XZ Compressed Data
| Format | XZ Compressed Data |
|---|---|
| Short name | XZ |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
LZMA2-based compressed stream holding a single file, often a TAR archive (.tar.xz), Linux packages, kernel modules or firmware. Streams consist of blocks with integrity checks (CRC32, CRC64, SHA-256 or none) and an index, and end with the footer magic 'YZ'; multiple streams may be concatenated. No file name or timestamp is stored.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | FD 37 7A 58 5A 00 | .7zXZ. | Stream header magic FD 37 7A 58 5A 00 |
Known extensions
.xz, .txz
References
- The .xz File Format (Tukaani) https://tukaani.org/xz/xz-file-format.txt
Cite this entry
Crush Format Reference, “XZ Compressed Data”. https://kalink0.github.io/crush-forensics/formats/xz/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction