What Is a .MS_ File?

MS Compress Archive (SZDD / KWAJ)

Overview

MS Compress is the compression format produced by Microsoft's MS-DOS and early Windows COMPRESS.EXE utility. It is a single-file compressor rather than an archive format: one input file becomes one compressed output file, with no directory structure and no support for bundling multiple files.

You will almost always meet these files on old installation media, driver disks, and Windows service packs, where the last character of the extension was replaced with an underscore - SETUP.EX_, DRIVER.SY_, README.TX_. That renaming convention, not the content, is usually the first clue.

Technical Specifications

Format Details

• MIME Type: application/x-mscompress
• File Extensions: .ms_, and by convention any extension ending in _ (.ex_, .dl_, .sy_, .tx_)
• Category: Archive
• Variants: SZDD (most common) and KWAJ
• Compression: LZ77-derived sliding-window algorithm
• Origin: Microsoft, MS-DOS era

Magic Numbers

The two variants are distinguished by their signatures:

SZDD:  53 5A 44 44 88 F0 27 33      "SZDD\x88\xF0'3"
KWAJ:  4B 57 41 4A 88 F0 27 D1      "KWAJ\x88\xF0'\xD1"

A third, rarer variant begins SZ \x88\xF0\x27\x33 ("SZ" followed by a space) and was produced by some early Microsoft tools.

Because the underscore-extension convention is only a convention, content-based detection is the reliable way to identify these files - a .ex_ file is not guaranteed to be compressed, and a compressed file is not guaranteed to end in _.

File Structure

SZDD header

Offset  Size  Field
0x00    8     Signature "SZDD\x88\xF0\x27\x33"
0x08    1     Compression mode ('A' = the only documented mode)
0x09    1     Last character of the original filename
0x0A    4     Uncompressed size (little-endian)
0x0E    ...   Compressed data

The single stored filename character is what makes recovery awkward: the compressor discarded the rest of the name, keeping only the letter that the underscore replaced. Expanding SETUP.EX_ gives back SETUP.EXE only because the header records the final E.

KWAJ header

KWAJ is the more capable variant, used mainly by later Microsoft setup tools. Its header carries a compression-method field (supporting several methods including no compression, XOR, and LZH-style compression) plus optional fields that can store the full original filename and extension.

History and Development

COMPRESS.EXE shipped with Microsoft development and OEM toolkits from the late 1980s, and EXPAND.EXE shipped with MS-DOS and Windows so that end users could decompress installation files. Floppy-disk distribution made per-file compression valuable: setup programs could read a compressed file straight off the disk and expand it during installation.

The format was superseded by Cabinet (CAB) archives, which compress better, hold many files with a real directory, and support spanning across disks. By the Windows 95 era CAB had largely taken over, and MS Compress survives mainly in legacy media and in forensic or preservation work.

Common Use Cases

• Legacy installation media: MS-DOS and early Windows setup disks with .EX_ and .DL_ files.
• Driver packages: older OEM driver disks and firmware update kits.
• Retrocomputing and preservation: recovering files from archived disk images.
• Digital forensics: identifying and expanding compressed payloads found on old systems.
• Service pack extraction: some early Windows updates shipped individual compressed files.

How to Open an MS Compress File

On Windows

EXPAND.EXE is still included with Windows and handles SZDD directly:

REM Expand a single file, giving the full target name
expand SETUP.EX_ SETUP.EXE

REM Expand every compressed file in a folder
expand -r *.??_

On macOS and Linux

The libmspack project provides msexpand, and most distributions package it:

# Debian/Ubuntu
sudo apt install libmspack-dev mscompress

# Expand an SZDD file
msexpand DRIVER.SY_ DRIVER.SYS

# Identify before expanding
file DRIVER.SY_
xxd -l 16 DRIVER.SY_

The separate mscompress/msexpand package implements the SZDD algorithm and is the usual choice on Unix systems.

Programmatic access

libmspack exposes an SZDD and KWAJ decompressor as a C library, and there are ports and bindings in Python, Go, and Rust for tooling that needs to expand these files inline.

Advantages

• Simple and small: a trivial header and a compact decompressor, which mattered on constrained systems.
• Streamable: files can be expanded as they are read, without seeking.
• Still supported: expand.exe remains in current Windows releases, so old media stays readable.

Limitations

• One file per archive: no directory structure, no multi-file bundling.
• Weak compression: the LZ77 variant is far behind Deflate, LZMA, or Zstandard.
• Lossy filenames: SZDD keeps only the final character of the original name, so the rest must be inferred.
• Effectively obsolete: no current Microsoft tooling produces these files.
• Detection ambiguity: the underscore extension convention is not enforced, so identification requires reading the signature.

Related Formats

• CAB: the Cabinet format that replaced MS Compress for Microsoft installers.
• ZIP: the general-purpose archive format with directories and multi-file support.
• GZIP: the Unix equivalent of a single-file stream compressor.
• MSI: the Windows Installer package format used by modern setup programs.