Flash-Friendly File System (F2FS)
| Format | Flash-Friendly File System (F2FS) |
|---|---|
| Short name | F2FS |
| Category | filesystem |
| Platforms | Linux, Android |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A log-structured filesystem for NAND flash, used as the userdata partition on many Android devices. Data and nodes are written to new segments rather than in place, and checkpoints alternate between two copies, so earlier versions of files and metadata can remain in segments that have not yet been cleaned. Inodes carry access, change, modification and (optionally) creation times.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 1024 (0x400) | 10 20 F5 F2 | . .. | Superblock magic 0xF2F52010 (byte 1024) |
Known extensions
None recorded
References
- Flash-Friendly File System (F2FS) (Linux kernel documentation) https://docs.kernel.org/filesystems/f2fs.html
- F2FS on-disk structures — include/linux/f2fs_fs.h (Linux kernel source) https://github.com/torvalds/linux/blob/master/include/linux/f2fs_fs.h
- Mobile Forensics – The File Format Handbook: The Flash-Friendly File System (F2FS) (Chris Currier, Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_3
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “Flash-Friendly File System (F2FS)”. https://kalink0.github.io/crush-forensics/formats/f2fs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction