PKZIP Mixed-Compression Multi-File — Hashcat Mode 17225
TL;DR — Mode 17225 covers ZipCrypto archives with a mix of stored (uncompressed) and deflated (compressed) files. The combination provides diverse plaintext anchor points for recovery: stored files give direct file-format signatures, compressed files give known deflate stream structure. Recovery is typically efficient.
What 'mixed' means
Real-world ZIP archives often combine compression methods. JPEG photos and MP4 video are stored (already-compressed source); text and Office documents are deflated. The same archive may contain both.
Hashcat mode 17225 specifically handles the mixed case — when the archive's hash extraction shows both method=0 and method=8 entries protected with ZipCrypto.
Recovery characteristics
Mixed archives are often the most favourable for recovery because they provide both plaintext-direct anchors (stored files) and deflate-stream structural anchors. Modern recovery tooling exploits both.
Wall-clock recovery time is typically similar to or better than pure-compressed multi-file archives.
Identification
Tool inspection (7-Zip, zipinfo, unzip -v) reveals the per-file methods. If you see a mix of 'Store' and 'Deflate' methods with ZipCrypto encryption flags, your archive is mode 17225 territory.
Frequently Asked Questions
Is mixed compression more secure than pure?
Why do tools mix compression?
Related references
Have a file in this category?
Start with a free analysis. The encryption type is detected automatically; a free check runs through fast techniques before any paid attempt. You only pay if recovery actually works.
Run a free analysis