---
{
  "title": "Archive Collected Data",
  "summary": "Archiving collected data packages information for easier staging or transfer.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1560"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1560: Archive Collected Data",
      "url": "https://attack.mitre.org/techniques/T1560"
    }
  ],
  "editorialVersion": 2
}
---

## Packaging information is a separate stage

Archiving collected data combines information into a package convenient for storage, staging, or transfer. Compression can reduce size, and some archive formats support encryption. In an intrusion, packaging may prepare collected documents for later movement, but creating an archive does not by itself establish exfiltration.

Archive tools are also normal parts of backup, software deployment, support, and everyday collaboration. The investigation needs to connect the package with its source material, creator, location, timing, and subsequent handling rather than treating a familiar file extension as a verdict.

## A package appears in a temporary directory

In a fictional design firm, endpoint telemetry shows a command-line archiver running under a staff account shortly after many project files were read. A large archive appears in a temporary location. The analyst checks the process command information, source paths where visible, resulting file metadata, and the account's normal workflow.

The file could be an authorized delivery package. It could also be preparation for unauthorized transfer. A recent request from a project owner, a documented destination, and matching contents would support the legitimate explanation; an unexplained collection spanning unrelated projects would increase concern.

Inspecting the package itself may expose sensitive information, so use authorized handling and controlled storage. If it is encrypted, record that limitation rather than assuming its contents from the filename. Avoid placing confidential documents in broad ticket attachments during analysis.

## Link preparation to later activity

Look for supported relationships between the archive and any subsequent upload, copy, or external sharing. Matching paths, hashes, sizes, and process activity can help, but each has limits. A network byte count alone may not identify the transferred content.

[[data-staged]] describes the location and preparation of collected information. [[exfiltration]] concerns movement across the intended boundary. Keeping those stages separate makes impact statements more accurate.

## Respond to the actual risk

If packaging is part of ongoing unauthorized activity, containment may involve the affected device, identity, or transfer path. Preserve the archive metadata and relevant records before deletion where practical. Deleting one package does not remove access to the original documents or prevent a new archive being created.

For practice, construct three fictional cases: a scheduled backup, an approved project delivery, and unexplained collection from several restricted folders. List the contextual evidence that distinguishes them and write one cautious conclusion for each. Identify what additional evidence would be necessary to claim that the information left the organization. [[logs-and-telemetry]] and [[incident-response]] connect this file-level observation to the wider investigation.

## Related concepts

- [[mitre-attack]]