ext2 / ext3 / ext4
| Format | ext2 / ext3 / ext4 |
|---|---|
| Short name | ext |
| Category | filesystem |
| Platforms | Linux, Android |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The Linux extended filesystem family, also the data and system partitions of many Android devices. Files are inodes with up to four timestamps (ext4: nanosecond resolution and creation time), block pointers or extents, and directory entries that link names to inode numbers. ext3/ext4 clear a deleted file's block pointers or extents in the inode, but keep a journal whose older copies of metadata blocks can still describe deleted or changed files. The superblock records last mount path, mount and write times.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 1080 (0x438) | 53 EF | S. | Superblock magic 0xEF53 (superblock at byte 1024) |
Known extensions
None recorded
References
- ext4 Data Structures and Algorithms (Linux kernel documentation) https://docs.kernel.org/filesystems/ext4/index.html
- Extended File System (EXT) — format documentation (libyal/libfsext) https://github.com/libyal/libfsext/blob/main/documentation/Extended%20File%20System%20(EXT).asciidoc
- ForensicsWiki — Extended file system (ext) https://forensics.wiki/extended_file_system_(ext)/
- Mobile Forensics – The File Format Handbook: Ext4 (Rune Nordvik, Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_2
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “ext2 / ext3 / ext4”. https://kalink0.github.io/crush-forensics/formats/ext/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction