PII often hides inside compressed archives — exported reports, old backups, zipped mail attachments. The desktop agent can open archives and scan their contents in place, without extracting them to disk permanently.
| Format | Extensions |
|---|
| ZIP | .zip |
| TAR | .tar |
| GZIP | .gz, .tgz |
| BZIP2 | .bz2, .tbz2 |
Configuration
Archive scanning is configured in Settings:
- Master toggle — turn archive scanning on or off entirely.
- Per-format checkboxes — with the master toggle on, enable or disable each format individually (for example, scan ZIPs but skip TARs).
Settings apply from the next scan. Archives encountered while their format is disabled are recorded as regular files but not opened.
Safety limits
Archives are a classic attack and resource-exhaustion surface (zip bombs, deeply nested archives). The agent enforces hard limits that cannot be disabled:
| Limit | Value |
|---|
| Maximum archive file size | 64 MiB |
| Maximum size per archive member | 16 MiB |
| Maximum total extracted size per archive | 32 MiB |
| Maximum members per archive | 1,000 |
| Nested archives (archive inside archive) | Not opened |
Nested archives are never opened, even when the outer and inner formats are both enabled. If your organization stores archives-of-archives, extract them manually before scanning that location.
For endpoints with large backup archives beyond the 64 MiB limit, extract the backup to a folder and scan the folder directly — folder scans have no size ceiling.
