Java Class File
| Format | Java Class File |
|---|---|
| Short name | class |
| Category | execution |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Compiled Java bytecode, usually packaged in JAR, WAR or similar ZIP-based archives. The header holds the magic 0xCAFEBABE followed by minor and major version; the major version identifies the targeted Java release (45 = Java 1.0/1.1 … 65 = Java 21). The constant pool contains class, method and string names, which can reveal functionality, embedded URLs or credentials. The magic is shared with Mach-O universal binaries; they are distinguished by the value at offset 4 (a small architecture count in Mach-O, the class file version in Java).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | CA FE BA BE | .... | Magic 0xCAFEBABE at offset 0 (shared with Mach-O universal binaries; major version at offset 6 is 45 or higher) |
Known extensions
.class
References
- The class File Format (Java Virtual Machine Specification, Java SE 21) https://docs.oracle.com/javase/specs/jvms/se21/html/jvms-4.html
- CAFEBABE disambiguation (file/libmagic) https://github.com/file/file/blob/master/magic/Magdir/cafebabe
Cite this entry
Crush Format Reference, “Java Class File”. https://kalink0.github.io/crush-forensics/formats/class/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction