XML Document
| Format | XML Document |
|---|---|
| Short name | XML |
| Category | serialization |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (XmlParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Human-readable markup format used pervasively for configuration, data exchange, and structured documents. Key forensic XML files on Android: AndroidManifest.xml (stored as binary XML inside the APK) — declares package name, version, permissions, exported components, intent filters, and allowBackup flag; critical for app capability assessment and malware analysis. packages.xml (/data/system/) — lists all installed packages with granted permissions, installer source (com.android.vending = Play Store vs sideloaded), and UID assignments. runtime-permissions.xml and roles.xml (Android 10+) — dangerous permissions granted at runtime and default app assignments. Since Android 12 the system writes packages.xml and most other XML files under /data/system in the binary ABX format (see ABX entry). SharedPreferences files (/data/data/<package>/shared_prefs/*.xml) — app configuration and user state, sometimes containing credentials or tokens. On Windows: Scheduled Tasks (C:\Windows\System32\Tasks\), stored as UTF-16 XML. On iOS/macOS: XML plists (see Property List entry). In Office documents: OOXML internals (.docx/.xlsx/.pptx are ZIP+XML).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 3C 3F 78 6D 6C | <?xml | XML declaration ('<?xml'); optional, so many XML files have no magic |
| offset 0 (0x0) | EF BB BF 3C 3F 78 6D 6C | ...<?xml | XML declaration with UTF-8 byte order mark |
| offset 0 (0x0) | FF FE 3C 00 3F 00 78 00 6D 00 6C 00 | ..<.?.x.m.l. | XML declaration in UTF-16LE with byte order mark |
Known extensions
.xml
References
- XML specification (W3C) https://www.w3.org/TR/xml/
- AndroidManifest.xml forensics — permissions and components https://greaterinternetfreedom.org/course/mobile-forensic-analysis-a-case-study-walkthrough-part-03-application-analysis-a-static-approach/
- Android - Roles and Permissions (Android 10/11) (D20 Forensics) https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
Cite this entry
Crush Format Reference, “XML Document”. https://kalink0.github.io/crush-forensics/formats/xml/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction