What was the SquashFS compression method?

Question

I've got some SquashFS files, and I'd like to know how they were compressed so that I can have a rough idea of how they would perform when mounted.

The only binaries provided by the squashfs-tools package are mksquashfs and unsquashfs, which are for creating/appending SquashFS files and extracting SquashFS files, respectively.

How can I determine what compression method was used to make a specific SquashFS file?

Answer 1

unsquashfs -s did not have the capability of displaying the compression type used until this commit on 07 August 2009. This means that if you are running squashfs-tools 4.0 or older, you wouldn't be able to see the compression method used.

From this information, I derived a way to read the SquashFS 4.0 superblock to determine the compression method used (where $SQUASHFS is the path to your SquashFS file):

dd if=$SQUASHFS bs=1 count=2 skip=20 2>/dev/zero | od -An -tdI | xargs

Alternatively, here's a function for those who would like to type in the filename at the end of the line:

sqsh_comp_method(){ dd if="$1" bs=1 count=2 skip=20 2>/dev/zero|od -An -tdI | xargs;};sqsh_comp_method

You will get a number (between 1 and 6 as of SquashFS 4.4). You can match that number to the following table to see what compression method was used:

╔═══╦════════════════════╦════════════════════╗
║ # ║ Compression Method ║ Compatible Version ║
╠═══╬════════════════════╬════════════════════╣
║ 1 ║ gzip               ║ 1.0 and newer      ║
║ 2 ║ lzma               ║ 4.1 and newer      ║
║ 3 ║ lzo                ║ 4.1 and newer      ║
║ 4 ║ xz                 ║ 4.2 and newer      ║
║ 5 ║ lz4                ║ 4.3 and newer      ║
║ 6 ║ zstd               ║ 4.4 and newer      ║
╚═══╩════════════════════╩════════════════════╝

^_(Source)

Note that the above dd command will only provide a reliable output if the file you specified had a SquashFS 4.0 superblock. The following command will output "Not SquashFS 4.0" if the file $SQUASHFS does not have the SquashFS 4.0 magic number:

if [[ "$(dd if="$SQUASHFS" bs=1 count=4 skip=28 2>/dev/zero | xxd -p)" != "04000000" ]] ; then echo -n "Not " ; fi ; echo "SquashFS 4.0"

Explanation

In SquashFS 4.0 filesystems, the compression method is stored on the 21^st and 22^nd bytes of the superblock as a data type short. dd bs=1 count=2 skip=20 will retrieve the short, od -An -tdI will turn the short into a human-readable number, and xargs is just to get rid of the leading spaces.

Before SquashFS 4.0, there was only the gzip method.

---

Old answer

unsquashfs has the -s flag for displaying SquashFS filesystem information.

Example usage:

deltik@node51 [/tmp]# unsquashfs -s template.squashfs
Found a valid SQUASHFS 4:0 superblock on template.squashfs.
Creation or last append time Thu Apr 30 23:07:23 2015
Filesystem size 47225242.44 Kbytes (46118.40 Mbytes)
Compression gzip
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always_use_fragments option is not specified
Xattrs are compressed
Duplicates are removed
Number of fragments 23629
Number of inodes 437076
Number of ids 1

If you just want the compression type identified, you could pipe the output through awk '/^Compression/{print $2}'. Example:

deltik@node51 [/tmp]# unsquashfs -s template.squashfs | awk '/^Compression/{print $2}'
gzip

Answer 2

Also looking for a better answer. I'm assuming you want to know because your OS doesn't seem to support the compression used in providing you with the squashedfs in question. Or perhaps like the unsquashfs on CentOS6, yours doesn't report the Compression type.

So I strings | head on the compressed file. The first line will be hsqs and the second line should indicate the compression method used. I believe I used this method to determine that 7zXZ indicating that 7zip was in fact the method. However, with gzip, no such luck. I have to use od -b on the file to get the octal dump and to try to match the file signature with those associated with the file program. Again, however, no such luck (the string I expected to find is 037 213 but I see only 037 221.