MessagePack
| Format | MessagePack |
|---|---|
| Short name | MsgPack |
| Category | serialization |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Compact binary serialization format used as a JSON alternative in mobile apps, game clients, Redis, and network protocols. Self-describing at the type level (integers, strings, arrays, maps, binary, extensions) but field names are only present if the application includes them — without the originating schema, interpretation requires reverse engineering. No magic bytes — identification relies on file extension, database context, or heuristic parsing (first byte encodes type and length). The Timestamp extension type (-1) can encode nanosecond-precision timestamps — forensically relevant if used by the application. Forensically found in: app caches, network capture payloads, and some iOS/Android app data directories.
Signatures
None recorded
Known extensions
.msgpack, .mp
References
- MessagePack format specification https://github.com/msgpack/msgpack/blob/master/spec.md
- MessagePack overview (msgpack.org) https://msgpack.org/
- MessagePack overview (Wikipedia) https://en.wikipedia.org/wiki/MessagePack
Cite this entry
Crush Format Reference, “MessagePack”. https://kalink0.github.io/crush-forensics/formats/msgpack/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction