QNX Embedded Flash Filesystem (EFS / F3S)
| Format | QNX Embedded Flash Filesystem (EFS / F3S) |
|---|---|
| Short name | EFS |
| Category | filesystem |
| Platforms | QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The QNX flash filesystem for NOR flash (FFS3, fs-flash3). The flash is divided into units holding extents; changes are copy-on-write, with a pointer from an old extent to the one that supersedes it, so older versions can remain readable until the unit is reclaimed. The partition is found by its boot record containing the text 'QSSL_F3S'.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 51 53 53 4C 5F 46 33 53 | QSSL_F3S | Boot record signature 'QSSL_F3S' (offset depends on the unit layout) |
Known extensions
None recorded
References
- FFS3 filesystem — QNX SDP 8.0 System Architecture https://qnx.com/developers/docs/8.0/com.qnx.doc.neutrino.sys_arch/topic/fsys_FFS3.html
- qnxmount — QNX6, ETFS and EFS parsers (Netherlands Forensic Institute) https://github.com/NetherlandsForensicInstitute/qnxmount
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “QNX Embedded Flash Filesystem (EFS / F3S)”. https://kalink0.github.io/crush-forensics/formats/efs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction