Btrfs
| Format | Btrfs |
|---|---|
| Short name | Btrfs |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
A copy-on-write Linux filesystem with subvolumes and snapshots (default on openSUSE and Fedora desktops, Synology NAS). Metadata trees are written to new locations on every transaction, so earlier tree generations and snapshot contents can hold previous versions of files. The superblock additionally keeps four backup roots referencing earlier tree generations, and superblock mirrors exist at 64 MiB and 256 GiB where the device is large enough.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 65600 (0x10040) | 5F 42 48 52 66 53 5F 4D | _BHRfS_M | Superblock magic '_BHRfS_M' (superblock at 64 KiB) |
| offset unknown | 5F 42 48 52 66 53 5F 4D | _BHRfS_M | Superblock mirror magic at 64 MiB + 0x40 and 256 GiB + 0x40 (if present) |
Known extensions
None recorded
References
- On-disk Format (Btrfs documentation) https://btrfs.readthedocs.io/en/latest/dev/On-disk-format.html
Cite this entry
Crush Format Reference, “Btrfs”. https://kalink0.github.io/crush-forensics/formats/btrfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction