Khronos KTX 1.1 Texture
| Format | Khronos KTX 1.1 Texture |
|---|---|
| Short name | KTX |
| Category | media |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (ImageParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Khronos texture container. On iOS the payload is normally ASTC 4x4, optionally LZFSE-compressed, flagged by a Compression_APPLE entry in the key/value block. Observed holding application snapshots (Library/Caches/Snapshots and SplashBoard/Snapshots), Safari tab thumbnails (Library/Safari/Thumbnails) and, less often, Photos attachment previews. Snapshots appear in this container and in Apple's AAPL/ATX one depending on the release; the Safari thumbnails in every tested image were this container and not ATX. A snapshot is the image the system captured of an app's screen when it was last backgrounded, so decoding one can show on-screen content at that moment. The same extension is also used by textures shipped inside system frameworks and apps, which carry other pixel formats and are not user content.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | AB 4B 54 58 20 31 31 BB 0D 0A 1A 0A | .KTX 11..... | Khronos KTX 1.1 file identifier |
Known extensions
.ktx
References
- KTX File Format Specification v1.1 (Khronos) https://registry.khronos.org/KTX/specs/1.0/ktxspec.v1.html
- KHR_texture_compression_astc_hdr (glInternalFormat enum values) https://registry.khronos.org/OpenGL/extensions/KHR/KHR_texture_compression_astc_hdr.txt
- ios_ktx2png reference implementation (Yogesh Khatri, MIT) https://github.com/ydkhatri/MacForensics/tree/master/IOS_KTX_TO_PNG
Cite this entry
Crush Format Reference, “Khronos KTX 1.1 Texture”. https://kalink0.github.io/crush-forensics/formats/ktx/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction