Berkeley DB Database
| Format | Berkeley DB Database |
|---|---|
| Short name | BDB |
| Category | database |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Embedded key-value database library format with Btree, Hash and Queue access methods. The first page is a metadata page whose magic number at offset 12 identifies the access method; its byte order shows the endianness of the creating system. Commonly encountered as legacy Bitcoin Core wallets (wallet.dat, Btree), which contain keys, addresses and transaction data; newer Bitcoin Core versions use SQLite-based wallets and only migrate legacy files. Also used by older Linux package databases and various Unix services. Freed pages can retain previous records.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 12 (0xC) | 62 31 05 00 | b1.. | Btree metadata magic 0x00053162 (little-endian) |
| offset 12 (0xC) | 00 05 31 62 | ..1b | Btree metadata magic 0x00053162 (big-endian) |
| offset 12 (0xC) | 61 15 06 00 | a... | Hash metadata magic 0x00061561 (little-endian) |
| offset 12 (0xC) | 00 06 15 61 | ...a | Hash metadata magic 0x00061561 (big-endian) |
Known extensions
None recorded
References
- Berkeley DB magic definitions (file/libmagic) https://github.com/file/file/blob/master/magic/Magdir/database
- migrate.cpp — Berkeley DB parser for legacy wallets (Bitcoin Core) https://github.com/bitcoin/bitcoin/blob/master/src/wallet/migrate.cpp
Cite this entry
Crush Format Reference, “Berkeley DB Database”. https://kalink0.github.io/crush-forensics/formats/bdb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction