Zstandard Compressed Data
| Format | Zstandard Compressed Data |
|---|---|
| Short name | zstd |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Zstandard frames as used for .zst files, Linux packages (e.g. Arch Linux .pkg.tar.zst), initramfs and kernel modules, and as HTTP content encoding stored in browser caches. A frame header may record the content size, a checksum flag and a dictionary ID; data compressed with a dictionary cannot be decompressed without that dictionary. Skippable frames (magic 0x184D2A50–0x184D2A5F) can carry arbitrary other data.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 28 B5 2F FD | (./. | Frame magic 0xFD2FB528 |
| offset unknown | 50 2A 4D 18 | P*M. | Skippable frame magic 0x184D2A50–0x184D2A5F (low nibble of first byte varies) |
Known extensions
.zst, .tzst
References
- Zstandard Compression and the 'application/zstd' Media Type (RFC 8878) https://www.rfc-editor.org/rfc/rfc8878.html
Cite this entry
Crush Format Reference, “Zstandard Compressed Data”. https://kalink0.github.io/crush-forensics/formats/zstd/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction