Difference between revisions of "Chrome Disk Cache Format"

From ForensicsWiki
Jump to: navigation, search
(Created page with "{{expand}} == Cache files == The cache is stored in multiple: {| class="wikitable" |- ! Filename ! Description |- | index | The index file |- | data_# | Data block files |- |...")
 
m (Examples =)
Line 107: Line 107:
 
|}
 
|}
  
=== Examples ====
+
==== Examples ====
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-

Revision as of 14:26, 21 June 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Cache files

The cache is stored in multiple:

Filename Description
index The index file
data_# Data block files
f_###### (Separate) data stream file

Cache address

The cache address is 4 bytes in size and consists of:

offset size value description
If file type is 0 (Separate file)
0.0 28 bits File number
The value represents the value of # in f_######
Else
0.0 16 bits Block number
2.0 8 bits File number (or file selector)
The value represents the value of # in data_#
3.0 2 bits Block size
The number of contiguous blocks where 0 represents 1 block and 3 represents 4 blocks.
3.2 2 bits Reserved
Common
3.4 3 bits File type
3.7 1 bit Initialized flag

File types

Value Description
0 (Separate) data stream file
1 (Rankings) block data file (36 byte block data file)
2 256 byte block data file
3 1024 byte block data file
4 4096 byte block data file
6 Unknown; seen on Mac OS X 0x6f430074

Examples

Value Description
0x00000000 Not initialized
0x8000002a Data stream file: f_00002a
0xa0010003 Block data file: data_1, block number 3, 1 block of size

See Also

External Links