UBI (Unsorted Block Images)
| Format | UBI (Unsorted Block Images) |
|---|---|
| Short name | UBI |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A volume layer on raw NAND flash in embedded Linux devices. Each physical eraseblock starts with an erase-counter header and (once mapped) a volume-ID header that maps it to a logical block of a volume; a volume table, kept twice in an internal layout volume, names the volumes. Eraseblocks that held earlier copies of a logical block can remain until they are erased.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 55 42 49 23 | UBI# | Erase-counter header magic 'UBI#' |
| offset unknown | 55 42 49 21 | UBI! | Volume-ID header magic 'UBI!' (at the VID header offset given in the erase-counter header) |
Known extensions
.ubi
References
- UBI documentation (Linux MTD project) http://www.linux-mtd.infradead.org/doc/ubi.html
- UBI — Unsorted Block Images, design paper (Linux MTD project) http://www.linux-mtd.infradead.org/doc/ubidesign/ubidesign.pdf
- UBI on-flash structures — drivers/mtd/ubi/ubi-media.h (Linux kernel source) https://github.com/torvalds/linux/blob/master/drivers/mtd/ubi/ubi-media.h
Cite this entry
Crush Format Reference, “UBI (Unsorted Block Images)”. https://kalink0.github.io/crush-forensics/formats/ubi/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction