Hello trid users,
Some days ago i searched for some documentation. What i searched was packed
inside an archive with file suffix ZOO.
When running TrID command on such ZOO examples these are described as "ZOO
compressed archive" by ark-zoo.trid.xml or with lower priority as "ZOO
compressed archive (strict)" by ark-zoo-strict.trid.xml (See appended
output/trid-v.txt). In output mime typed is shown by line inside definition
that looks like:
<Mime>application/octet-stream</Mime>
And only ZOO suffix is considered as valid extension. This is triggered
inside definitions by line like:
<Ext>ZOO</Ext>
For comparison reason i also run file command (newest version 5.44) on such
samples. Here such samples are described as "Zoo archive data". For all
samples except x-fmt-269-signature-id-621.zoo also version information is
shown. (See appended output/file-5.44.txt). But when running this with
--extension option no suffix is listed here (See appended
output/file-ext-5.44.txt). But when running with -i option a mime type is
shown. That is application/x-zoo (See appended output/file-i-5.44.txt). That
information can also be found in shared-mime-info database. So on my
Raspberry Pi there this type is also used. This information is also found on
Wikipedia page.
For comparison reason i also run the file format identification utility
DROID ( See
https://sourceforge.net/projects/droid/). This does recognize
only some archives. These are described as "ZOO Compressed Archive" by PUID
x-fmt/269. Here no mime type is shown and only ZOO suffix is considered as
"good" whereas BAK is marked with EXTENSION_MISMATCH true (See appended
output/droid-zoo.csv).
All tools use in first step the same recognition method. That is expressed
by in side TrID definition by XML construct like:
<Pattern>
<Bytes>DCA7C4FD</Bytes>
<Pos>20</Pos>
</Pattern>
ZOO files typically start with 20 byte header starting with "ZOO ?.??
Archive.", followed by the bytes 0x1a 0x0 0x0, where question marks means
versions digits. That are just used for informational reason and the text
can be anything. That is described inside ark-zoo.trid.xml by XML constructs
like:
<Pattern>
<Bytes>5A4F4F20</Bytes>
<ASCII> Z O O</ASCII>
<Pos>0</Pos>
</Pattern>
<Pattern>
<Bytes>2E</Bytes>
<Pos>5</Pos>
</Pattern>
<Pattern>
<Bytes>417263686976652E1A0000DCA7C4FD</Bytes>
<ASCII> A r c h i v e</ASCII>
<Pos>9</Pos>
</Pattern>
The sample x-fmt-269-signature-id-621.zoo is used by DROID to recognize ZOO
samples and therefore contain only the 4 byte magic pattern. So it is only
described by ark-zoo-strict.trid.xml.
The DROID tool also looks for byte sequence FC83 at the end, which is wrong.
Why this is happen can be explained by looking in man page zoo(1). There is
written some sentence like:
Packing removes any garbage data appended to an archive because of Xmodem
file transfer
In the man page is also written that archive_name.bak is backup of archive.
That is created by program itself, if packing occurs, the original unpacked
archive is always left behind with an extension of .bak. This is the default
behavior if not the E modifier is used that causes zoo not to save a backup
copy of the original archive after packing.
So i run tridscan to update the two definitions ark-zoo.trid.xml
ark-zoo-strict.trid.xml. The additional possible backup suffix is now
expressed by line like:
<Ext>ZOO/BAK</Ext>
The mime type is now shown by changed definition line like:
<Mime>application/x-zoo</Mime>
With the updated trid definitions now my ZOO examples are still described,
but now correct mime type and suffix are listed (see appended
output/trid-v-new.txt). TrID definitions, some samples and output are stored
in archive zoo_trid.zip. I hope that my updated definitions can be used in
future version of triddefs.
With best wishes
Jörg Jenderek
