Supported formats

What the engine routes, format by format.

This table is generated from the SIS engine's own format registry, so it cannot drift from what the code actually routes. It states what a root format is declared to have — not how well any particular file was covered. Coverage is reported per scan, and the report is the thing to trust for your file.

How to read it

  • Native analysis — a native analysis lane is declared for the format. It is a statement that the machinery exists, not a depth or accuracy grade.
  • Recognised only — the format is identified, but there is no analysis lane. Findings for these are limited to what recognition reveals, and the result says it could not look inside.
  • Detected only — content is detected but not routed to a specific format lane.
  • Nested content — the registry declares extraction of members, embedded objects or inline references, under explicit budgets. Listing only means members are named but their contents are not extracted.
  • Sanitisation backend — a native sanitisation path exists for the format. Sanitisation is format-dependent and followed by a verify-rescan; it is not universal content disarm and reconstruction, and it does not certify the result is harmless.
Format Analysis Nested content Sanitisation backend
Archives and disk images
ISO / UDF disk images iso Native analysis Yes Format-dependent
ZIP zip Native analysis Yes Format-dependent
Documents
PDF pdf Native analysis Yes Format-dependent
Email and messages
EML email eml Native analysis Yes —
MHT / MHTML mht Native analysis Yes —
Outlook MSG msg Native analysis Yes —
Executables
ELF elf Native analysis — —
Mach-O macho Native analysis — —
PE (Windows executables) pe Native analysis — —
Fonts
Fonts font Native analysis — —
Images
BMP bmp Native analysis — —
GIF gif Native analysis — —
JPEG jpeg Native analysis — —
JPEG 2000 jp2 Native analysis — —
PNG png Native analysis — —
TIFF tiff Native analysis — —
WebP webp Native analysis — —
Markup and styles
CSS css Native analysis Yes —
HTML html Native analysis Yes Format-dependent
SVG svg Native analysis Yes Format-dependent
XML xml Native analysis Yes —
Media
Media containers media Native analysis — —
SWF swf Native analysis — —
Office documents
Office Open XML ooxml Native analysis Yes Format-dependent
OLE compound files ole2 Native analysis Yes —
RTF rtf Native analysis Yes Format-dependent
Scripts
HTA hta Native analysis Yes —
JavaScript js Native analysis — —
PowerShell ps1 Native analysis — —
Shell scripts sh Native analysis — —
VBScript vbs Native analysis — —
Windows Script Files wsf Native analysis — —
Other
7-Zip sevenzip Native analysis Yes Format-dependent
Compressed streams compressed_stream Recognised only Yes —
Legacy media containers media-legacy-container Recognised only — —
OneNote one Native analysis Yes —
Python scripts py Native analysis — —
RAR rar Recognised and listed, but contents are not extracted: the engine reports the archive as not extracted, which keeps the result out of the clean category (arc:rar_not_extracted). Native analysis Listing only —
TAR tar Native analysis Yes Format-dependent
Unrecognised content unknown Detected only — —
VBA projects vba Native analysis — —
Windows shortcuts (LNK) lnk Native analysis — —

Registry snapshot dated 2026-10-02. The format identifiers are the engine's own, shown so the table can be matched against sis output.

What this table does not tell you

  • Coverage of your file. A native lane running does not mean every byte or member was reached. Budgets, encrypted members, malformed structure and unsupported surfaces each leave a gap, and the per-scan report records them. Where a format has no member producer, a report can read as complete traversal while enumerating nothing, so do not read "complete" as "everything was examined" for those.
  • Depth or detection quality. "Native analysis" is not a detection-rate claim. Differences between formats in depth and in how much evidence they produce are real and are not graded here.
  • Embedded and secondary surfaces. Content carried inside another format — an image in a document, a script in markup — is reached through the container's lane and its budgets, not through its own row.
  • Everything the engine can do. This is the public support surface, kept to formats and four properties each. The CLI and the workbench show more for a given file.

Check it on your own file

The workbench shows the coverage for whatever you drop in, locally. In the CLI, sis explain members FILE shows the nested tree with each member's format and coverage, and sis explain detection FILE shows why a file was analysed as a given format and which handlers ran or were skipped.

Want to see the coverage rather than read the table?

Open the investigation workbench → How the analysis works