YAFFS1 / YAFFS2
| Format | YAFFS1 / YAFFS2 |
|---|---|
| Short name | YAFFS |
| Category | filesystem |
| Platforms | Linux, Android |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Yet Another Flash File System, used on NAND flash in older Android devices and embedded systems. Each page carries tags in its spare area naming the object and chunk it belongs to; YAFFS2 adds a per-block sequence number (YAFFS1 uses deletion markers and a 2-bit serial number). The newest chunk wins, so earlier versions of files can remain on the flash. It has no magic number and is recognised by its page and spare-area layout.
Signatures
None recorded
Known extensions
.yaffs, .yaffs2
References
- How Yaffs works (Aleph One, yaffs.net) https://yaffs.net/node/409
- Forensic Analysis of YAFFS2 (Zimmermann, Spreitzenbarth, Schmitt, Freiling — SICHERHEIT 2012) https://dl.gi.de/handle/20.500.12116/18263
Cite this entry
Crush Format Reference, “YAFFS1 / YAFFS2”. https://kalink0.github.io/crush-forensics/formats/yaffs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction