ZFS
| Format | ZFS |
|---|---|
| Short name | ZFS |
| Category | filesystem |
| Platforms | Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Copy-on-write filesystem and volume manager (OpenZFS), common on NAS and server systems. Each device carries four 256 KiB labels (two at the start, two at the end), each with a name/value list describing the pool and device configuration and a ring of uberblocks pointing to the current and recent transaction groups. Because blocks are never overwritten in place, earlier transaction groups and snapshots can preserve previous file versions. No signature at offset 0; uberblocks are found in the ring starting 128 KiB into each label.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 0C B1 BA 00 00 00 00 00 | ........ | Uberblock magic 0x00BAB10C (little-endian) in the uberblock ring at 128 KiB into each label |
| offset unknown | 00 00 00 00 00 BA B1 0C | ........ | Uberblock magic 0x00BAB10C (big-endian) |
Known extensions
None recorded
References
- uberblock_impl.h (OpenZFS source) https://github.com/openzfs/zfs/blob/master/include/sys/uberblock_impl.h
- vdev_impl.h — vdev label layout (OpenZFS source) https://github.com/openzfs/zfs/blob/master/include/sys/vdev_impl.h
Cite this entry
Crush Format Reference, “ZFS”. https://kalink0.github.io/crush-forensics/formats/zfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction