Supported formats
What the engine routes, format by format.
This table is generated from the SIS engine's own format registry, so it cannot drift from what the code actually routes. It states what a root format is declared to have — not how well any particular file was covered. Coverage is reported per scan, and the report is the thing to trust for your file.
How to read it
- Native analysis — a native analysis lane is declared for the format. It is a statement that the machinery exists, not a depth or accuracy grade.
- Recognised only — the format is identified, but there is no analysis lane. Findings for these are limited to what recognition reveals, and the result says it could not look inside.
- Detected only — content is detected but not routed to a specific format lane.
- Nested content — the registry declares extraction of members, embedded objects or inline references, under explicit budgets. Listing only means members are named but their contents are not extracted.
- Sanitisation backend — a native sanitisation path exists for the format. Sanitisation is format-dependent and followed by a verify-rescan; it is not universal content disarm and reconstruction, and it does not certify the result is harmless.
| Format | Analysis | Nested content | Sanitisation backend |
|---|---|---|---|
| Archives and disk images | |||
ISO / UDF disk images iso | Native analysis | Yes | Format-dependent |
ZIP zip | Native analysis | Yes | Format-dependent |
| Documents | |||
PDF pdf | Native analysis | Yes | Format-dependent |
| Email and messages | |||
EML email eml | Native analysis | Yes | — |
MHT / MHTML mht | Native analysis | Yes | — |
Outlook MSG msg | Native analysis | Yes | — |
| Executables | |||
ELF elf | Native analysis | — | — |
Mach-O macho | Native analysis | — | — |
PE (Windows executables) pe | Native analysis | — | — |
| Fonts | |||
Fonts font | Native analysis | — | — |
| Images | |||
BMP bmp | Native analysis | — | — |
GIF gif | Native analysis | — | — |
JPEG jpeg | Native analysis | — | — |
JPEG 2000 jp2 | Native analysis | — | — |
PNG png | Native analysis | — | — |
TIFF tiff | Native analysis | — | — |
WebP webp | Native analysis | — | — |
| Markup and styles | |||
CSS css | Native analysis | Yes | — |
HTML html | Native analysis | Yes | Format-dependent |
SVG svg | Native analysis | Yes | Format-dependent |
XML xml | Native analysis | Yes | — |
| Media | |||
Media containers media | Native analysis | — | — |
SWF swf | Native analysis | — | — |
| Office documents | |||
Office Open XML ooxml | Native analysis | Yes | Format-dependent |
OLE compound files ole2 | Native analysis | Yes | — |
RTF rtf | Native analysis | Yes | Format-dependent |
| Scripts | |||
HTA hta | Native analysis | Yes | — |
JavaScript js | Native analysis | — | — |
PowerShell ps1 | Native analysis | — | — |
Shell scripts sh | Native analysis | — | — |
VBScript vbs | Native analysis | — | — |
Windows Script Files wsf | Native analysis | — | — |
| Other | |||
7-Zip sevenzip | Native analysis | Yes | Format-dependent |
Compressed streams compressed_stream | Recognised only | Yes | — |
Legacy media containers media-legacy-container | Recognised only | — | — |
OneNote one | Native analysis | Yes | — |
Python scripts py | Native analysis | — | — |
RAR rar Recognised and listed, but contents are not extracted: the engine reports the archive as not extracted, which keeps the result out of the clean category (arc:rar_not_extracted). | Native analysis | Listing only | — |
TAR tar | Native analysis | Yes | Format-dependent |
Unrecognised content unknown | Detected only | — | — |
VBA projects vba | Native analysis | — | — |
Windows shortcuts (LNK) lnk | Native analysis | — | — |
Registry snapshot dated 2026-10-02. The format identifiers are the engine's own,
shown so the table can be matched against sis output.
What this table does not tell you
- Coverage of your file. A native lane running does not mean every byte or member was reached. Budgets, encrypted members, malformed structure and unsupported surfaces each leave a gap, and the per-scan report records them. Where a format has no member producer, a report can read as complete traversal while enumerating nothing, so do not read "complete" as "everything was examined" for those.
- Depth or detection quality. "Native analysis" is not a detection-rate claim. Differences between formats in depth and in how much evidence they produce are real and are not graded here.
- Embedded and secondary surfaces. Content carried inside another format — an image in a document, a script in markup — is reached through the container's lane and its budgets, not through its own row.
- Everything the engine can do. This is the public support surface, kept to formats and four properties each. The CLI and the workbench show more for a given file.
Check it on your own file
The workbench shows the coverage for whatever you drop in, locally. In the CLI,
sis explain members FILE shows the nested tree with each member's format and
coverage, and sis explain detection FILE shows why a file was analysed as a
given format and which handlers ran or were skipped.
Want to see the coverage rather than read the table?
Open the investigation workbench → How the analysis works