UBIFS
| Format | UBIFS |
|---|---|
| Short name | UBIFS |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The flash filesystem that runs on a UBI volume. Nodes are written out of place and indexed by a wandering B+ tree; a journal holds recent changes. Nodes for superseded data can remain in the volume until it is garbage-collected.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 31 18 10 06 | 1... | Node magic 0x06101831 (little-endian), superblock node in LEB 0 |
Known extensions
.ubifs
References
- UBIFS documentation (Linux MTD project) http://www.linux-mtd.infradead.org/doc/ubifs.html
- A Brief Introduction to the Design of UBIFS (Adrian Hunter, 2008) http://www.linux-mtd.infradead.org/doc/ubifs_whitepaper.pdf
- UBIFS on-flash structures — fs/ubifs/ubifs-media.h (Linux kernel source) https://github.com/torvalds/linux/blob/master/fs/ubifs/ubifs-media.h
Cite this entry
Crush Format Reference, “UBIFS”. https://kalink0.github.io/crush-forensics/formats/ubifs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction