XAR Archive
| Format | XAR Archive |
|---|---|
| Short name | XAR |
| Category | archive |
| Platforms | macOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The eXtensible ARchive format used by macOS flat installer packages (.pkg), XIP archives and some other Apple software distribution artifacts; older bundle-style .pkg packages are directories instead. An XAR archive consists of a big-endian binary header, a zlib-compressed XML table of contents (TOC) and a heap containing the archived file data. The TOC can contain paths, file types, ownership, permissions, timestamps, sizes and per-file archived and extracted checksums, providing useful metadata for forensic analysis and integrity comparisons. Signed XAR archives reference the signature data stored in the heap from the TOC, which also embeds the associated X.509 certificate chain. For installer packages, the TOC can therefore provide both metadata about package contents and information useful for validating the integrity and provenance of the package.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 78 61 72 21 | xar! | XAR signature 'xar!' |
Known extensions
.pkg, .xar, .xip
References
- xar format (mackyle/xar wiki) https://github.com/mackyle/xar/wiki/xarformat
- xar source (Apple Open Source) https://github.com/apple-oss-distributions/xar
Cite this entry
Crush Format Reference, “XAR Archive”. https://kalink0.github.io/crush-forensics/formats/xar/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction