F2FS (Flash-Friendly File System)
Definition
A log-structured file system designed for NAND flash, used on the userdata partition of many modern Android devices including Samsung Galaxy and Google Pixel. Writes sequentially in a log, reducing write amplification. Forensically, the log-structured layout means deleted data may be overwritten more quickly and recovery requires understanding the node information block (NIB) structure.
- Design target
- NAND flash storage
- Structure
- Log-structured, sequential writes
- Common devices
- Samsung Galaxy and Google Pixel userdata partitions
- Forensic effect
- Faster overwrite of deleted data than on traditional file systems
Common questions
Why does F2FS make deleted-data recovery harder than on other Android file systems?+
Because writes are appended sequentially in a rotating log rather than in place, garbage collection reclaims and overwrites stale blocks relatively quickly, shrinking the window in which deleted files remain recoverable compared with file systems that leave freed space untouched until reallocated.
What does an examiner need to parse F2FS structures correctly?+
Reconstructing files requires understanding the node information block (NIB) structure that maps logical files to physical log locations, since generic file-carving tools that assume a traditional inode layout will misread or miss F2FS artifacts.
Related terms
- APFS (Apple File System)
- The default file system on iOS devices since iOS 10.3. Features include 64-bit inode numbers, copy-on-write metadata, file-level encryption using per-file keys,...
- App Sandbox (iOS)
- The iOS isolation mechanism combining UNIX file permissions, signed entitlements, and TrustedBSD mandatory access control. Each app is confined to a container...
- Data Protection Classes (iOS)
- iOS encrypts each file under one of four protection classes that control when the file's encryption key is available: Complete (key available...
- Ext4
- The fourth extended file system, the default Linux file system used for the userdata partition on most Android devices before widespread F2FS...
- UID-Based Sandbox (Android)
- Android's application isolation model in which each installed app receives a unique Linux user ID at install time. The app's private data...