bzip2 Compressed Data
| Format | bzip2 Compressed Data |
|---|---|
| Short name | bzip2 |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Block-sorting compressed stream holding a single file, often a TAR archive (.tar.bz2) or a log/disk image. No file name or timestamp is stored. Each block (up to 900 kB uncompressed) carries its own CRC and starts with a 48-bit block magic; since blocks are bit-aligned, recovering undamaged blocks from truncated or carved streams requires a bit-level search (e.g. bzip2recover). Multiple streams may be concatenated.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 42 5A 68 | BZh | Signature 'BZh' followed by the block size digit |
| offset 4 (0x4) | 31 41 59 26 53 59 | 1AY&SY | First block magic 0x314159265359 (BCD pi) |
| offset 4 (0x4) | 17 72 45 38 50 90 | .rE8P. | Stream footer magic 0x177245385090 (BCD sqrt(pi)) of an empty stream |
Known extensions
.bz2, .tbz2, .tbz
References
- bzip2 (sourceware.org) https://sourceware.org/bzip2/
- The bzip2 format (Joe Tsai, dsnet/compress) https://github.com/dsnet/compress/blob/master/doc/bzip2-format.pdf
Cite this entry
Crush Format Reference, “bzip2 Compressed Data”. https://kalink0.github.io/crush-forensics/formats/bzip2/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction