Forensicsarchiveunpackerextractlistrarzip7ztar

Unar

Unar is an archive unpacker supporting a wide variety of file formats including zip, RAR, 7z, tar, and many legacy formats. It includes lsar for listing archive contents and unar for extracting them.

Description

The Unarchiver provides tools to handle numerous archive formats, from modern ones like ZIP, RAR, 7z, tar, gzip, bzip2, LZMA, XZ, CAB, MSI, NSIS, EXE, ISO, BIN, and split files, to older formats such as Stuffit, ARJ, ARC, ACE, ZOO, and more. This makes it invaluable for unpacking files in forensic analysis, reverse engineering, or general file handling where diverse compression methods are encountered.

The package includes lsar, which lists archive contents with options for detailed information, integrity testing, password handling, and JSON output, and unar, which extracts contents with controls for output directories, overwriting, recursion, and encoding. These tools are particularly useful in cybersecurity tasks involving evidence recovery from archives or processing protected files.

Use cases include extracting archives during incident response, testing file integrity, or scripting batch operations on mixed-format collections. Dependencies ensure compatibility with GNUstep runtime and various compression libraries.

How It Works

Unar and lsar parse archive structures using format-specific handlers for supported compression and packaging methods like ZIP, RAR, 7z, tar variants, and legacy formats. They support password decryption, filename encoding detection or specification, integrity testing where possible, and handle nested archives unless recursion is disabled. Output modes include directory extraction, stdout streaming, JSON listings, and resource fork processing for Mac formats, leveraging libraries like libbz2, libicu, libgnustep-base, and zlib.

Installation

bash
sudo apt install unar

Flags

-long (-l)Print more information about each file in the archive.
-verylong (-L)Print all available information about each file in the archive.
-test (-t)Test the integrity of the files in the archive, if possible.
-password (-p) <string>The password to use for decrypting protected archives.
-encoding (-e) <encoding name>The encoding to use for filenames in the archive, when it is not known. If not specified, the program attempts to auto-detect the encoding used. Use "help" or "list" as the argument to give a listing of all supported encodings.
-output-directory (-o) <string>The directory to write the contents of the archive to. Defaults to the current directory. If set to a single dash (-), no files will be created, and all data will be output to stdout.
-force-overwrite (-f)Always overwrite files when a file to be unpacked already exists on disk. By default, the program asks the user if possible, otherwise skips the file.
-no-recursion (-nr)Do not attempt to extract archives contained in other archives.
-json (-j)Print the listing in JSON format.
-quiet (-q)Run in quiet mode.

Examples

Display help for lsar tool.
lsar -h
List contents of an archive file with optional files specified.
lsar [options] archive [files ...]
Print more information about each file in the archive.
lsar -l archive
List contents of a password-protected archive.
lsar -p password archive
Print the archive listing in JSON format.
lsar -j archive
Display help for unar tool.
unar -h
Extract contents from an archive file with optional files specified.
unar [options] archive [files ...]
Extract archive contents to a specific output directory.
unar -o directory archive
Updated 2026-04-16kali.org ↗