iCalendar
| Format | iCalendar |
|---|---|
| Short name | iCal |
| Category | document |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Text format for calendar data used for calendar exports, invitations sent as e-mail attachments and synchronisation. A VCALENDAR object contains events, to-dos, journal entries and alarms with start/end times, location, description, organizer and attendees, time zone definitions (TZID) and change tracking timestamps (DTSTAMP, CREATED, LAST-MODIFIED). Times may be given in UTC, with a time zone reference or as floating local time, which must be considered when building timelines.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52 | BEGIN:VCALENDAR | Start line 'BEGIN:VCALENDAR' (may be preceded by a byte order mark) |
Known extensions
.ics, .ical, .ifb
References
- Internet Calendaring and Scheduling Core Object Specification (RFC 5545) https://www.rfc-editor.org/rfc/rfc5545.html
Cite this entry
Crush Format Reference, “iCalendar”. https://kalink0.github.io/crush-forensics/formats/ical/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction