Footer layout

This area contains the appropriate structure of the footers.

Magic bytes

Each footer (even if each is embedded in another) starts with a sequence of magic bytes. The following table shows you which footer starts with which magic bytes:

Magic bytes	footer type
0x7A66664D	Main footer
0x7A666646	Segment footer
0x7a666650	Physical object footer
0x7A66664C	Logical object footer
0x7A666649	File footer

Main footer

The main footer contains several informations about the zff container and is the "starting point" of your container.

Version 2

Name	Type	Length in bytes	optional	description
Magic bytes	0x7A66664D	4		Start value to identify the footer.
Footer length	uint64	8		The length of the footer in bytes, beginning with the number of magic bytes.
Footer version	uint8	1		The footer version.
Number of segments	uint64	8		The number of segments in this zff container.
ObjectHeader (BTreeMap)	<uint64,uint64>	<Number of headers> * 2 * 8		Sorted Hashmap of the object-number and the segment number where the appropriate object header could be found.
ObjectFooter (BTreeMap)	<uint64,uint64>	<Number of headers> * 2 * 8		Sorted Hashmap of the object-number and the segment number where the appropriate object footer could be found.
Chunk offset maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 2 * 8		Sorted Hashmap of the chunk offset map offsets. Contains the highest Chunk number of the chunk offset map and the appropriate segment number.
Chunk size maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 2 * 8		Sorted Hashmap of the chunk size map offsets. Contains the highest Chunk number of the chunk size map and the appropriate segment number.
Chunk flags maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 2 * 8		Sorted Hashmap of the chunk flags map offsets. Contains the highest Chunk number of the chunk flags map and the appropriate segment number.
Chunk xxhash maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 8 * 2		Sorted Hashmap of the chunk xxhash map offsets. Contains the highest Chunk number of the chunk xxhash map and the appropriate segment number.
Chunk samebytes maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 8 * 2		Sorted Hashmap of the samebytes map offsets. Contains the highest Chunk number of the samebytes map and the appropriate segment number.
Chunk deduplication maps (BTreeMap)	<uint64,uint64>	<Number of Maps> * 8 * 2		Sorted Hashmap of the duplicated chunks map offsets. Contains the highest Chunk number of the duplicated chunks map and the appropriate segment number. Note that this map may be empty (deduplication is just an optional feature at cost of dump time).
Description notes	String	variable	☑️	Some notes which can optionally added to the main footer / Zff image. This field uses the identifier "dn". See how to handle fields with an identifier for more details.
Footer start offset	uint64	8		Offset of this segment, where the footer starts.

Segment footer

The segment footer contains all offsets for the appropriate chunks, object header and object footer.

Version 3

Name	Type	Length in bytes	description
Magic bytes	0x7A666646	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
length of segment	uint64	8	The length of the segment in bytes (including the length of the segment header, main header and main footer).
ObjectHeader offsets (BTreeMap)	<uint64,uint64>	<Number of headers> * 2 * 8	Sorted Hashmap of the object-number and the offset where the appropriate object header could be found.
ObjectFooter offsets (BTreeMap)	<uint64,uint64>	<Number of footers> * 2 * 8	Sorted Hashmap of the object-number and the offset number where the appropriate object footer could be found.
chunk offset map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the chunk offset maps offsets. Contains the highest Chunk number of the chunk offset map and the appropriate offset of the table.
chunk size map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the chunk size maps offsets. Contains the highest Chunk number of the chunk size map and the appropriate offset of the table.
chunk flags map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the chunk flags maps offsets. Contains the highest Chunk number of the chunk flags map and the appropriate offset of the table.
chunk xxhash map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the chunk xxhash maps offsets. Contains the highest Chunk number of the chunk xxhash map and the appropriate offset of the table.
chunk samebytes map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the samebytes maps offsets. Contains the highest Chunk number of the samebytes map and the appropriate offset of the table.
chunk dedup map (BTreeMap)	<uint64, uint64>	<Number of offsets> * 8	Sorted (by chunk numbers) Hashmap of the duplicated chunks maps offsets. Contains the highest Chunk number of the deduplication chunk map and the appropriate offset of the table.
First chunk number in segment	uint64	8	Represents the first chunk number which this segment contains.
footer offset	uint64	8	The offset where the segment footer starts.

Physical object footer

The object footer contains all offsets for the appropriate chunks.

Version 2

Name	Type	Length in bytes	description
Magic bytes	0x7a666650	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
object number	uint64	8	The appropriate object number
encryption flag	uint8	1	The encryption flag. 0 if the data is not encrypted, 1 if the data is encrypted.
Acquisition start timestamp	uint64	8	Contains the UNIX timestamp of the start of the acquisition.
Acquisition end timestamp	uint64	8	Contains the UNIX timestamp of the end of the acquisition.
length of data	uint64	8	The length of the image (uncompressed, unencrypted) in bytes.
First chunk number	uint64	8	The first chunk number, used for this object.
Number of chunks	uint64	8	Number of chunks for this object.
hash header v2	object	var	The appropriate HashHeader version 2 for this image.

encrypted variant

Name	Type	Length in bytes	description
Magic bytes	0x7a666650	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
object number	uint64	8	The appropriate object number
encryption flag	uint8	1	The encryption flag. 0 if the data is not encrypted, 1 if the data is encrypted.
encrypted data blob	bytes	variable	encrypted data blob, can be decrypted by the appropriate key (of the object header).

Logical object footer

The object footer contains all offsets (or startpoints) for the appropriate chunks.

Version 2

Name	Type	Length in bytes	description
Magic bytes	0x7A66664C	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
object number	uint64	8	The appropriate object number
encryption flag	uint8	1	The encryption flag. 0 if the data is not encrypted, 1 if the data is encrypted.
Acquisition start timestamp	uint64	8	Contains the UNIX timestamp of the start of the acquisition.
Acquisition end timestamp	uint64	8	Contains the UNIX timestamp of the end of the acquisition.
Root directory filenumbers	uint64 Array	number of files * 8	Contains an array/vector of filenumbers, which lies in the root directory of this logical container
BTreeMap: <Filenumber, FileHeader segment number>	<uint64, uint64>	<Number of footers> * 2*8	Contains the segment number, where you will find the appropriate FileHeader. The map has to be stored sorted by keys (filenumbers).
BTreeMap: <Filenumber, FileHeader offsets>	<uint64, uint64>	<Number of offsets> * 2*8	Contains all offsets (of the appropriate segments) of the start values of the file headers . The map has to be stored sorted by keys (filenumbers).
BTreeMap: <Filenumber, FileFooter segment number>	<uint64, uint64>	<Number of footers> * 2*8	Contains the segment number, where you will find the appropriate FileFooter. The map has to be stored sorted by keys (filenumbers).
BTreeMap: <Filenumber, FileFooter offsets>	<uint64, uint64>	<Number of offsets> * 2*8	Contains all offsets (of the appropriate segments) of the start values of the file footers. The map has to be stored sorted by keys (filenumbers).

virtual object footer

Version 1

Name	Type	Length in bytes	description
Magic bytes	0x7a666656	4	Start value to identify the footer.
Footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
Footer version	uint8	1	The footer version.
Object number	uint64	8	The appropriate object number
encryption flag	uint8	1	The encryption flag. 0 if the data is not encrypted, 1 if the data is encrypted.
Creation timestamp	uint64	8	Contains the UNIX timestamp of the start of the creation of this object.
Passive objects	uint64 Array	number of files * 8	Contains all objects which are affected by this virtual object.
Length of data	uint64	8	The length of the original data, in bytes.
Virtual Object Map Offset	uint64	8	Offset where the virtual object map can be found.
Virtual Object Map Segment number	uint64	8	Segment number where the virtual object map can be found.

encrypted variant

Name	Type	Length in bytes	description
Magic bytes	0x7A66664C	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
object number	uint64	8	The appropriate object number
encryption flag	uint8	1	The encryption flag. 0 if the data is not encrypted, 1 if the data is encrypted.
encrypted data blob	bytes	variable	encrypted data blob, can be decrypted by the appropriate key (of the object header).

File footer

Version 2

Name	Type	Length in bytes	description
Magic bytes	0x7A666649	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
file number	uint64	8	THe appropriate file number.
Acquisition start timestamp	uint64	8	Contains the UNIX timestamp of the start of the acquisition.
Acquisition end timestamp	uint64	8	Contains the UNIX timestamp of the end of the acquisition.
Hash header v2	object	variable	This header contains the used hash values and algorithm types (hash header version 2 used here).
First chunk number	uint64	8	The first chunk number, used for this object.
Number of chunks	uint64	8	Number of chunks for this file object.
Length of data	uint64	8	The length of the file (uncompressed, unencrypted) in bytes. If the File has type "directory" or "symlink", the size is 0.

encrypted variant

Name	Type	Length in bytes	description
Magic bytes	0x7A666649	4	Start value to identify the footer.
footer length	uint64	8	The length of the footer in bytes, beginning with the number of magic bytes.
footer version	uint8	1	The footer version.
file number	uint64	8	The appropriate file number.
encrypted data blob	bytes	variable	encrypted data blob, can be decrypted by the appropriate key (of the object header).