Firefox Cache (cache2)
| Format | Firefox Cache (cache2) |
|---|---|
| Short name | cache2 |
| Category | database |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The HTTP cache of Firefox and other Gecko-based browsers in the profile's cache2 folder: an index file and one file per entry below entries/, named by a hash of the key. Each entry file holds the cached content followed by metadata; the last 4 bytes point to the metadata, which contains a version, fetch count, last fetched, last modified and expiration times, the key (URL with context prefixes) and elements such as the response headers. Cached content can show visited pages and loaded resources independent of the browsing history. Entry format version 4 supports at-rest encryption of the metadata.
Signatures
None recorded
Known extensions
None recorded
References
- CacheFileMetadata.h (Firefox source) https://github.com/mozilla-firefox/firefox/blob/main/netwerk/cache2/CacheFileMetadata.h
- Firefox cache file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Firefox%20cache%20file%20format.asciidoc
Cite this entry
Crush Format Reference, “Firefox Cache (cache2)”. https://kalink0.github.io/crush-forensics/formats/cache2/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction