A file's extension — the letters after the last dot in its name — tells you (and your operating system) what kind of file it is and what program should open it. Extensions can be faked or hidden, which is exactly why security professionals learn to look past the extension and actually inspect a file's contents when something seems off.
Archives like .zip files bundle multiple files into one compressed container — useful for sharing, but also a common place for adversaries to bury something they'd rather you not notice right away. Extracting an archive unpacks it back into its original files so you can actually inspect what's inside.
Knowing a file exists somewhere isn't the same as being able to find it fast. A few techniques make file search dramatically more effective than scrolling through folders by hand:
| Technique | What it does |
|---|---|
| Search by name | Finds files matching all or part of a filename |
| Wildcard search | Use * to match any characters — e.g., *.docx finds every Word document |
| Filter by file type | Narrows results to a specific extension or category |
| Sort by date modified | Surfaces the most recently changed files first — useful when you know roughly when something happened |
Here's the entire idea in one sentence: an adversary can read any unencrypted file if they have access to the device or drive storing it. No password cracking, no exploit, no cleverness required — if the file itself isn't protected, reaching the device is the same as reaching the data.