PKZIP Uncompressed (Stored) ZipCrypto — Hashcat Mode 17210
TL;DR — Mode 17210 covers PKZIP archives where files are stored without compression (ZIP method 0 = stored). The encryption is the same ZipCrypto cipher as mode 17200; the storage method differs. Recovery profile is similar — ZipCrypto's structural weaknesses make most files practically recoverable.
Stored vs deflated
ZIP supports multiple compression methods: 0 (stored, no compression), 8 (deflated, the most common), and others. Mode 17210 specifically covers stored content; mode 17200 covers the default deflated case.
Stored archives are common when the source files are already compressed (JPEG images, MP4 video, MP3 audio) — additional ZIP-level compression provides no benefit. Some workflows force stored mode for speed when compression doesn't help.
Cryptographically, the mode (stored vs deflated) doesn't change the cipher. Recovery techniques targeting ZipCrypto apply identically.
Recovery characteristics
Same cipher weaknesses apply. Stored archives may have slightly different plaintext patterns — for instance, a JPEG file's known header bytes are intact when stored, providing a known-plaintext anchor. This typically helps recovery.
Most mode 17210 archives are recoverable with similar effort to mode 17200.
Identification
ZIP entries with method=0 (stored) and ZipCrypto encryption produce mode 17210 hashes. Tools like 7-Zip print 'Method: Store' for these files.
Frequently Asked Questions
Is mode 17210 different from 17200 cryptographically?
Why are some files stored without compression?
Are stored files easier to recover than deflated?
Related references
Have a file in this category?
Start with a free analysis. The encryption type is detected automatically; a free check runs through fast techniques before any paid attempt. You only pay if recovery actually works.
Run a free analysis