Skip to content
>_ FileDex █

This file type cannot be converted in the browser.

┌─ FILE ANALYSIS ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ┐
│ DEVELOPER : Microsoft
│ CATEGORY : Archive
│ MIME TYPE : application/vnd.ms-cab-compressed
│ MAGIC BYTES : 4D534346
└ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ┘

What is a CAB file?

CAB (Cabinet) is a Microsoft archive format designed for efficient software distribution and installation on Windows. Introduced in the mid-1990s, CAB files support multiple compression algorithms (MSZIP, LZX, Quantum) and can span multiple volumes (split across multiple files). They are extensively used by Windows Installer (.msi), Windows Update, driver packages, and the Windows installation media itself.

Unlike generic archives such as ZIP or 7z, CAB files are deeply integrated into the Windows installation infrastructure — msiexec.exe, the Windows Setup engine, and driver signing workflows all rely on the CAB format.

How to open CAB files

  • Windows Explorer — Double-click to browse contents (built-in support since Windows XP)
  • 7-Zip (Windows) — Free, extracts all CAB variants
  • expand (Windows CLI) — expand cabinet.cab -F:* C:\output\ extracts all files
  • cabextract (Linux/macOS) — Free command-line tool: cabextract archive.cab
  • WinRAR (Windows) — Commercial but reads CAB natively

Technical specifications

PropertyValue
Compression algorithmsMSZIP (DEFLATE), LZX, Quantum
Multi-volumeSupported (spanning across multiple CAB files)
Maximum files65,535 files per cabinet
Maximum file size2 GB per cabinet file
Digital signaturesAuthenticode signing supported
Magic bytes4D 53 43 46 (MSCF in ASCII)
Folder structureLogical folders with independent compression

Common use cases

  • Windows installation media: install.wim and system files are distributed in CAB containers during Windows Setup
  • Windows Update: Update packages (.cab) are downloaded and extracted by the Windows Update Agent
  • Device drivers: Hardware driver packages (.inf + .sys + .cat + .cab) are distributed as signed CABs to ensure integrity
  • MSI packages: Many MSI installers store compressed application files inside embedded CAB streams
  • Windows patches: Hotfixes and security updates use CAB format (.msu files are CABs containing other CABs)

Working with CAB files

REM List contents
expand -D cabinet.cab

REM Extract all files to destination
expand cabinet.cab -F:* C:\extracted\

REM Extract a specific file
expand cabinet.cab -F:setup.exe C:\extracted\

REM Create a CAB file (using makecab)
makecab input.exe output.cab

REM Create from directive file (multiple files)
makecab /f cabinet.ddf

The makecab.exe tool (included with Windows) creates CAB files from a Diamond Directive File (.ddf) that specifies which files to include, compression settings, and volume spanning.

CAB in driver signing

Hardware vendors submit driver packages to Microsoft as signed CABs for WHQL (Windows Hardware Quality Labs) certification. The package includes:

  • .inf — Installation instructions
  • .sys / .dll — Driver binaries
  • .cat — Security catalog (hashes of all files, signed by Microsoft)
  • .cab — Container for distribution

The .cat file is the critical security artifact — Windows verifies it against Microsoft’s signature before loading any driver from the package.

Security considerations

CAB files from Windows Update and Microsoft’s servers are signed with Microsoft’s Authenticode certificate. Third-party CAB files should be verified before extraction. The signtool verify /pa /v file.cab command checks the Authenticode signature. Unsigned CABs containing executables or drivers should be treated with caution, especially from unfamiliar sources.