ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Compression"

From ForensicsWiki
Jump to: navigation, search
(Deflate/Inflate)
(LZXpress)
 
(11 intermediate revisions by the same user not shown)
Line 5: Line 5:
 
=== Deflate/Inflate ===
 
=== Deflate/Inflate ===
 
Used in:
 
Used in:
 +
* [[Encase image file format|Expert Witness (Compression) Format (EWF)]]
 
* [[Gzip|gzip]]
 
* [[Gzip|gzip]]
 +
* [[Personal Folder File (PAB, PST, OST)]], in compressed Offline Storage Table (OST) files.
 +
* [[QCOW Image Format]], in compressed images
 +
* [[VMWare Virtual Disk Format (VMDK)]], in compressed images
  
 
=== LZNT1 ===
 
=== LZNT1 ===
Line 11: Line 15:
 
* [[NTFS]]
 
* [[NTFS]]
 
* [[Windows SuperFetch Format]]
 
* [[Windows SuperFetch Format]]
 +
 +
=== LZSS ===
 +
* [http://en.wikipedia.org/wiki/Lempel%E2%80%93Ziv%E2%80%93Storer%E2%80%93Szymanski Wikipedia: Lempel–Ziv–Storer–Szymanski]
 +
 +
=== LZX ===
 +
Used in:
 +
* [http://msdn.microsoft.com/library/bb417343.aspx#lzxdatacompressionformat Microsoft Cabinet Format]
 +
 +
The Windows implementation of LZX can be found in lz32.dll and is used by the WINAPI LZ functions e.g. LZOpenFile.
  
 
=== LZXPRESS ===
 
=== LZXPRESS ===
Line 17: Line 30:
  
 
=== LZXPRESS Huffman ===
 
=== LZXPRESS Huffman ===
 +
Variant of LZXPRESS that uses Huffman encoding.
 +
 
Used in:
 
Used in:
* [[Windows SuperFetch Format]]
+
* [[Windows SuperFetch Format]], Windows 7
 +
 
 +
==== LZXPRESS Huffman stream ====
 +
Variant of LZXPRESS Huffman that allows for LZ compression tuples that refer to previous blocks of uncompressed data.
 +
 
 +
Used in:
 +
* [[Windows Prefetch File Format]], Windows 10
 +
* [[Windows SuperFetch Format]], Windows 8
  
 
== External Links ==
 
== External Links ==
Line 26: Line 48:
 
=== Deflate/Inflate ===
 
=== Deflate/Inflate ===
 
* [http://en.wikipedia.org/wiki/DEFLATE Wikipedia: DEFLATE]
 
* [http://en.wikipedia.org/wiki/DEFLATE Wikipedia: DEFLATE]
* [https://tools.ietf.org/html/rfc1950 IETF: RFC1950 - ZLIB Compressed Data Format Specification]
+
* [https://tools.ietf.org/html/rfc1950 RFC1950 - ZLIB Compressed Data Format Specification], by [[IETF]]
* [https://tools.ietf.org/html/rfc1951 IETF: RFC1951 - DEFLATE Compressed Data Format Specification]
+
* [https://tools.ietf.org/html/rfc1951 RFC1951 - DEFLATE Compressed Data Format Specification], by [[IETF]]
  
 
=== LZ1 ===
 
=== LZ1 ===
 
* [http://andyh.org/LZ1.html LZ1]
 
* [http://andyh.org/LZ1.html LZ1]
 +
 +
=== LZXpress ===
 +
* [https://msdn.microsoft.com/library/hh554002(v=prot.10).aspx MS-XCA: Xpress Compression Algorithm], by Microsoft

Latest revision as of 05:04, 22 June 2015

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

LZ-based

Deflate/Inflate

Used in:

LZNT1

Used in:

LZSS

LZX

Used in:

The Windows implementation of LZX can be found in lz32.dll and is used by the WINAPI LZ functions e.g. LZOpenFile.

LZXPRESS

Used in:

LZXPRESS Huffman

Variant of LZXPRESS that uses Huffman encoding.

Used in:

LZXPRESS Huffman stream

Variant of LZXPRESS Huffman that allows for LZ compression tuples that refer to previous blocks of uncompressed data.

Used in:

External Links

Deflate/Inflate

LZ1

LZXpress