7za create AES256 password protected encrypted zip of a folder

Question

I want to create an AES256 encrypted zip of a folder. I am on Mac and I want to create the zip file and store it in an external drive. I want to AES256 encrypt the file in case I lose the external drive, no one can read it.

I am using the command

7za a -tzip '-pPASSWORD' -mem=AES256 personal_data.zip /Users/myuser/personal_data

The directory /Users/myuser/personal_data has subfolders and files inside it.

When I extract, the directory structure is non retained and it extracts all the content, at the root of place where I extract.

I use below command to extract.

7za e personal_data.zip

I have two questions:

1. How can I maintain the directory structure when it extracts?
2. Is this the most secure way to store a Zip file with sensitive content on the personal system?

Thank you

Answer 1

Well first,
e Extract files from archive (without using directory names)
so you want to use
x eXtract files with full paths
instead to extract.

[I'm assuming the debian & mac versions of 7za are equivalent.]

---

It's definitely not the most secure method, for one your password could be getting stored in your .history file, or be easily visible from a process listing showing the full command line.

And 7z isn't an encryption / security program. Even if it does use AES256 competently, it might not be picking suitable random numbers, or could be making any number of seemingly tiny mistakes that drastically lower security. Look into using GPG instead (you can pipe into/out of it, as in tar ...|gpg... 7z can pipe in or out too but may have some trouble doing both at the same time).

Or an on-the-fly encryption like LUKS, or eCryptfs, or EncFS (maybe older, maybe unsupported, still appears functional), or even TrueCrypt/VeraCrypt, there's probably some mac-specific software too. Then you don't have to worry about unencrypted files, or their remnants lying around after deletion.