Difference between revisions of "Gzip"

From ForensicsWiki
Jump to: navigation, search
Line 2: Line 2:
  
 
The gzip file (.gz) format consists of:
 
The gzip file (.gz) format consists of:
* a 10-byte header, containing a magic number (1f 8b), a version number and a timestamp
 
 
 
* The file header:
 
* The file header:
 
The file header is 10 bytes in size and contains:
 
The file header is 10 bytes in size and contains:

Revision as of 01:03, 28 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

The gzip file (.gz) format consists of:

  • The file header:

The file header is 10 bytes in size and contains:

Offset Size Value Description
0 2 0x1f 0x8b Signature (or identification byte 1 and 2)
2 1 Compression Method
3 1 Flags
4 4 Last modification time
Contains a POSIX timestamp.
8 1 Extra flags
9 1 Operating system
Value that indicates on which operating system the gzip file was created.
  • optional extra headers, such as the original file name,
  • a body, containing a DEFLATE-compressed payload
  • an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.

External Links