Linux Logical Volume Manager (LVM2)
| Format | Linux Logical Volume Manager (LVM2) |
|---|---|
| Short name | LVM2 |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-16 |
Forensic relevance
Linux volume management: a physical volume label in one of the first four sectors (normally the second) points to a text metadata area describing volume groups and logical volumes with their extents. The metadata area keeps earlier versions of the configuration in a ring buffer, so removed or resized logical volumes can be traced. On the host system, further metadata history is kept as text files below /etc/lvm/archive/ and /etc/lvm/backup/, which can reach further back than the on-disk ring buffer.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 512 (0x200) | 4C 41 42 45 4C 4F 4E 45 | LABELONE | Physical volume label 'LABELONE' (normally sector 1) |
| offset 536 (0x218) | 4C 56 4D 32 20 30 30 31 | LVM2 001 | Label type indicator 'LVM2 001' (offset 24 within the label) |
Known extensions
None recorded
References
- LVM format specification (libyal/libvslvm) https://github.com/libyal/libvslvm/blob/main/documentation/Logical%20Volume%20Manager%20(LVM)%20format.asciidoc
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “Linux Logical Volume Manager (LVM2)”. https://kalink0.github.io/crush-forensics/formats/lvm2/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction