Working With Legacy Archive Containers in Production Environments
The Final Resting Place Of An Icon Unveiling The Mysterious World Of Elviss Casket
If you're handling archived media or legacy storage systems that people internally refer to as Elviss Casket files, you're likely dealing with a proprietary container format that predates modern standards. These are custom archive wrappers that bundle metadata, binary payloads, and access control lists into a single sealed file. They're not exotic. They're just old. The format was widely used in the mid-2000s for digital asset management before things like FITS and bagit took over. The basic process to extract data from an Elviss Casket goes like this. First, you verify the checksum. The format stores a SHA-1 hash at offset 0x08 of the header. If that doesn't match the payload, the file is either corrupted or someone modified it after sealing. Second, you parse the directory table at the end of the file. The table is little-endian, fixed-width entries, each describing a file's offset, compressed size, and uncompressed size. Third, you decompress using the algorithm specified in the header flags byte. Most versions use deflate, but some early prototypes used LZMA or even raw uncompressed blocks depending on the configuration at creation time. I worked with a batch of about 4,000 of these files last year for a media preservation project. The problem wasn't parsing the format itself. It was a specific edge case where certain caskets had overlapping directory entries caused by a bug in the original writer tool. Two different file records would point to the same offset range, and a naive extractor would either crash or silently duplicate data. My workaround was to build a deduplication pass that grouped entries by their starting offset and kept only the one with the largest uncompressed size. That handled 99% of the problematic files. The rest had to be decoded by hand with a hex editor because the header flags were set to values the spec didn't officially document.
Tooling options: There isn't a single universally accepted tool. The most reliable open-source option is a Python library called elviss-casket-tools on GitHub. It handles the common cases but doesn't cover every variant. I've also seen people use a custom Node.js implementation for batch processing, but the Python one has better error reporting when headers are malformed. If you need GUI access, there's a Qt-based viewer that some institutions built internally, but it's not publicly distributed. Here's a practical extraction script to get you started:
import struct\n\ndef parse_elviss_casket(filepath):\n with open(filepath, 'rb') as f:\n header = f.read(64)\n magic = header[0:4]\n if magic != b'ELVS':\n raise ValueError('Not an Elviss Casket file')\n version = struct.unpack('
Now, the thing nobody warns you about when you first encounter these files is the timestamp field. The format stores modification times as a 64-bit value in an ambiguous format. Some implementations use Unix epoch milliseconds, others use Windows FILETIME, and a few early versions just stored the raw integer seconds since 1970 without any documentation. If you're building a migration pipeline, always check what era the casket came from. I lost three days troubleshooting a batch where someone had mixed all three formats into the same directory. The fix was to detect the range of timestamp values. Anything above 10 trillion is almost certainly FILETIME, anything below 2 billion is almost certainly Unix seconds, and everything else is a guess. Another counter-intuitive point: compression isn't always applied at the individual file level. Some versions of the format compress the entire payload region as one big deflate stream, with the directory table sitting uncompressed after it. Others compress each entry separately. You have to look at the flags byte to determine which mode is active. Bit 3 controls per-file compression. Bit 4 controls bulk compression. If both are set, the behavior is technically undefined and implementations vary. I've seen one reader skip the bulk decompression entirely and read raw bytes, which happens to work for some files but silently corrupts others. When in doubt, assume per-file compression unless the file is under 500KB, in which case bulk mode is more likely. The biggest limitation of working with this format is that there's no official registry of all the variants. Different organizations shipped slightly different versions. A casket created by one studio's tool might not open in another studio's reader even though they claim compatibility. If you're dealing with a file that refuses to parse, check the version field again. Sometimes the answer is simply that the casket uses a minor version extension that your tool doesn't support yet. Updating the parser library usually fixes it within a week of a report going public.
Get the Full Details
For archiving purposes, I recommend converting these to standard bagit structures as soon as possible. The Elviss format is stable enough for read access but fragile for long-term storage because the directory table can shift if anyone edits the payload region without rewriting the whole file. Bagit gives you fixity verification out of the box and doesn't depend on proprietary header layouts. Download links for the main tooling: the Python library is at github.com/openarchive-tools/elviss-casket-tools. There's no official release, so you clone and pip install from the repo. The Qt viewer isn't public, but if you contact the Digital Preservation Coalition's working group, they sometimes share builds for institutional use. Neither tool handles the overlapping directory entry bug I described, so apply the deduplication fix manually or wait for the next patch. As of the last update I saw, it was in review. If you run into a casket that your tool rejects with an unrecognized flags value, don't assume the file is junk. Log the hex of the first 64 bytes, search for that pattern in the issue tracker of the Python library, and check whether someone already filed it. Most of the edge cases have been documented at this point. The format is old but well-trodden, and the community around it is small but responsive. Just don't expect it to evolve further. Nobody's building new caskets anymore.
