QNX Embedded Transaction Filesystem (ETFS)
| Format | QNX Embedded Transaction Filesystem (ETFS) |
|---|---|
| Short name | ETFS |
| Category | filesystem |
| Platforms | QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A transaction-based QNX filesystem for NAND flash. Every write is a new transaction with a sequence number in the page's spare area; the current state is rebuilt by replaying them, so pages holding superseded versions of files can remain until they are reclaimed (background reclaim and wear levelling decide when). It has no magic number: it is recognised by its reserved files (.filetable, .badblks, .counts) at fixed file IDs.
Signatures
None recorded
Known extensions
None recorded
References
- Embedded transaction filesystem (ETFS) — QNX Neutrino System Architecture https://www.qnx.com/developers/docs/6.5.0SP1/neutrino/sys_arch/fsys.html
- etfsctl — reserved files .filetable, .badblks, .counts (QNX utilities reference) https://www.qnx.com/developers/docs/6.5.0SP1/neutrino/utilities/e/etfsctl.html
- qnxmount — QNX6, ETFS and EFS parsers (Netherlands Forensic Institute) https://github.com/NetherlandsForensicInstitute/qnxmount
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “QNX Embedded Transaction Filesystem (ETFS)”. https://kalink0.github.io/crush-forensics/formats/etfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction