Supported Formats

Supported Formats

This page mirrors the Supported formats section of the README.

Category	Formats	Primary tool	Fallback(s)
Linux packages	.deb .udeb	dpkg-deb	ar + tar
	.rpm	rpm2cpio | cpio	rpm2archive + tar
Windows installers	.msi .msp	msiextract	7z
	.cab	cabextract	7z
	NSIS installers	7z	binwalk
	InnoSetup	innoextract	7z
	InstallShield (setup.exe + data*.cab)	unshield	7z
	WiX Burn / generic PE installers	7z	binwalk
Filesystem images	.iso / UDF	7z	bsdtar
	.dmg (unencrypted UDIF)	7z	--
	.xar / .pkg (macOS)	7z	--
	SquashFS	unsquashfs	--
	.snap (SquashFS)	unsquashfs	--
	AppImage	unsquashfs at offset	--appimage-extract
Traditional archives	.tar / .tar.{gz,bz2,xz,zst,lzma}	tar	--
	.zip / .jar / .apk / .whl / .docx / …	unzip	7z
	.7z	7z	--
	.rar	unrar	7z
	.ar / .a	ar	--
	.cpio	cpio	--
Single-stream compression	.gz / .bz2 / .xz / .zst / .lzma / .lz4 / .lzo	corresponding CLI	--
Binaries	UPX-packed ELF / PE / Mach-O	upx -d on copy	--
	PE resources (icons, manifests, embedded binaries)	wrestool (secondary)	--
	ELF sections (.text, .rodata, .data, .note.* …)	objcopy + readelf (secondary)	--
Last resort	unknown binaries with embedded signatures	binwalk -Me	--
Extended and legacy archives	.arj	arj	--
	.lha / .lzh	lha (lhasa)	unar
	.lz (lzip single stream)	lzip -d -c	--
	.tar.lz / .tlz	lzip -d | tar -xf - (pipeline)	--
	.lrz (lrzip)	lrzip -d on copy	--
	.zpaq	zpaq x	--
	.arc / .ark (ARC/ARK MS-DOS)	nomarch	--
	.tnef / winmail.dat	tnef -C	--
	.shar (POSIX shell archive)	unshar -d	--
	.uu / .uue (uuencoded)	uudecode	--
	.sit / .sitx (StuffIt)	unar	--
	.alz (Korean ALZ)	unar	--
	.ace	unar	--
Documents, disk images, and filesystems	PDF (with attachments)	pdfdetach -saveall	--
	PDF (structure / streams)	qpdf --qdf	--
	.apk (Android package, decoded)	apktool d	unzip (raw fallback at priority 80)
	.vmdk (VMware)	vmdkmount (FUSE, root)	qemu-img convert (no root)
	.qcow2 / .qcow (QEMU)	qcowmount (FUSE, root)	qemu-img convert
	.vhd / .vhdx (Microsoft)	vhdimount (FUSE, root)	qemu-img convert
	NTFS (in disk image)	fsntfsmount (FUSE, root)	--
	ext{2,3,4} (in disk image)	fsextmount (FUSE, root)	--
	XFS (in disk image)	fsxfsmount (FUSE, root)	--
	APFS (in disk image)	fsapfsmount (FUSE, root)	--
	HFS+ (in disk image)	fshfsmount (FUSE, root)	--
	FAT (in disk image)	fsfatmount (FUSE, root)	mtools
	VSS shadow copies	vshadowmount (FUSE, root)	--
	LVM2	vslvmmount (FUSE, root)	--
	JFFS2 / UBI / MTD (firmware)	binwalk -e (priority 80)	--
	.kwaj / .szdd (MS DOS-era)	msexpand	--
	macOS binary plist (BPLIST)	plistutil -i -o -f xml (secondary)	(terminal kind, no primary)
Terminal-classify (no recursion)	LUKS encrypted volumes	(none -- classify only, kind=LUKS_ENCRYPTED)	--
	Encrypted RAR/7z/DMG	(none -- classify only, kind=ENCRYPTED_GENERIC)	--

"Secondary" extractors run in addition to (not instead of) the primary extraction, and their output lands in a sibling _secondary_<name>/ directory inside the unpack folder.

---