LZ4 Frame
| Format | LZ4 Frame |
|---|---|
| Short name | LZ4 |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The LZ4 frame format for .lz4 files and LZ4-compressed data in apps, kernels and databases. The frame descriptor records block size, checksums and optionally the content size. The older legacy frame format (fixed 8 MB blocks, no checksum) is still used by the Linux kernel for LZ4-compressed kernel images and initramfs. (Mozilla's jsonlz4 and Apple's LZ4 variants use other headers.)
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 04 22 4D 18 | ."M. | Frame magic 0x184D2204 |
| offset 0 (0x0) | 02 21 4C 18 | .!L. | Legacy frame magic 0x184C2102 |
Known extensions
.lz4
References
- LZ4 Frame Format Description (lz4 project) https://github.com/lz4/lz4/blob/dev/doc/lz4_Frame_format.md
Cite this entry
Crush Format Reference, “LZ4 Frame”. https://kalink0.github.io/crush-forensics/formats/lz4/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction