File Formats

The .zip/.tvak package: format marker, manifest, metadata, and integrity.

Format: .zip and .tvak

Both extensions produce the exact same ZIP-based container — the same way .docx, .xlsx, and .jar are all plain ZIP files under a different extension. .zip is the default; .tvak is a fully-supported alternative. Choosing one over the other changes nothing about what's collected or how it's packaged — only the filename suffix.

Format marker + versioning contract

Every package contains tvak_format.json, written as the first entry in the archive:

{ "Format": "TVAK-Evidence-Package", "FormatVersion": 1, "CreatedBy": "tvak Collector 0.1.0.0" }

This lets any tool confirm "this is a genuine TVAK Evidence Package, schema vN" by reading one small file, without trusting the extension and without parsing the full manifest. FormatVersion is a maintained contract starting at 1.

Package layout

<name>.zip  (or .tvak)
├── tvak_format.json     — format identity marker, written first
├── manifest.json        — per-file SHA-256, collector run status, host/collector provenance
├── metadata.json         — case-level context — empty by default
├── collection.log        — full run log
└── artifacts/
    ├── System/
    ├── Processes/
    └── ...                one subfolder per module that produced output

manifest.json

Field	Contains
`ManifestVersion`	Manifest's own schema version (`"1.0"`) — distinct from `tvak_format.json`'s `FormatVersion`.
`Collector`	`{ Name, Version, BuildHash }` — `BuildHash` is the SHA-256 of the Collector exe itself.
`Host`	Hostname, OS version/arch, domain, collection start/end (UTC), run-as account, elevation, and raw `SourceTimeZone` registry values.
`Files[]`	Per file: path, SHA-256 (over uncompressed bytes), size, compressed flag, provenance, collected-at timestamp.
`CollectorsRun[]`	Per collector: name, status, reason, artifact count, duration.
`Errors[]`	Rollup of every non-Success `CollectorsRun[]` entry.
`RawArtifacts[]`	Per Raw-module artifact: category, method, reason, path, SHA-256.
`Memory`	Null unless attempted; otherwise tool/path/exit-code/output/method.

Full status-value meanings: Error Reference.

metadata.json

Case-level context, deliberately kept separate from manifest.json so filling in a case name never touches evidence-integrity data: CaseId, CaseName, Investigator, CollectionReason, Tags[]. Empty by default.

Verifying integrity

Get-FileHash .\artifacts\Processes\processes.csv -Algorithm SHA256
# compare the Hash value against that file's "Sha256" entry in manifest.json's Files[] array

Opening a .tvak file

The bytes are genuine ZIP — any tool that reads ZIP by content rather than by file extension opens it exactly like a .zip: 7-Zip, WinRAR, Python's zipfile, Linux's unzip, and System.IO.Compression.ZipFile all work fine.

Known limitation, not corruption: Windows' own Expand-Archive PowerShell cmdlet, and almost certainly Explorer's built-in "Extract All", reject .tvak outright — they gate on the file extension, not the content. Same situation as .docx/.jar/every other renamed-ZIP format. Rename to .zip first, or use a real ZIP tool that sniffs content instead of extension.