QNX Image Filesystem (IFS)
| Format | QNX Image Filesystem (IFS) |
|---|---|
| Short name | QNX IFS |
| Category | filesystem |
| Platforms | QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A QNX boot image: a startup header and startup code followed by a read-only image filesystem holding the kernel, drivers, libraries and the build script the system boots with. The image filesystem may be compressed (zlib, LZO or UCL). On x86 a preboot section can precede the startup header. Shows what software and configuration a QNX device was built to start.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | EB 7E FF 00 | .~.. | Startup header signature 0x00FF7EEB (little-endian) |
| offset 0 (0x0) | 00 FF 7E EB | ..~. | Startup header signature 0x00FF7EEB (big-endian) |
| offset unknown | EB 7E FF 00 | .~.. | Startup header after a preboot section (x86 BIOS/UEFI images) |
Known extensions
.ifs
References
- The startup header (QNX SDP 8.0 — Building Embedded Systems) https://www.qnx.com/developers/docs/8.0/com.qnx.doc.neutrino.building/topic/ipl/ipl_startup_header.html
- dumpifs — Dump an image filesystem (QNX SDP 8.0 utilities reference) https://qnx.com/developers/docs/8.0/com.qnx.doc.neutrino.utilities/topic/d/dumpifs.html
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “QNX Image Filesystem (IFS)”. https://kalink0.github.io/crush-forensics/formats/qnx-ifs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction