Bzip2

From Just Solve the File Format Problem
(Difference between revisions)
Jump to: navigation, search
(Added sample file)
(add details from ForensicsWiki entry)
 
Line 11: Line 11:
  
 
== Identification ==
 
== Identification ==
Files begin with bytes <code>42 5A 68 ?? 31 41 59 26 53 59</code>.
 
  
Note that part of the signature is a [[Binary-coded decimal|BCD]] representation of the digits of π.
+
Files begin with magic number "BZ" (bytes 42 5A). Then either an "h" (0x68; [[Huffman coding]]) or "0" (0x30; deprecated original version), then the block size, in 100kb units (TODO: clarify this).
 +
 
 +
Each compressed block starts with a magic number 0x314159265359 (yes, that is the start of decimal π, but in hex.)
 +
 
 +
The end of file marker uses magic number 0x177245385090 (square root of π, in the same ... interesting ... format.)
  
 
== Software ==
 
== Software ==
Line 29: Line 32:
 
* [[Wikipedia:Bzip2|Wikipedia article]]
 
* [[Wikipedia:Bzip2|Wikipedia article]]
 
* [https://twitter.com/angealbertini/status/537704386080694274/photo/1 Chart of format details]
 
* [https://twitter.com/angealbertini/status/537704386080694274/photo/1 Chart of format details]
* [https://lwn.net/Articles/762264/ bzip.org changes hands]
+
* [https://lwn.net/Articles/762264/ bzip.org changes hands] (LWN article from August 9, 2018)
 +
* [https://web.archive.org/web/20190809161013/http://www.forensicswiki.org/wiki/Bzip2 ForensicsWiki entry] (also includes more details on the headers)

Latest revision as of 01:20, 26 October 2020

File Format
Name bzip2
Ontology
Extension(s) .bz2
MIME Type(s) application/x-bzip2
PRONOM x-fmt/268
Released 1997

bzip2 is a data compression algorithm and compressed file format.

Contents

[edit] Identification

Files begin with magic number "BZ" (bytes 42 5A). Then either an "h" (0x68; Huffman coding) or "0" (0x30; deprecated original version), then the block size, in 100kb units (TODO: clarify this).

Each compressed block starts with a magic number 0x314159265359 (yes, that is the start of decimal π, but in hex.)

The end of file marker uses magic number 0x177245385090 (square root of π, in the same ... interesting ... format.)

[edit] Software

[edit] Sample files

[edit] See also

[edit] Links

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox