Crush — Format Reference

Built from crush/data/build_formats_db.py at commit 640a2a9928f4 on 2026-10-21 06:46:19 UTC.

← All formats

Chromium Disk Cache

FormatChromium Disk Cache
Short nameChrome cache
Categorydatabase
PlatformsWindows, macOS, Linux, Android
Crush supportNot yet supported
StatusReviewed
Last reviewed2026-10-05

Forensic relevance

The HTTP cache of Chrome, Edge and other Chromium browsers and Electron apps. The blockfile backend (default on Windows) uses an index file and data_0..3 block files; the simple backend (default on all other platforms) stores one file per entry. Entries hold the URL, response headers with server dates and the cached content (pages, images, scripts), also for sites no longer in history. With cache partitioning, keys are prefixed with '_dk_' and the site that loaded the resource, revealing the context in which it was requested. Content is stored as transferred, so it may be gzip-, Brotli- or Zstandard-encoded.

Signatures

OffsetHex ASCII (non-printable as .)Description
offset 0 (0x0)C3 CA 03 C1....Blockfile index magic 0xC103CAC3
offset 0 (0x0)C3 CA 04 C1....Blockfile data file magic 0xC104CAC3
offset 0 (0x0)30 5C 72 A7 1B 6D FB FC0\r..m..Simple cache entry magic 0xFCFB6D1BA7725C30
offset unknownD8 41 0D 97 45 6F FA F4.A..Eo..Simple cache end-of-stream magic 0xF4FA6F45970D41D8 (EOF records within entry files)

Known extensions

None recorded

References

Cite this entry

Crush Format Reference, “Chromium Disk Cache”. https://kalink0.github.io/crush-forensics/formats/chrome-cache/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction