Resilient File System (ReFS)
| Format | Resilient File System (ReFS) |
|---|---|
| Short name | ReFS |
| Category | filesystem |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Microsoft's copy-on-write filesystem for Windows Server and Dev Drives on Windows 11, in two incompatible format generations (1.x from Windows 8/Server 2012, 3.x from Windows 10/Server 2016). Metadata is held in B+ trees that are written to new locations on every change, so older tree pages can remain. Supports integrity streams (checksums) and block cloning.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 3 (0x3) | 52 65 46 53 00 00 00 00 | ReFS.... | File system signature 'ReFS' in the volume boot record |
| offset 16 (0x10) | 46 53 52 53 | FSRS | File system recognition structure signature 'FSRS' |
Known extensions
None recorded
References
- Resilient File System (ReFS) (libyal/libfsrefs) https://github.com/libyal/libfsrefs/blob/main/documentation/Resilient%20File%20System%20(ReFS).asciidoc
- ForensicsWiki — Resilient file system (ReFS) https://forensics.wiki/resilient_file_system_(refs)/
Cite this entry
Crush Format Reference, “Resilient File System (ReFS)”. https://kalink0.github.io/crush-forensics/formats/refs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction