Difference between revisions of "Gzip"

From ForensicsWiki
Jump to: navigation, search
(External Links)
Line 3: Line 3:
 
The gzip file (.gz) format consists of:
 
The gzip file (.gz) format consists of:
 
* a 10-byte header, containing a magic number (1f 8b), a version number and a timestamp
 
* a 10-byte header, containing a magic number (1f 8b), a version number and a timestamp
 +
 +
* The file header:
 +
The file header is 10 bytes in size and contains:
 +
{| class="wikitable"
 +
! align="left"| Offset
 +
! Size
 +
! Value
 +
! Description
 +
|-
 +
| 0
 +
| 2
 +
| 0x1f 0x8b
 +
| Signature (or identification byte 1 and 2)
 +
|-
 +
| 2
 +
| 1
 +
|
 +
| Compression Method
 +
|-
 +
| 3
 +
| 1
 +
|
 +
| Flags
 +
|-
 +
| 4
 +
| 4
 +
|
 +
| Last modification time <br> Contains a POSIX timestamp.
 +
|-
 +
| 8
 +
| 1
 +
|
 +
| Extra flags
 +
|-
 +
| 9
 +
| 1
 +
|
 +
| Operating system <br> Value that indicates on which operating system the gzip file was created.
 +
|}
 +
 
* optional extra headers, such as the original file name,
 
* optional extra headers, such as the original file name,
 
* a body, containing a DEFLATE-compressed payload
 
* a body, containing a DEFLATE-compressed payload

Revision as of 01:03, 28 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

The gzip file (.gz) format consists of:

  • a 10-byte header, containing a magic number (1f 8b), a version number and a timestamp
  • The file header:

The file header is 10 bytes in size and contains:

Offset Size Value Description
0 2 0x1f 0x8b Signature (or identification byte 1 and 2)
2 1 Compression Method
3 1 Flags
4 4 Last modification time
Contains a POSIX timestamp.
8 1 Extra flags
9 1 Operating system
Value that indicates on which operating system the gzip file was created.
  • optional extra headers, such as the original file name,
  • a body, containing a DEFLATE-compressed payload
  • an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.

External Links