Help decoding the Chromium Browser cache index file

[Richard Drinkwater]

Hi,

Apologies if this is not an appropriate group for this question.  I teach computer forensics classes and I want to be able to explain the structure of the cache index and block files.  I have read the various source codes in this area but probably because I am not a programmer I am struggling.

From what I've read at disk_cache/disk_format.h I can see that the index file has a header storing various parameters and then a hash table storing the CacheAddr of the cached items.  I have read http://src.chromium.org/svn/trunk/src/net/disk_cache/addr.h n regard to the CacheAddr structure.  I have an external file f_00002a stored in the cache.  I would expect to find the hex 0x8000002A CacheAddr stored in the Index file.  However when I search the Index file for 0x8000002A I don't find this value.  So my question is why can't I locate the CacheAddr for this external file in the Index file?

Any help welcomed.

Richard Drinkwater

[Fred Akalin]

(Disclaimer: I'm not familiar with the cache files.)

Could it be an endianness issue? I.e., does the byte pattern 2a 00 00 80 show up?

--
--
Chromium Developers mailing list: chromi...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-dev

[William Chan (陈智昌)]

Here's the structure of the cache index and block files explained: http://www.chromium.org/developers/design-documents/network-stack/disk-cache. Note that we're in progress of switching the block file cache version. I don't know the exact status of that, but Ricardo should know. Maybe he'll chime in.

On Sat, Oct 5, 2013 at 1:14 AM, Richard Drinkwater <dc1...@gmail.com> wrote:

--

[Ricardo Vargas]

It should be clear by now, but the index stores the address of an entry, as opposed to the address of a response body.

You may also be interested in compiling dump_cache (src/net/tools from a chromium checkout). That tool will decode interesting parts of the headers and may help you understand how all the parts fit together.

Information for the new format is linked from the same page William mentioned... and the docs will be updated as appropriate as we go.