Protocol Buffers (protobuf)
| Format | Protocol Buffers (protobuf) |
|---|---|
| Short name | protobuf |
| Category | serialization |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (ProtobufParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Google's binary serialization format used by Android system services, Chrome/Edge/Brave (e.g. BLOBs in the Network Action Predictor database), Google apps (Gmail, Maps, Drive, Photos), Jetpack DataStore (Android SharedPreferences replacement), and gRPC network protocols. On Apple platforms, protobuf payloads appear as record bodies inside SEGB (.segb, .biome) files written by iOS and macOS system services (Screen Time, Health, Siri, Homekit, and others). No magic bytes — identification relies on file extension (.pb, .binarypb), database BLOB column context (common in Chrome SQLite databases), or heuristic detection of wire-format tag/length patterns. Not self-describing: without the .proto schema file, fields are visible only as field numbers and wire types (varint, length-delimited, fixed32, fixed64) — semantic meaning requires schema recovery. For open-source apps (Chrome, Chromium), schemas are often findable in the project source code. Nested messages, repeated fields, and oneof unions are common structures.
Signatures
None recorded
Known extensions
.pb, .binarypb
References
- Protocol Buffers encoding specification (Google) https://protobuf.dev/programming-guides/encoding/
- Protocol Buffers overview (Wikipedia) https://en.wikipedia.org/wiki/Protocol_Buffers
- In the protobuf: web browser artifacts using Google's data interchange format (IBM X-Force, Chris Tappin, 2025) https://www.ibm.com/think/x-force/web-browser-artifacts-using-googles-data-interchange-format
- Mobile Forensics – The File Format Handbook: Protocol Buffers (Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_9
- Reading Protobuf wire format without a map — forensic deep dive (beBinary) https://bebinary4n6.blogspot.com/2026/06/reading-wire-protobuf-without-map.html
Cite this entry
Crush Format Reference, “Protocol Buffers (protobuf)”. https://kalink0.github.io/crush-forensics/formats/protobuf/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction