systemd Journal
| Format | systemd Journal |
|---|---|
| Short name | journal |
| Category | log |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The binary log of systemd-journald, stored persistently below /var/log/journal/<machine-id>/ or volatile below /run/log/journal/ (lost on reboot). Entries consist of key-value fields (MESSAGE, _PID, _UID, _COMM, _BOOT_ID, …) with realtime and monotonic timestamps; field data can be XZ-, LZ4- or ZSTD-compressed. If Forward Secure Sealing is enabled, tag objects containing an SHA-256 HMAC are appended at regular intervals, allowing later detection of tampering. The header state marks files as offline, online (open for writing, e.g. not closed cleanly) or archived; rotated files keep older entries, and files found corrupted or unclean are renamed with a '~' suffix.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4C 50 4B 53 48 48 52 48 | LPKSHHRH | Signature 'LPKSHHRH' |
Known extensions
.journal, .journal~
References
- Journal File Format (systemd) https://systemd.io/JOURNAL_FILE_FORMAT/
- Systemd journal file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Systemd%20journal%20file%20format.asciidoc
Cite this entry
Crush Format Reference, “systemd Journal”. https://kalink0.github.io/crush-forensics/formats/journal/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction