A forensic decoder for the binary encodings of the KV-store family.
Supported artifacts and what gets expanded:
· Redis RDB — "REDIS" magic + ASCII version, AUX fields (opcode 0xFA), SELECTDB (0xFE), RESIZEDB (0xFB), expiry opcodes FD/FC, every value type from plain strings (int8/16/32 and LZF-compressed) through list, set, zset (ASCII and binary-double scores), hash, zipmap, ziplist, intset, quicklist v1 and v2, listpack hash/zset/set (types 16/17/18/20), and the CRC-64 Jones trailer (verified).
· LevelDB / RocksDB write-ahead log — 32 KiB blocks, 7-byte record headers (masked CRC32C, u16 length, FULL/FIRST/MIDDLE/LAST types), zero trailers.
· LevelDB / RocksDB SSTable — 48-byte legacy footer (varint64 metaindex + index BlockHandles padded to 40 bytes + little-endian magic 0xdb4775248b80fb57 / 0x88e241b785f4cff7), data-block prefix compression with restart points.
· Memcached binary protocol — 24-byte header (magic 0x80/0x81, opcode, key/extras/value split, vbucket or status, opaque, CAS), per-opcode extras such as flags + expiry.
· BoltDB — 16-byte page header and meta page magic 0xed0cdaed. LMDB — MDB_page header flags (the format famously has no magic number).
Paste a second RDB snapshot to get a keyspace diff (added / removed / value-changed / TTL-drifted keys) and a TTL expiry matrix evaluated against your chosen reference time.
The RDB path is verified against real redis-server 7.2.4 dumps; module and stream value types (6/7/15/19/21) are reported but not expanded.