Local file header at BOF (with maximum offset of 4 bytes) + central file header and end of central directory near EOF. NB. The signature byte sequence is currently massaged to steer around the known PRONOM bug in the area of right fragment matching when the longest fragment is not nearest EOF. The first fragment in the EOF byte sequence has been shortened by 1 byte to ensure that the subsequent fragment is the longest. This abbreviation does not reduce the overall signature strength too much and so will hopefully not result in any false pisitive identification. When the PRONOM bug has been fixed, the "504B01" at the start of the EOF byte sequence should be extended to "504B0102", and this note reduced.
Byte sequences
Position type
Absolute from BOF
Offset
0
Maximum Offset
4
Byte order
Value
504B0304
Position type
Absolute from EOF
Offset
0
Byte order
Little-endian
Value
504B01{43-65531}504B0506{18-65531}
Name
ZIP Format Signature 2
Description
BOF; Offset: 0; Magic Bytes: 'PK' followed by 0x05060000 denoting the end of the central directory