is a real risk that your command as given would delete an unrelated file. Dec 26, 2010 at 10:53
  • tar -tf tarbomb.tar will print file names one per line, so you could do tar -tf tarbomb.tar | while IFS=$'\n' read -r filename; do rm "$filename"; done or similar.
    – Mikel
    Jan 24, 2011 at 22:44

Not really what you asked for but how about to use a "unzip all" script instead of.

unzip *.zip

That way the output from each file goes into it's own directory.

for f in *.zip ; do unzip -n "$f" -d "${f/%zip/out}"; done

I use the following function in zsh:

ununzip () {
    rm -r $(unzip -l $1 | grep -v 'Archive:' | \
    grep '[/.]' | sed 's![^a-zA-Z]([a-zA-Z./])!\1!')

I.e. command substitution to remove all files in the cleaned up output of unzip -l.

tar tvf could be used in a similar way.


A had an issue with unzip recently, the --list command did nothing on Ubuntu/Kali (Zip 3.0 (July 5th 2008), by Info-ZIP) while the -l exports in useless human readable format. So I've happily ended up with tar-xargs-based example:

zipinfo -1 ./archive.zip | xargs rm -rf

You must log in to answer this question.