# RDB SSTable LevelDB RocksDB Memcached Binary KV-Store Encoding Lineage

Decode binary key-value store artifacts byte by byte: Redis RDB snapshots, LevelDB/RocksDB WAL records and SSTable footers, Memcached binary packets, BoltDB and LMDB page headers — with keyspace hex-diff and TTL expiry matrix.

> Canonical page: https://elysiatools.com/en/tools/rdb-sstable-leveldb-rocksdb-memcached-binary-key-value-store-encoding-lineage

- **Category:** Converter

- **Keywords:** redis rdb decoder, rocksdb sstable footer, leveldb log format, memcached binary protocol, kv store forensics, crc64 redis, listpack decoder, intset, boltdb page, lmdb page header

## Overview

A forensic decoder for the binary encodings of the KV-store family.

Supported artifacts and what gets expanded:

· Redis RDB — "REDIS" magic + ASCII version, AUX fields (opcode 0xFA), SELECTDB (0xFE), RESIZEDB (0xFB), expiry opcodes FD/FC, every value type from plain strings (int8/16/32 and LZF-compressed) through list, set, zset (ASCII and binary-double scores), hash, zipmap, ziplist, intset, quicklist v1 and v2, listpack hash/zset/set (types 16/17/18/20), and the CRC-64 Jones trailer (verified).
· LevelDB / RocksDB write-ahead log — 32 KiB blocks, 7-byte record headers (masked CRC32C, u16 length, FULL/FIRST/MIDDLE/LAST types), zero trailers.
· LevelDB / RocksDB SSTable — 48-byte legacy footer (varint64 metaindex + index BlockHandles padded to 40 bytes + little-endian magic 0xdb4775248b80fb57 / 0x88e241b785f4cff7), data-block prefix compression with restart points.
· Memcached binary protocol — 24-byte header (magic 0x80/0x81, opcode, key/extras/value split, vbucket or status, opaque, CAS), per-opcode extras such as flags + expiry.
· BoltDB — 16-byte page header and meta page magic 0xed0cdaed. LMDB — MDB_page header flags (the format famously has no magic number).

Paste a second RDB snapshot to get a keyspace diff (added / removed / value-changed / TTL-drifted keys) and a TTL expiry matrix evaluated against your chosen reference time.

The RDB path is verified against real redis-server 7.2.4 dumps; module and stream value types (6/7/15/19/21) are reported but not expanded.

## Inputs

- **Binary Snapshot A (hex bytes)** (textarea): e.g. 52 45 44 49 53 30 30 31 31 … (REDIS0011…), or 80 00 00 05 … for a memcached packet
- **Format** (select)
- **Binary Snapshot B (hex, optional diff base)** (textarea): Paste a second RDB snapshot here to get a keyspace diff + TTL drift matrix
- **Reference Time for TTL Matrix (Unix seconds)** (number): 1790000000

## When to use

- Analyzing corrupted or unreadable Redis RDB snapshot files and validating CRC-64 Jones checksums.
- Debugging wire-level Memcached binary protocol packets, request/response flags, and extras structures.
- Comparing two Redis RDB snapshots to track keyspace diffs, changed values, and drifting key TTLs.

## How it works

- Paste the raw hexadecimal byte string representing your database snapshot, log chunk, or network packet into Binary Snapshot A.
- Select the specific storage engine format or leave it on Auto-detect to identify headers via magic bytes.
- Optionally paste a secondary snapshot hex string into Binary Snapshot B and configure a reference Unix timestamp to evaluate TTL expirations.
- Review the generated forensic report, which breaks down container encodings, opcode timelines, header fields, and keyspace diffs.

## Use cases

- Inspecting internal listpack, ziplist, or intset representations across Redis version upgrades.
- Verifying Memcached binary protocol framing, CAS counters, status codes, and opaque values in network captures.
- Auditing on-disk page allocation flags and meta headers for embedded BoltDB and LMDB databases.

## Frequently asked questions

### Which Redis data types are decoded by this tool?

It unpacks strings (int8/16/32, LZF), lists, sets, sorted sets, hashes, zipmaps, ziplists, intsets, quicklist v1/v2, and listpack encodings. Module and stream types are flagged without deep expansion.

### How does format auto-detection work?

It matches byte signatures against known headers, such as 'REDIS' for RDB snapshots, 0x80/0x81 for Memcached binary frames, SSTable footer magic values, or BoltDB meta magic.

### What is the purpose of the Reference Time parameter?

It acts as the evaluation baseline to calculate whether millisecond and second TTLs in snapshots are active, expired, or drifted relative to that specific epoch timestamp.

### Can this tool parse SSTable index structures?

Yes, it parses 48-byte legacy footers, metaindex/index BlockHandles, restart points, and block-level prefix compression for LevelDB and RocksDB.

### Does it support differential analysis between two files?

Yes, pasting a second RDB dump into Snapshot B produces a keyspace comparison listing added, deleted, modified, and TTL-shifted keys.

## Related tools

- [JavaScript Deobfuscator](https://elysiatools.com/en/tools/javascript-deobfuscator): Deobfuscate and analyze obfuscated JavaScript code to improve readability and understanding
- [Parquet Bloom Filter ZoneMap Dictionary and Column Statistics Pruner Evaluator](https://elysiatools.com/en/tools/parquet-bloom-filter-zonemap-dictionary-and-column-statistics-pruner-evaluator): Decode a Parquet thrift footer and quantify predicate-pushdown pruning: zone-map min/max, split-block bloom filters (XXH64), dictionary ratios and encodings, with per-row-group prune-savings estimates for example WHERE clauses.
- [PCIe Link Training LTSSM & Lane Margining Eye Decoder](https://elysiatools.com/en/tools/pcie-link-training-linkstate-and-lane-margining-eye-decode): Decode a PCIe link training log (LTSSM state sequence plus TS1/TS2 ordered sets) into the full Gen1-Gen6 state timeline: negotiated speed and width, rate identifier bits, lane reversal, polarity inversion, equalization phases and Detect/Recovery restart diagnostics. Also grades a lane margining report (pcilmr CSV or key=value) against the PCIe Base Spec Rev 5.0 §8.4.2 eye minimums per generation and renders a per-lane eye-margin heatmap SVG.
- [SQL Query Formatter & Minifier](https://elysiatools.com/en/tools/sql-query-formatter): Beautify or minify SQL with full control over dialect (PostgreSQL, MySQL, SQLite, SQL Server/T-SQL, BigQuery, Snowflake, and more), keyword / identifier / function casing, indent style (standard, tabular-left, tabular-right), and spacing between statements. Produces a syntax-highlighted, copy-ready result with live size and statement stats.
- [Convert TIFF to PDF](https://elysiatools.com/en/tools/tiff-to-pdf): Convert TIFF images to PDF format with customizable page size, orientation, and compression settings
- [Modern Unique ID Generator](https://elysiatools.com/en/tools/uid-generator): Generate modern unique identifiers: ULID, NanoID, Snowflake and CUID2. Compare formats, decode ULID timestamps and pick the right ID for your system.
- [X.509 Certificate Decoder](https://elysiatools.com/en/tools/certificate-decoder): Parse an X.509 SSL/TLS certificate (paste PEM or upload .pem/.crt) and inspect subject, issuer, validity period with expiry status, public key, signature algorithm, serial, SANs, key usage and fingerprint. Like openssl x509 -text, visualised. Runs locally.
- [Convert AVIF to TIFF](https://elysiatools.com/en/tools/avif-to-tiff): Convert AVIF images to TIFF format with lossless quality, compression options, and professional workflows

## Samples

- [Hex/Unicode Encoding Format Samples](https://elysiatools.com/en/samples/text-hex-unicode-formats): Examples of hex (\xXX) and unicode (\uXXXX) escape sequence encoding formats
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion