Difference between revisions of "Gzip"

From ForensicsWiki
Jump to: navigation, search
Line 2: Line 2:
  
 
The gzip file (.gz) format consists of:
 
The gzip file (.gz) format consists of:
* The file header:
+
* a file header
 +
* optional extra headers, such as the original file name,
 +
* a body, containing a DEFLATE-compressed payload
 +
* an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.
 +
 
 +
=== File header ===
 
The file header is 10 bytes in size and contains:
 
The file header is 10 bytes in size and contains:
 
{| class="wikitable"
 
{| class="wikitable"
Line 41: Line 46:
 
|}
 
|}
  
* optional extra headers, such as the original file name,
+
==== Extra flags ====
* a body, containing a DEFLATE-compressed payload
+
If compression method is 8 the following extra flags can be defined:
* an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.
+
* 0x02 - compressor used maximum compression, slowest algorithm
 +
* 0x04 - compressor used fastest algorithm
  
 
== External Links ==
 
== External Links ==

Revision as of 02:31, 28 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

The gzip file (.gz) format consists of:

  • a file header
  • optional extra headers, such as the original file name,
  • a body, containing a DEFLATE-compressed payload
  • an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.

File header

The file header is 10 bytes in size and contains:

Offset Size Value Description
0 2 0x1f 0x8b Signature (or identification byte 1 and 2)
2 1 Compression Method
3 1 Flags
4 4 Last modification time
Contains a POSIX timestamp.
8 1 Extra flags
9 1 Operating system
Value that indicates on which operating system the gzip file was created.

Extra flags

If compression method is 8 the following extra flags can be defined:

  • 0x02 - compressor used maximum compression, slowest algorithm
  • 0x04 - compressor used fastest algorithm

External Links