LZFSE Compressed Data
| Format | LZFSE Compressed Data |
|---|---|
| Short name | LZFSE |
| Category | archive |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple-proprietary lossless compression algorithm introduced with iOS 9 and macOS 10.11 (El Capitan). Used in OTA software updates, IPSW firmware payloads, Dyld Shared Cache (DSC), kernelcache, some system binaries, and app data. Files must be decompressed before content analysis. Identified by the 'bvx2' magic (0x62767832). Apple also uses a simpler variant called LZVN (used for inputs under 4096 bytes and unconditionally in Mach-O compressed segments). HFS+ and APFS transparent file compression also uses LZFSE/LZVN — the file's content is then stored compressed in a resource fork or extended attribute, not in the data stream. Also used in Apple Archive (.aar) format since macOS Big Sur.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 62 76 78 32 | bvx2 | LZFSE magic ('bvx2', compressed block with compressed tables) |
| offset 0 (0x0) | 62 76 78 31 | bvx1 | LZFSE magic ('bvx1', compressed block with uncompressed tables) |
| offset 0 (0x0) | 62 76 78 6E | bvxn | LZVN-compressed block ('bvxn') |
| offset 0 (0x0) | 62 76 78 2D | bvx- | Uncompressed block ('bvx-') |
Known extensions
None recorded
References
- LZFSE reference implementation (Apple/GitHub) https://github.com/lzfse/lzfse
- Apple developer docs — Compression framework https://developer.apple.com/documentation/compression/algorithm/lzfse
- LZFSE overview (Wikipedia) https://en.wikipedia.org/wiki/LZFSE
Cite this entry
Crush Format Reference, “LZFSE Compressed Data”. https://kalink0.github.io/crush-forensics/formats/lzfse/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction