CBOR (Concise Binary Object Representation)
| Format | CBOR (Concise Binary Object Representation) |
|---|---|
| Short name | CBOR |
| Category | serialization |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
RFC 8949 binary serialization format increasingly found in mobile and web app data. Mandatory encoding for WebAuthn/FIDO2 authentication — passkey credential data, attestation objects, and public key material on iOS, Android, and Windows are CBOR-encoded. Also used in some messaging app caches and IoT device communication. No mandatory magic bytes — data may begin with the optional self-described CBOR tag (0xD9D9F7); otherwise identification relies on file extension or surrounding context. Structurally similar to JSON but binary; a CBOR decoder is required to recover readable key/value structures.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | D9 D9 F7 | ... | Optional self-described CBOR tag 55799 (RFC 8949, 3.4.6) |
Known extensions
.cbor
References
- Format spec (RFC 8949) https://www.rfc-editor.org/rfc/rfc8949.html
- CBOR overview and tools https://cbor.io/
- COSE structures and process (CBOR Object Signing and Encryption, RFC 9052) https://www.rfc-editor.org/rfc/rfc9052.html
- WebAuthn Level 3 spec (CBOR usage) https://www.w3.org/TR/webauthn-3/
Cite this entry
Crush Format Reference, “CBOR (Concise Binary Object Representation)”. https://kalink0.github.io/crush-forensics/formats/cbor/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction