JSON Document
| Format | JSON Document |
|---|---|
| Short name | JSON |
| Category | serialization |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (JsonParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Human-readable serialization format used pervasively in mobile and web apps. Forensically relevant as: app configuration and cached API responses, browser localStorage/sessionStorage exports, browser bookmarks and preferences (e.g. browser bookmark and saved-login files), data exports from online services, location data in GeoJSON format, and structured log files (JSONL/NDJSON). Many apps store sensitive data in plaintext JSON without encryption — credentials, tokens, and personal data are frequently found in app data directories. No magic bytes — identification relies on file extension or content inspection for the leading '{' or '[' character.
Signatures
None recorded
Known extensions
.json, .geojson, .jsonl, .ndjson
References
- JSON format spec (RFC 8259) https://datatracker.ietf.org/doc/html/rfc8259
- GeoJSON format spec (RFC 7946) https://datatracker.ietf.org/doc/html/rfc7946
- JSON Lines format https://jsonlines.org/
- Browser artifacts — JSON files in forensics (HackTricks) https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts.html
Cite this entry
Crush Format Reference, “JSON Document”. https://kalink0.github.io/crush-forensics/formats/json/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction