Hive Database (Dart / Flutter)
| Format | Hive Database (Dart / Flutter) |
|---|---|
| Short name | Hive |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-06 |
Forensic relevance
Append-only key-value store of the Dart/Flutter Hive library (Hive 2.x and its Hive CE continuation). Each box is one <name>.hive file, the box name in lower case, next to a <name>.lock file; a <name>.hivec file is the intermediate result of a compaction. Has no magic bytes: the file is a plain sequence of frames, each made of a little-endian uint32 frame length, the key (type 0: uint32, type 1: UTF-8 string of up to 255 bytes), the value (a type ID byte followed by the data, absent for a deletion) and a CRC32 over the frame. Every write or delete appends a new frame, so earlier values and deleted keys remain in the file until a compaction rewrites only the live frames (automatically once more than 60 obsolete frames make up over 15 % of the entries, or when the app requests it). With encryption only the value is encrypted (AES-256-CBC, random 16-byte IV in front, PKCS7 padding); keys stay in plain text and the CRC is seeded with a checksum of the key. Integers are stored as 64-bit floats. Custom objects carry an app-defined type ID (stored as ID + 32) and store their fields by numeric index, not by name. Hive CE adds value types such as sets, DateTime, BigInt and Duration plus 16-bit type IDs, but keeps the frame layout. Opening a box whose last frame is damaged truncates the file at the last valid frame by default. The Hive 4 development versions store boxes as Isar databases instead (see Isar Database). Depending on the app, boxes hold settings, cached content, session state such as account IDs or tokens, histories or the app's main records. Found in the app data directories of Flutter apps on Android, iOS and desktop systems.
Signatures
None recorded
Known extensions
.hive, .hivec
References
- Hive 2.2.3 frame writer (source) https://github.com/isar/hive/blob/v2.2.3/hive/lib/src/binary/binary_writer_impl.dart
- Hive 2.2.3 storage backend: lock file, recovery, compaction (source) https://github.com/isar/hive/blob/v2.2.3/hive/lib/src/backend/vm/storage_backend_vm.dart
- Hive CE (Hive Community Edition) https://github.com/IO-Design-Team/hive_ce
Cite this entry
Crush Format Reference, “Hive Database (Dart / Flutter)”. https://kalink0.github.io/crush-forensics/formats/hive/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction