From Forensics Wiki
Revision as of 23:03, 27 November 2013 by Joachim Metz
The gzip file (.gz) format consists of:
- a 10-byte header, containing a magic number (1f 8b), a version number and a timestamp
- The file header:
The file header is 10 bytes in size and contains:
|0||2||0x1f 0x8b||Signature (or identification byte 1 and 2)|
|4||4|| Last modification time |
Contains a POSIX timestamp.
|9||1|| Operating system |
Value that indicates on which operating system the gzip file was created.
- optional extra headers, such as the original file name,
- a body, containing a DEFLATE-compressed payload
- an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.