gzip compresses a single file, and its short header keeps three things about the original: the filename it had before compression, the time it was last modified, and the operating system that compressed it. Renaming the .gz does not touch any of them, so the original name survives an attempt to disguise what the file is.
Scan a gzip fileThe one field that matters is the original filename. gzip stores it in the header's FNAME block, separate from whatever the .gz is called on disk. So a file renamed to something innocuous still admits its real name - File X-Ray reads it and flags it, because it can undo a deliberate attempt to hide what a file is.
The rest of the header is small but real: the modification time of the file before it was compressed (compressing does not reset it, so it still dates the original), a byte naming the operating system that produced the archive, and an optional free-text comment. Everything past the header is the compressed payload, which is opaque until it is decompressed. A .tgz is just a gzip-wrapped tar, and its file listing lives in the tar inside - File X-Ray reads the outer gzip header (the tar's original name, its timestamp and the source OS) and then decompresses the payload, up to 64 MB expanded, to list the tar within: every path, the entry count and total size, the account that owned the files, and the oldest and newest timestamps in the set.
This is a selection. The full field manual documents the fields read from each format.
Its short header keeps the original filename the file had before compression, the file's modification time, the operating system that compressed it, and an optional comment. The compressed data itself is opaque unless it is decompressed, but the header fields are readable straight away.
No. gzip stores the original filename in the header's FNAME block, separate from the name the .gz has on disk. Renaming the .gz leaves that field untouched, so the real name is still there - File X-Ray reads it and flags it.
No. A .tgz is a tar archive wrapped in gzip, and the file listing lives in the tar, which sits inside the compressed payload. File X-Ray reads the outer gzip header - the tar's original name, its timestamp and the source OS - but does not decompress the payload, so it does not enumerate the tar's contents.
File X-Ray inspects a .gz header but does not strip it. To drop the stored original filename and timestamp, re-compress with gzip -n (also written --no-name), which tells gzip not to save the original name and modification time in the header.
File X-Ray reads gzip files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.