gzip compresses a single file, and its short header keeps three things about the original: the filename it had before compression, the time it was last modified, and the operating system that compressed it. Renaming the .gz does not touch any of them, so the original name survives an attempt to disguise what the file is.
Scan a gzip fileThe one field that matters is the original filename. gzip stores it in the header's FNAME block, separate from whatever the .gz is called on disk. So a file renamed to something innocuous still admits its real name - File X-Ray reads it and flags it, because it can undo a deliberate attempt to hide what a file is.
The rest of the header is small but real: the modification time of the file before it was compressed (compressing does not reset it, so it still dates the original), a byte naming the operating system that produced the archive, and an optional free-text comment. Everything past the header is the compressed payload, which is opaque until it is decompressed. A .tgz is just a gzip-wrapped tar, and its file listing lives in the tar inside - File X-Ray reads the outer gzip header (the tar's original name, its timestamp and the source OS) and then decompresses the payload, up to 64 MB expanded, to list the tar within: up to the first 40 paths, the entry count and total size, the account that owned the files, and the oldest and newest timestamps in the set.
This is a selection. The full field manual documents the fields read from each format.
Its short header keeps the original filename the file had before compression, the file's modification time, the operating system that compressed it, and an optional comment. The compressed data itself is opaque unless it is decompressed, but the header fields are readable straight away.
No. gzip stores the original filename in the header's FNAME block, separate from the name the .gz has on disk. Renaming the .gz leaves that field untouched, so the real name is still there - File X-Ray reads it and flags it.
Yes, if it expands to 64 MB or less. A .tgz is a tar archive wrapped in gzip, and the file listing lives in the tar inside the compressed payload. File X-Ray reads the outer gzip header, then decompresses the payload in your browser and reads the tar: the number of files and their total size, up to the first 40 paths, the account that owned the files, and the oldest and newest file timestamps. A larger archive shows only the gzip header.
File X-Ray rewrites the gzip header in your browser, removing the stored original filename, the modification time and any comment, and setting the operating-system byte to unknown. For a .tar.gz that expands to 64 MB or less it also cleans the tar inside - the owner names, user and group ids and file timestamps in every member header - and compresses it again, and the files themselves come out unchanged. If you are producing the file yourself, gzip -n (also written --no-name) leaves the name and timestamp out in the first place.
File X-Ray reads gzip files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.