In addition to addressing the date irregularities that occur when unzipping files we will delve into the structure to understand why some zip files use modified dates as created dates. This session will take us into the binary structure of zip files such that an analyst can carve the 3 mandatory pieces from a zip fragment, combine them to create a new zip file from the carvings, and edit the necessary hex to make the new file a valid zip file from which the data can be extracted.