LevelDB Database
| Format | LevelDB Database |
|---|---|
| Short name | LevelDB |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (LeveldbParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Key-value store used by Chrome/Chromium (IndexedDB, localStorage, sessionStorage), Electron-based desktop apps, and many Android and iOS apps for caches and app state. LevelDB is not a single file but a directory containing: CURRENT and MANIFEST-###### (metadata), .ldb/.sst files (sorted string tables with key-value data, Snappy-compressed blocks), and ######.log files (write-ahead log with recent mutations). All files must be parsed together for a complete view. Deleted or overwritten records survive in .log files with sequence numbers and a deleted/live state flag — deleted data is often recoverable. Values are frequently serialized in the V8/Blink format (Chromium IndexedDB) or as JSON. Chromium's IndexedDB, Local Storage and Session Storage are separate LevelDB stores holding web app state and cached API responses — common sources of social media and messaging artifacts.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 57 FB 80 8B 24 75 47 DB | W...$uG. | Table file (.ldb/.sst) footer magic 0xdb4775248b80fb57 (little-endian) in the last 8 bytes |
Known extensions
.ldb, .sst, .log
References
- LevelDB format specification (Google) https://github.com/google/leveldb/blob/main/doc/impl.md
- LevelDB table format (Google) https://github.com/google/leveldb/blob/main/doc/table_format.md
- Hang on! That's not SQLite! Chrome, Electron and LevelDB (CCL, Alex Caithness, 2020) https://www.cclsolutionsgroup.com/post/hang-on-thats-not-sqlite-chrome-electron-and-leveldb
- IndexedDB on Chromium (CCL, Alex Caithness, 2020) https://www.cclsolutionsgroup.com/post/indexeddb-on-chromium
- Chromium Session Storage and Local Storage (CCL, Alex Caithness, 2021) https://www.cclsolutionsgroup.com/post/chromium-session-storage-and-local-storage
- MIC: Memory analysis of IndexedDB data on Chromium-based applications (Jeong, Lee, Park — FSI: Digital Investigation 2024) https://www.sciencedirect.com/science/article/pii/S2666281724001331
- ForensicsWiki — LevelDB format https://forensics.wiki/leveldb_format/
- Reading the CURRENT — LevelDB Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/reading-current-leveldb-forensics-with.html
Cite this entry
Crush Format Reference, “LevelDB Database”. https://kalink0.github.io/crush-forensics/formats/leveldb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction