Mozilla LZ4 (jsonlz4)
| Format | Mozilla LZ4 (jsonlz4) |
|---|---|
| Short name | jsonlz4 |
| Category | archive |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Firefox's LZ4-compressed JSON files: session store (sessionstore.jsonlz4, recovery.jsonlz4 — open tabs, history per tab, form data, cookies), bookmark backups, search engine configuration (search.json.mozlz4), add-on startup data (addonStartup.json.lz4) and other add-on data. A custom header 'mozLz40\0' and the decompressed size (4 bytes, little-endian) precede a raw LZ4 block without frame.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 6D 6F 7A 4C 7A 34 30 00 | mozLz40. | Header magic 'mozLz40' |
Known extensions
.jsonlz4, .mozlz4, .baklz4
References
- dejsonlz4 — reference decoder (avih) https://github.com/avih/dejsonlz4
Cite this entry
Crush Format Reference, “Mozilla LZ4 (jsonlz4)”. https://kalink0.github.io/crush-forensics/formats/jsonlz4/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction