RocksDB Database
| Format | RocksDB Database |
|---|---|
| Short name | RocksDB |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-10 |
Forensic relevance
Key-value store developed by Facebook as a fork of LevelDB, used as the storage engine of databases and server software and embedded in some applications. Like LevelDB it is a directory, not a single file, and uses the same file names: CURRENT, MANIFEST-###### (the database's version history: which table files exist and on which level, per column family), ######.sst (sorted string tables) and ######.log (write-ahead log of recent writes). It also writes OPTIONS-###### (its settings as text, including the RocksDB version that wrote them), IDENTITY and LOG. The file formats differ from LevelDB's: block-based tables end in their own footer magic and record their checksum type (CRC32C or xxHash), blocks can be compressed with Snappy, zlib, bzip2, LZ4, ZSTD or Xpress, the MANIFEST records column families and further per-file fields, and the write-ahead log can hold column family IDs, merge operands and range deletions. Older versions wrote block-based tables with LevelDB's footer magic. Column families divide one database into separate sets of keys. Deleted and overwritten values remain in table and log files until compaction rewrites them; a merge operand's final value depends on the application's merge operator.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | F7 CF F4 85 B7 41 E2 88 | .....A.. | Block-based table (.sst) footer magic 0x88e241b785f4cff7 (little-endian) in the last 8 bytes |
| offset unknown | 64 95 BF 63 96 22 42 82 | d..c."B. | Plain table (.sst) footer magic 0x8242229663bf9564 (little-endian) in the last 8 bytes |
| offset unknown | B8 13 8F 7A EB 18 34 4F | ...z..4O | Plain table (.sst) with footer format 0: magic 0x4f3418eb7a8f13b8 (little-endian) in the last 8 bytes |
| offset unknown | 73 78 F1 C5 D0 89 67 92 | sx....g. | Cuckoo table (.sst) footer magic 0x926789d0c5f17873 (little-endian) in the last 8 bytes |
Known extensions
.sst, .log
References
- RocksDB (official site) https://rocksdb.org/
- RocksDB overview (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/RocksDB-Overview
- RocksDB BlockBasedTable format (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/Rocksdb-BlockBasedTable-Format
- MANIFEST (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/MANIFEST
- Write Ahead Log file format (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/Write-Ahead-Log-File-Format
- RocksDB Options file (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/RocksDB-Options-File
- Column families (RocksDB wiki) https://github.com/facebook/rocksdb/wiki/Column-Families
Cite this entry
Crush Format Reference, “RocksDB Database”. https://kalink0.github.io/crush-forensics/formats/rocksdb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction