SquashFS
| Format | SquashFS |
|---|---|
| Short name | SquashFS |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A compressed read-only filesystem used for firmware images of routers, IoT devices, set-top boxes and Linux live systems. Inode and directory tables and file data are compressed in blocks; files are stored once and cannot be changed in place, so the image shows the firmware as built. Timestamps are unsigned seconds since 1970: each inode holds only a modification time, and the superblock records when the image was created.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 68 73 71 73 | hsqs | Superblock magic 'hsqs' (little-endian) |
| offset 0 (0x0) | 73 71 73 68 | sqsh | Superblock magic 'sqsh' (big-endian, versions before 4.0) |
Known extensions
.squashfs, .sqsh
References
- Squashfs 4.0 Filesystem (Linux kernel documentation) https://docs.kernel.org/filesystems/squashfs.html
- Squashfs binary format (dr-emann) https://dr-emann.github.io/squashfs/
Cite this entry
Crush Format Reference, “SquashFS”. https://kalink0.github.io/crush-forensics/formats/squashfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction