Difference between revisions of "Gzip"

From Forensics Wiki
Jump to: navigation, search
(One intermediate revision by one user not shown)
Line 1: Line 1:
 
{{expand}}
 
{{expand}}
  
 +
== File format ==
 
The gzip file (.gz) format consists of:
 
The gzip file (.gz) format consists of:
* The file header:
+
* a file header
 +
* optional extra headers, such as the original file name,
 +
* a body, containing a DEFLATE-compressed payload
 +
* an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.
 +
 
 +
=== File header ===
 
The file header is 10 bytes in size and contains:
 
The file header is 10 bytes in size and contains:
 
{| class="wikitable"
 
{| class="wikitable"
Line 41: Line 47:
 
|}
 
|}
  
* optional extra headers, such as the original file name,
+
==== Extra flags ====
* a body, containing a DEFLATE-compressed payload
+
If compression method is 8 the following extra flags can be defined:
* an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.
+
* 0x02 - compressor used maximum compression, slowest algorithm
 +
* 0x04 - compressor used fastest algorithm
  
 
== External Links ==
 
== External Links ==

Revision as of 01:31, 28 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Contents

File format

The gzip file (.gz) format consists of:

  • a file header
  • optional extra headers, such as the original file name,
  • a body, containing a DEFLATE-compressed payload
  • an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data.

File header

The file header is 10 bytes in size and contains:

Offset Size Value Description
0 2 0x1f 0x8b Signature (or identification byte 1 and 2)
2 1 Compression Method
3 1 Flags
4 4 Last modification time
Contains a POSIX timestamp.
8 1 Extra flags
9 1 Operating system
Value that indicates on which operating system the gzip file was created.

Extra flags

If compression method is 8 the following extra flags can be defined:

  • 0x02 - compressor used maximum compression, slowest algorithm
  • 0x04 - compressor used fastest algorithm

External Links