TAR Archive
| Format | TAR Archive |
|---|---|
| Short name | TAR |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (TarVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Unix standard archive format packaging files and directory trees with full metadata preservation. TAR itself provides no compression — commonly combined with gzip (.tar.gz/.tgz), bzip2 (.tar.bz2), or xz (.tar.xz). Structure: each file entry has a 512-byte header containing filename, permissions, UID/GID (as octal ASCII), file size, and mtime (Unix epoch seconds as octal ASCII). Four major variants: V7 (no magic), USTAR/POSIX ('ustar\0' at offset 257 — adds uname/gname and longer paths), GNU tar ('ustar \0' with two spaces), and PAX/POSIX.1-2001 (USTAR + extended header records for sub-second timestamps, unlimited path lengths, and UTF-8 encoding). Forensically relevant as: Samsung firmware packages (.tar.md5), iOS/macOS app packages (.ipa are ZIP, but some backup formats use TAR), Linux backup archives, Docker image layers, and forensic tool outputs. TAR has no deletion mechanism — updated files are appended as new entries; superseded versions of the same file remain in the archive. mtime in headers may reveal original file timestamps from the source system.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 257 (0x101) | 75 73 74 61 72 | ustar | USTAR/GNU magic ('ustar') at offset 257 in first header block |
Known extensions
.tar, .tgz, .tar.gz, .tar.bz2, .tar.xz
References
- TAR format specification (GNU tar manual) https://www.gnu.org/software/tar/manual/html_node/Standard.html
- TAR archive format overview (Wikipedia) https://en.wikipedia.org/wiki/Tar_(computing)
- The tar archive format, its extensions, and why GNU tar extracts in quadratic time (mort.coffee, 2022) https://mort.coffee/home/tar/
Cite this entry
Crush Format Reference, “TAR Archive”. https://kalink0.github.io/crush-forensics/formats/tar/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction