> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/linux-forensics/inspecting-rpm-deb-packages.md).

# Inspecting RPM/DEB packages

An RPM package (.rpm) is a package which is used to store files/scripts/conf files on RedHat systems.

Likewise, .deb files (Debian/binary packages) contain similar contents for Debian-based systems.

Let's inspect a simple .deb package provided by ProtonVPN for their CLI VPN client (available [here](https://protonvpn.com/download/protonvpn-stable-release_1.0.0-1_all.deb)).

```
$ file protonvpn-stable-release_1.0.0-1_all.deb
protonvpn-stable-release_1.0.0-1_all.deb: Debian binary package (format 2.0), with control.tar.xz, data compression xz
```

To unpack .deb files, you can either use dpkg -c like so;

```
$ dpkg -c protonvpn-stable-release_1.0.0-1_all.deb
```

Or you can simply use tar -x, like so;

```
$ tar -x protonvpn-stable-release_1.0.0-1_all.deb
```

Or use dpkg-deb;

```
$ dpkg-deb -x protonvpn-stable-release_1.0.0-1_all.deb .
```

This will create the files/directories which would be modified/created if you were to install the package with dpkg.

RPM - TBA