1

I'm looking for some guidance on how to get this gzip out of a data file.

$ file cut6
cut6: data

$ binwalk cut6
DECIMAL   HEXADECIMAL    DESCRIPTION
.......................................
1       0x1   gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), NULL date (1970-01-01 00:00:00)

I tried a few things just to see if I could get lucky, but no dice.

$ gzip -d cut6
gzip: cut6: unknown suffix -- ignored

$ gunzip cut6
gzip: cut6: unknown suffix -- ignored

$ uncompress cut6
gzip: cut6: unknown suffix -- ignored

$ zcat cut6
gzip: cut6: not in gzip format

.

2

It looks like binwalk tells you there is an additional byte in front of the gzipped data. Ignore that byte with any method you see fit.

tail -c +1 cut6 | gzip -d
0

Try to check the file format signature manually, like: xxd -l 4 cut6 to find/confirm a file format. Then go with 4 (this size can be different) bytes to https://en.wikipedia.org/wiki/List_of_file_signatures . You should get 1F 8B, but if not, then look for the right compression method and use appropriate tool to decompress/process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.