Firefox Disk Cache Format

From ForensicsWiki
Jump to: navigation, search

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

There are multiple versions of the Firefox Disk Cache format:

  • Cache version 1
  • Cache version 2 - default as of firefox 32 [1]

Cache version 1

The Cache directory contains the multiple type of cache files:

  • Cache Map File
  • Cache Block File
  • Cache Data File

Cache Map file

File named _CACHE_MAP_

Contains:

  • Cache Map file header
  • An array of Cache Map buckets

There are 32 buckets in the Cache map file. Within each bucket, there are 256 records inside each bucket, hence the Cache Map file contains 8192 records in total.

Each record contains the information for one instance of cache data. A record contains four 32-bit integers:

  • A Hash Number
  • An Eviction Rank
  • The Data Location
  • The Metadata Location

Cache Block file

File named _CACHE_00#_, where # is a number ranging from [1-3].

Cache Data File

File named:

<hash number><type><generation number>

Where <hash number>, <type>, <generation number> are placeholders for the corresponding values.

Cache version 2

cache2/index
cache2/doomed/*
cache2/entries/*

See Also

External Links