Difference between revisions of "Firefox Disk Cache Format"

From ForensicsWiki
Jump to: navigation, search
Line 38: Line 38:
== Cache version 2 ==
== Cache version 2 ==
== See Also ==
== See Also ==

Latest revision as of 11:34, 25 December 2015

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

There are multiple versions of the Firefox Disk Cache format:

  • Cache version 1
  • Cache version 2 - default as of firefox 32 [1]

Cache version 1

The Cache directory contains the multiple type of cache files:

  • Cache Map File
  • Cache Block File
  • Cache Data File

Cache Map file

File named _CACHE_MAP_


  • Cache Map file header
  • An array of Cache Map buckets

There are 32 buckets in the Cache map file. Within each bucket, there are 256 records inside each bucket, hence the Cache Map file contains 8192 records in total.

Each record contains the information for one instance of cache data. A record contains four 32-bit integers:

  • A Hash Number
  • An Eviction Rank
  • The Data Location
  • The Metadata Location

Cache Block file

File named _CACHE_00#_, where # is a number ranging from [1-3].

Cache Data File

File named:

<hash number><type><generation number>

Where <hash number>, <type>, <generation number> are placeholders for the corresponding values.

Cache version 2


See Also

External Links