XFS
| Format | XFS |
|---|---|
| Short name | XFS |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
A journaling filesystem used as the default on Red Hat Enterprise Linux and its derivatives and on many NAS devices. Allocation groups each manage their own inodes and free space through B+ trees; inodes carry nanosecond timestamps and, on v5 filesystems, a creation time. Newer filesystems can use the bigtime feature (Y2038-safe timestamps with a different epoch and encoding), which must be taken into account when interpreting timestamps.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 58 46 53 42 | XFSB | Superblock signature 'XFSB' |
Known extensions
None recorded
References
- X File System (XFS) (libyal/libfsxfs) https://github.com/libyal/libfsxfs/blob/main/documentation/X%20File%20System%20(XFS).asciidoc
- ForensicsWiki — XFS https://forensics.wiki/xfs/
Cite this entry
Crush Format Reference, “XFS”. https://kalink0.github.io/crush-forensics/formats/xfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction