JFFS2 (Journalling Flash File System v2)
| Format | JFFS2 (Journalling Flash File System v2) |
|---|---|
| Short name | JFFS2 |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A log-structured filesystem for raw NOR/NAND flash in embedded Linux devices. The whole filesystem is a sequence of nodes, each with a version number; the newest node for each inode wins, so older nodes holding earlier file contents and names can remain on the flash until garbage collection erases the block.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 85 19 03 20 | ... | Node magic 0x1985 + cleanmarker node 0x2003 (little-endian) |
| offset 0 (0x0) | 85 19 01 E0 | .... | Node magic 0x1985 + directory entry node 0xE001 (little-endian) |
| offset 0 (0x0) | 85 19 02 E0 | .... | Node magic 0x1985 + inode node 0xE002 (little-endian) |
| offset 0 (0x0) | 19 85 20 03 | .. . | Node magic 0x1985 + cleanmarker node 0x2003 (big-endian) |
| offset 0 (0x0) | 19 85 E0 01 | .... | Node magic 0x1985 + directory entry node 0xE001 (big-endian) |
| offset 0 (0x0) | 19 85 E0 02 | .... | Node magic 0x1985 + inode node 0xE002 (big-endian) |
Known extensions
.jffs2
References
- JFFS2 documentation (Linux MTD project) http://www.linux-mtd.infradead.org/doc/jffs2.html
- JFFS: The Journalling Flash File System (David Woodhouse, Red Hat) https://sourceware.org/jffs2/jffs2.pdf
- JFFS2 on-disk structures — include/uapi/linux/jffs2.h (Linux kernel source) https://github.com/torvalds/linux/blob/master/include/uapi/linux/jffs2.h
- ForensicsWiki — JFFS2 https://forensics.wiki/jffs2/
Cite this entry
Crush Format Reference, “JFFS2 (Journalling Flash File System v2)”. https://kalink0.github.io/crush-forensics/formats/jffs2/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction