v1.3.1

Magic Extractor 1.3.1 — GUI path fixes and cleaner extraction

A patch release focused on path handling in the GUI and Inno Setup extraction.

Fixed

• Drag-and-drop in the GUI could corrupt the dropped file's path, which was the
  likely cause of intermittent "DIE detection failed" errors. Paths from the
  file dialogs are also normalized to the native Windows separator now.
• Inno Setup extraction now preserves the installer's folder layout and
  flattens it into the output directory, instead of the old flat extraction.
• Removed a spurious SyntaxWarning that could leak into the extraction log
  when inspecting .py files bundled inside third-party installers.

Updated

• Bundled innounp 2.70.1 → 2.71.0 (adds the ** filemask wildcard, supports
  Inno Setup up to 7.1.0).

New

• The GUI's About dialog now shows the app version.

Full Changelog: 1.2.0...1.3.1

v1.3.0

Magic Extractor 1.3.0 — Better workflows and sturdier detection

This release makes Magic Extractor easier to use and maintain. The GUI now
exposes carving and bruteforce detection, full-file PureMagic analysis is the
default, Inno Setup support has been modernized, and the bundled detector and
extractor tools now have a repeatable update workflow.

New: carve and bruteforce in the GUI

The graphical interface now exposes two workflows that were previously limited
to the CLI:

• Carve mode uses binwalk's offset map to find embedded archives and extract
  them from firmware images or other container files.
• Bruteforce mode disables detector early-exit and tries every handler
  suggested by DIE, Magika and the other detectors.

The Preferences dialog can also remember the last 10 source and destination
paths, making repeated extraction jobs quicker to set up.

New: reproducible bundled-tool updates

The new update/ workflow vendors universal-tool-updater and a configuration
for refreshing the external tools shipped under cli/bin/:

• DIE, Magika, 7-Zip, innounp, lessmsi, unshield and PeaZip.
• The eight bundled tc4shell plugins used for forensic images, disc images,
  mail stores, application packages and modern codecs.
• Per-tool cleanup scripts keep only the required binaries and preserve the
  directory layout expected by Magic Extractor.

Run update/updater.exe --dry-run on Windows to check for available updates
without downloading anything. See update/UPDATING.md for the complete workflow
and the known caveats for each source.

Detection changes

• Full-file PureMagic analysis is now the default. PureMagic 2.x can perform
  content-aware deep scanning when it receives the complete file, improving
  detection when the useful signature is not near the beginning.
• --fast-check is now an explicit opt-in and examines the first 64 KiB.
  This is substantially more useful than the previous small prefix while still
  avoiding a full-file scan when startup speed matters most.
• The Python runtime dependencies were refreshed, including PureMagic 2.2+,
  Send2Trash 2.1+ and tkinterdnd2 0.6.2+.

Inno Setup improvements

• The bundled Inno Setup Unpacker was updated from the old 0.50 build to
  2.70-beta, adding support through Inno Setup 7.0.1-beta.
• Extraction now uses batch mode, disables colored console output and passes the
  supplied password directly to innounp.
• Duplicate and embedded files continue to be extracted without interactive
  prompts.

Reliability and interface fixes

• --fix-file-extensions now adds an extension only to extensionless files; it
  never replaces a real extension that is already present.
• The About dialog follows the selected theme, Windows dialog title bars support
  dark mode, and menus/dialogs stay above a window configured as always-on-top.
• The required Microsoft runtime DLLs are now bundled with DIE and Magika, so
  clean Windows systems do not need to supply them separately.
• Corrected the bundled unshield link filename.

Under the hood

The former 470-line cli/main.py has been reduced to a small entry point. Its
argument parsing, detection, extraction, read-only commands, carving and path
resolution now live in focused modules. Existing imports from main.py remain
available for compatibility, and direct workflow tests cover detector early-exit
and bruteforce behavior, handler extraction lifecycle and carving edge cases.

Notes

Full-file detection can take longer on very large inputs. Use --fast-check
when the first 64 KiB are sufficient and lower startup latency is preferable to
PureMagic's deep scan.

The updater is a maintainer workflow rather than an in-application auto-update
feature. Updated binaries should still be tested before publishing a release,
especially the architecture-sensitive 7-Zip plugins.

Full Changelog: 1.2.0...1.3.0

v1.2.0 - hkmori

Magic Extractor 1.2.0 — Massive format expansion

The tool performed as I had expected. So, in keeping with an old tradition, I'm
sharing a track with you to celebrate.

'search of a life worth living' by hkmori — Bandcamp · Helltube

This release roughly triples the number of recognized formats: 80+ formats
are now auto-detected and extracted, including forensic disk images, optical
disc images, mail/message stores and modern compression codecs. It also splits
plugin-dependent 7-Zip formats into their own handler and ships a handful of
detection and reliability fixes.

New: forensic disk images

Detected by magic and extracted via the bundled forensic7z plugin:

• EnCase / EWF — .E01, .S01, .Ex01, .L01, .Lx01
• AccessData FTK Imager — .AD1
• Advanced Forensics Format — .AFF
• WinHex evidence — .whx

New: optical disc images

Via the bundled Iso7z plugin:

• Compact / Compressed ISO (.ciso, .cso), MAME CHD, ECM, UltraISO
  ISZ, Alcohol 120% MDS, CloneCD CCD, zisofs.

New: mail & message stores

Via the bundled eDecoder plugin:

• Outlook TNEF (winmail.dat), Outlook Express DBX, WARC web archives,
  BinHex (.hqx), yEnc, The Bat! TBB, MacBinary III.

New: modern compression & app packages

• LZ4 / LZ5 / Lizard frames and Firefox jsonlz4 / mozlz4 (Modern7z).
• Electron .asar (Asar plugin) and Chromium resource pak (Grit7z).
• PyInstaller executables now extract via the Py7z plugin.
• More native 7-Zip filesystems now detected by magic: NTFS, GPT, UEFI
  firmware volumes (ExFAT is detected too, via the ExFat7z plugin).

Under the hood

• New Format7zExtHandler — plugin-dependent 7-Zip formats are separated
  from the native ones. Same extraction (it shells to 7-Zip), but clearly marks
  which formats need a plugin. Plugins ship in 7z/Formats/ and 7z/Codecs/.
• All magic signatures were cross-checked against the TrID database and the
  Detect-It-Easy signature set (this caught and fixed a wrong EnCase Lx01 magic).
• Detection routing data (handlers.json / signatures.json) is generated from
  each handler's declarations — see the new docs/adding-a-handler.md guide
  for how to add a format end to end.
• Extraction success/failure is now decided in one place — the tool's exit code
  (BaseExtractor.run_extraction) — removing per-handler boilerplate and a class
  of false failures.

Fixes

• Inno Setup installers now extract correctly — a cleanup bug reported every
  successful extraction as a failure.
• ZPAQ archives now extract — the output/password arguments were malformed,
  so extraction always failed.
• Self-extracting ARC / KGB / UHARC .exe archives now route to their own
  extractor instead of being claimed by the Inno Setup unpacker.
• Extractors that succeed without printing anything are no longer reported as
  failed; when a tool does fail, its real error is logged.
• Boolean extract options (--open-output-folder, --check-free-space,
  --check-unicode, --fix-file-extensions, --create-log-files) now honor
  true/false. Previously any value counted as true, so a default saved
  with --update-defaults could not be turned back off.
• A missing detector binary no longer crashes the whole run.
• Directory (batch) extraction now exits non-zero if any file failed.
• The output directory is now created automatically if it doesn't exist
  (previously extract <file> <newdir> errored).
• Corrected the EnCase .Lx01 magic (LEF2, not LVF2).
• Normalized the bundled tc4shell plugin ReadMe URLs (http→https; fixed a 404).

Notes

Plugin-dependent formats (marked † in formats.md) are identified even without
their plugin, but only extract when the matching plugin is present in the bundled
7-Zip's Formats/ / Codecs/ folder (they ship with the release). See
formats.md for the full list and THIRD-PARTY-NOTICES.md for the
bundled tools.

Full Changelog: 1.1.0...1.2.0

v1.1.0

Magic Extractor 1.1 — Desktop GUI + Fixes

This release adds a full desktop GUI, several new CLI options, and a batch of
detection and reliability fixes on top of 1.0.

The zip now ships two executables side by side:

• magic-extractor.exe — the command-line tool.
• magic-extractor-gui.exe — the new graphical front-end (it drives the CLI).

New: Graphical interface

A Universal-Extractor-style window, self-contained (no extra install):

• extract / scan modes, source + destination pickers, directory lock.
• Auto-fill destination — pick, drop, or type a source and the output folder
  is filled in automatically (editable; kept when locked).
• Drag-and-drop a file onto the window.
• Open with / command-line — pass a file (and optional output dir) to the GUI
  exe; it opens pre-filled. Works with an optional Explorer right-click entry
  ("Extract with Magic Extractor").
• Dark mode (follows the OS, toggleable) with a themed title bar.
• Run options: recursive + max depth, bruteforce, password, fast type check,
  verbose debug, and a Keep / Ask / Delete source choice after extraction.
• Preferences for the extraction flags (config.ini) and interface options
  (gui.ini), including optional recent-files history.
• Batch queue: add several files, then run them in sequence.
• Live log pane streaming the extraction output; window size, position, and
  settings are remembered between sessions.

New CLI options

• --delete-source — delete the source after a successful extraction, sent to
  the Recycle Bin by default (recoverable; configurable via
  delete_to_recycle_bin).
• --debug — verbose logging, valid on every subcommand.
• Output directories are now created automatically when they don't exist.

Detection improvements

• PyInstaller executables are now detected and routed correctly (via Detect
  It Easy's packer signature).
• identify / scan now reports the same installer/SFX candidates as extract
  (PyInstaller, Inno Setup, InstallShield, BitRock, and other PE wrappers).
• Broader DIE category handling (packers) and additional detection names for
  FreeArc, PeaZip, ZPAQ, and Inno Setup.

Reliability fixes

• No more console window flashing when the GUI runs an extraction on Windows.
• Fixed ALZ / EGG extraction failing with a side-by-side error
  (WinError 14001) — the required VC90 runtime is now shipped correctly beside
  the extractor, so it works without installing the Visual C++ 2008 runtime.
• Various internal cleanups and a reorganized, CI-tested codebase (unit tests +
  an extraction battery run automatically on every push).

License

Magic Extractor is now MIT-licensed (previously LGPL-3.0). The bundled
third-party detectors and extractors keep their own licenses — see the new
THIRD-PARTY-NOTICES.md shipped in the zip.

Usage

GUI: run magic-extractor-gui.exe (or magic-extractor-gui.exe mystery.bin).

CLI is unchanged:

magic-extractor.exe extract  <path> [output_dir] [options]
magic-extractor.exe identify <path>
magic-extractor.exe list     <path>
magic-extractor.exe carve    <path> [output_dir] [options]

For the full list of supported formats, see formats.md.

Full Changelog: 1.0.0...1.1.0

v1.0.0

Magic Extractor — First Release

This is the first public release of Magic Extractor, a universal extraction tool for Windows.

Magic Extractor identifies unknown files using multiple detectors and routes them to the correct bundled extractor. It is designed to handle mainstream archive formats, modern installers, SFX packages, embedded archives, and several less common compression formats.

Highlights

• Automatic file identification and extraction.

• Multi-detector pipeline with early-exit detection:

  • puremagic
  • built-in signatures
  • Detect It Easy
  • binwalk
  • Magika

• Bundled extractor support for tools such as 7z, unrar, unace, unshield, lessmsi, WiX/dark, and more.

• Support for installer formats, PE/SFX wrappers, and uncommon archivers.

• Recursive extraction for archives found inside extracted output.

• Bruteforce mode to try every detected candidate handler.

• Carving mode for extracting embedded archives from larger binary files, such as firmware images.

• Runtime-updatable bin/, data/, and config.ini files without rebuilding the executable.

Basic Usage

Download the release, unzip it, and run:

magic-extractor.exe extract mystery.bin

The file type is detected automatically and extracted into an output folder next to the input file.

Commands

magic-extractor.exe extract  <path> [output_dir] [options]
magic-extractor.exe identify <path>
magic-extractor.exe list     <path>
magic-extractor.exe carve    <path> [output_dir] [options]

A bare file path also defaults to extraction:

magic-extractor.exe mystery.bin

Common Examples

Identify a file without extracting it:

magic-extractor.exe identify setup.exe

List archive contents:

magic-extractor.exe list backup.7z

Extract recursively:

magic-extractor.exe extract app-1.0.tar.gz --recursive

Try all detected handlers:

magic-extractor.exe extract weird-archive.dat --bruteforce

Inspect embedded fragments before carving:

magic-extractor.exe carve router-firmware.bin --list

Carve and extract known embedded archives:

magic-extractor.exe carve router-firmware.bin

Notes

This release is focused on broad format coverage, reliable detection, and practical Windows usage. The detector and handler data are kept external to the executable so they can be updated by replacing files instead of rebuilding the application.

For the full list of supported formats, see formats.md.

License

LGPL-3.0-only.

Full Changelog: https://github.com/xchwarze/magic-extractor/commits/1.0.0