EXPAND Command Guide - Extract Files from Cabinet Files in Windows

The expand command is a Windows Command Prompt utility that extracts files from cabinet (.cab) files and compressed Windows installation files. Use expand source.cab -F:files destination to extract specific files, or expand -r source.cab destination to expand all files with automatic renaming—essential for driver installation, recovering system files, and extracting Windows installation components.

Whether you're installing drivers from a cabinet package, extracting system files from the Windows installation media, recovering a corrupted file from the Windows Store, or pulling specific DLLs from a deployment cabinet, mastering expand provides direct access to cabinet contents without third-party tools. IT professionals and system administrators rely on this command for driver deployment, offline system repair, and custom installation scripts.

This comprehensive guide covers expand syntax, the -r and -F parameters, practical examples for drivers and system files, troubleshooting tips, related commands, and frequently asked questions. By the end, you'll confidently extract files from cabinet archives from the command line.

What Is the Expand Command?

The expand command is a built-in Windows utility for extracting files from Microsoft Cabinet (.cab) files. Cabinet files are a compression format used by Windows and many installers to package multiple files into a single archive. Key capabilities:

Extract specific files – Use -F:files to extract only matching files
Extract all files – Omit -F to extract the entire cabinet
Automatic renaming (-r) – Expands files that use short (8.3) names in the cabinet to long filenames
Wildcard support – Use * and ? in -F filter for pattern matching

Expand works in Command Prompt (CMD) and requires the cabinet file to be in standard Microsoft format. It is available in all Windows versions from Windows NT through Windows 11 and Windows Server. Commonly used for driver installation, SFC (System File Checker) recovery, and Windows component extraction.

Expand Command Syntax

EXPAND [-r] source.cab [-F:files] [destination]
EXPAND source.cab -F:files destination
EXPAND -d source.cab

Parameters and Switches

Parameter	Description
`source.cab`	Cabinet file to expand. Path required.
`destination`	Directory or file path for extracted files. Optional for single-file extract to current directory.
`-r`	Rename expanded files. Expands short names to long filenames (e.g., file~1.sys → actualname.sys).
`-F:files`	Specify names of files to extract. Wildcards * and ? supported. Required when extracting specific files.
`-d`	Display cabinet contents (directory listing). Does not extract.

Important Rules

For extracting specific files, both source and destination are required when using -F.
Use -r when cabinet contains short 8.3 filenames and you need long names.
Destination can be a directory (extracts with original/short names) or a specific filename (single file extract).
Cabinet files can be on local drives or network paths.

Parameters in Detail

Rename Mode (-r)

When a cabinet stores files with short 8.3 names (e.g., driv~1.sys), use -r to expand them to their full long filenames. Essential for driver cabinets and Windows component cabinets that use abbreviated names internally.

Filter Mode (-F:files)

Specify which files to extract. Use wildcards: -F:*.sys extracts all .sys files, -F:nt*.dll extracts DLLs starting with nt. Without -F, expand extracts the first file only (legacy behavior) or all files depending on cabinet structure.

Directory Listing (-d)

Use expand -d source.cab to list contents without extracting. Helps verify cabinet contents and correct file names before extraction.

Examples

Extract All Files from Cabinet

Extract every file in a cabinet to a destination directory:

expand -r driver.cab C:\Drivers\

-r ensures long filenames. All files from driver.cab go to C:\Drivers. Use for full driver packages.

Extract Specific File Types

Extract only .sys (driver) files from a cabinet:

expand driver.cab -F:*.sys C:\Drivers

Use when you need only driver binaries, not INF or other support files.

Extract Single File

Extract one specific file to a destination:

expand install.cab -F:config.ini C:\Temp\

Use when you need a single file from a large cabinet without extracting everything.

Extract with Wildcard Pattern

Extract files matching a pattern:

expand win.cab -F:nt*.dll C:\System\

Extracts DLLs whose names start with "nt" (e.g., ntdll.dll, ntoskrnl.exe if in cabinet).

List Cabinet Contents

View what's inside without extracting:

expand -d driver.cab

Output shows filenames and sizes. Use to verify correct -F pattern before extraction.

Extract from Network Path

Cabinet on a network share:

expand \\Server\Packages\updates.cab -F:*.dll C:\Updates\

Works with UNC paths. Ensure read access to source and write access to destination.

Extract to Current Directory

Extract files to current folder:

cd C:\Extract
expand C:\Cabs\package.cab -F:*.* .

The . denotes current directory.

Recover System File with SFC

When SFC cannot repair a file, manually extract from installation media:

expand D:\sources\install.wim -F:filename.dll C:\Windows\System32\

Note: install.wim uses different structure; for Windows 10/11, DISM or media extraction tools may be preferred. Expand works best with .cab files.

Common Use Cases

Install drivers from cabinet – Extract .sys, .inf, and support files from a driver.cab package to a directory, then install via Device Manager or pnputil.
Recover corrupted system files – When SFC finds corruption, extract the original file from Windows installation media cabinet to replace the corrupted copy.
Deploy driver packages – In deployment scripts, expand driver cabinets to a staging folder before running installation (e.g., with pnputil or dpinst).
Extract Windows components – Pull specific DLLs or executables from Windows cabinet files for analysis, troubleshooting, or custom deployment.
Offline driver integration – Add drivers to Windows image by expanding cabinet to driver store location during offline servicing.
Software installation support – Some installers ship components in .cab; expand them when the installer fails or for manual installation.
Recovery environment – In WinRE or recovery console, expand files from installation media to repair a broken Windows installation.
Audit cabinet contents – Use expand -d to inventory what's inside a cabinet before deploying or when troubleshooting missing files.
Extract language packs – Windows language packs sometimes use cabinet format; expand to extract specific language files.
Legacy application support – Older applications distributed as .cab files; expand to extract for installation or migration.
Build customization – Extract specific components from Windows cab files for customized install images or slipstream scenarios.
Troubleshooting missing DLLs – When an application reports a missing DLL, extract it from the application's cabinet or Windows media.

Tips and Best Practices

Use -r for driver cabinets – Driver packages often use short names. Always use -r when expanding driver.cab files to get correct long filenames.
Verify cabinet before extract – Run expand -d cabinet.cab to list contents and confirm file names. Prevents wrong -F patterns.
Create destination directory first – Ensure the destination folder exists. Expand may not create parent directories in all scenarios.
Use absolute paths – Specify full paths for source and destination to avoid current-directory confusion.
Quote paths with spaces – Enclose paths in double quotes: expand "C:\My Cabs\file.cab" -F:*.* C:\Out.
Check cabinet format – Expand works with Microsoft cabinet format. Some .cab files use different formats; use 7-Zip or WinRAR if expand fails.
Admin rights for system directories – Extracting to C:\Windows\System32 requires Administrator privileges. Run CMD as Administrator.
Backup before overwrite – When replacing system files, backup the existing file first. Incorrect extraction can cause boot or stability issues.
Combine with pnputil – For driver deployment: expand cabinet to folder, then pnputil /add-driver folder\*.inf /install to install.
Network path considerations – Expanding from network shares can be slow for large cabinets. Copy to local drive first if performance matters.
Wildcard in -F – Use -F:*.ext for extension filter. Test with expand -d first to verify names.
Document source cabinets – In scripts, document which cabinet and -F pattern for reproducibility and troubleshooting.

Troubleshooting Common Issues

"Cannot Open Cabinet File"

Problem: Expand reports it cannot open the cabinet file.

Cause: File doesn't exist, path is wrong, file is corrupt, or file isn't a valid Microsoft cabinet.

Solution: Verify path with dir path\to\file.cab. Ensure file isn't 0 bytes or corrupted. Try copying to a simpler path (e.g., C:\temp\file.cab). If file opens in 7-Zip, it may be a different format—use 7-Zip for extraction.

Prevention: Use full paths. Download cabinets again if corruption suspected. Verify file format.

"No Files Specified" or Wrong Files Extracted

Problem: Expand extracts wrong files or nothing.

Cause: Incorrect -F pattern, or cabinet structure uses different naming than expected.

Solution: Run expand -d cabinet.cab to see exact file names. Use the exact names or correct wildcard in -F. For single file, use -F:exactname.ext.

Prevention: Always run expand -d first when unsure of cabinet contents.

"Access Denied" When Extracting to System Directory

Problem: Expand fails with access denied when destination is C:\Windows\System32.

Cause: Insufficient permissions. System files are protected.

Solution: Run Command Prompt as Administrator. For WRP-protected files, use DISM or SFC for repair. Take ownership with takeown/icacls if appropriate.

Prevention: Run CMD as Administrator when extracting to system directories.

Extracted Files Have Wrong Names

Problem: Extracted files have short 8.3 names like file~1.sys instead of full names.

Cause: -r switch was not used. Cabinet stores short names.

Solution: Use expand -r cabinet.cab -F:files destination. The -r enables long filename expansion.

Prevention: Always use -r when expanding driver or Windows component cabinets.

"Destination Path Not Found"

Problem: Expand reports destination path not found.

Cause: Destination directory doesn't exist. Expand may not create it.

Solution: Create directory first: mkdir C:\Destination. Then run expand. Use full path.

Prevention: Create destination before expand in scripts: if not exist dest mkdir dest.

Cabinet Too Large or Extract Very Slow

Problem: Expand takes very long or seems to hang on large cabinet.

Cause: Large cabinet, slow disk, or network source.

Solution: Copy cabinet to local SSD first. Ensure sufficient free space. For very large files, consider 7-Zip which may be faster for some formats.

Prevention: Use local paths. Ensure adequate disk space (cabinet may expand to 2-3x size).

Related Commands

DISM – Deployment Image Servicing

DISM services Windows images and can extract files from .wim files. For Windows 10/11 installation files, DISM is often preferred over expand when working with install.wim.

When to use expand: Cabinet (.cab) files, driver packages, standalone component extraction.

When to use DISM: WIM files, Windows image servicing, offline Windows repair.

SFC – System File Checker

SFC scans and repairs corrupted system files. When SFC cannot repair, it may suggest manual replacement—expand can extract the correct file from installation media.

When to use expand: After SFC finds corruption and you have installation media. Extract correct file and copy to replace corrupted one.

When to use SFC: First step for system file corruption. Let SFC attempt repair before manual expand.

pnputil – Driver Installation

pnputil adds and installs drivers. Common workflow: expand driver.cab to folder, then pnputil /add-driver to install.

When to use expand: Extract driver files from cabinet before pnputil.

When to use pnputil: Install the extracted drivers. They work together in driver deployment.

extract (Legacy)

extract was an older command for cabinet extraction. Expand is the current replacement. Use expand for all cabinet operations.

Frequently Asked Questions

What does the expand command do?

The expand command extracts files from Microsoft Cabinet (.cab) files. It can extract all files or specific files (using -F), and can expand short 8.3 filenames to long names (using -r).

How do I extract all files from a .cab file?

Use: expand -r source.cab destination_directory. The -r ensures long filenames. Omit -F to extract all files.

How do I extract only specific files from a cabinet?

Use -F with a pattern: expand source.cab -F:*.sys C:\Out. For single file: expand source.cab -F:filename.dll C:\Out. Wildcards * and ? work in -F.

What is the -r switch for?

-r (rename) expands short 8.3 filenames stored in the cabinet to their full long filenames. Essential for driver and Windows component cabinets.

How do I list cabinet contents without extracting?

Use: expand -d source.cab. This lists files and sizes. Useful to verify -F pattern before extraction.

Can I use expand on .wim or .msi files?

No. Expand works with .cab files only. For .wim use DISM. For .msi use msiexec or specialized tools.

Where are Windows driver cabinets located?

Driver packages may be in C:\Windows\System32\DriverStore, on installation media, or from vendor downloads. Use expand -d to inspect before extraction.

Why does expand fail on some .cab files?

Some .cab files use non-Microsoft formats (e.g., InstallShield). Use 7-Zip or the application's built-in extractor for those.

Can expand create the destination directory?

Behavior varies. It's safest to create the destination directory with mkdir before running expand.

Is expand available in PowerShell?

Expand is an external command. In PowerShell, run expand.exe or cmd /c expand .... Alternatively, use PowerShell's Expand-Archive for .zip files (not .cab).

Quick Reference Card

Command	Purpose	Example
`expand -r cab dest`	Extract all with long names	`expand -r driver.cab C:\Drivers`
`expand cab -F:*.ext dest`	Extract by extension	`expand pkg.cab -F:*.sys C:\Out`
`expand cab -F:file dest`	Extract single file	`expand pkg.cab -F:config.ini C:\`
`expand -d cab`	List contents	`expand -d driver.cab`
`expand -r cab -F:* dest`	All files, filtered, long names	`expand -r win.cab -F:* C:\Extract`

Summary

The expand command extracts files from Microsoft Cabinet (.cab) archives. Use expand -r for full extraction with long filenames, expand -F:pattern for selective extraction, and expand -d to list contents. Essential for driver installation, system file recovery, and extracting Windows components. Combine with pnputil for driver deployment and SFC for system file repair. Always verify cabinet contents with -d before extraction and use Administrator privileges when writing to system directories.

Practice the expand command in our Windows Command Simulator. Browse the Commands Reference for all Windows CMD utilities. Explore copy for file copying and xcopy for directory operations.