Tag: File System

SPIFFS Format Package

We are happy to announce support for the SPIFFS (SPI Flash File System) format. The new SPIFFS Format package lets you browse and extract files from SPIFFS images directly within the application.

SPIFFS is a flat file system designed for SPI NOR flash memory, widely used in ESP8266, ESP32, and other embedded microcontrollers. It provides wear leveling and power-loss resilience with minimal RAM overhead, making it the go-to file system for storing configuration files, web assets, and sensor data on IoT devices. SPIFFS uses a page-based layout with per-block object lookup tables and 16-bit object IDs. Unlike traditional file systems, it has no directory support — files are stored with flat paths (e.g. /config.json). Having native support in Cerbero Suite means analysts can inspect ESP32 firmware dumps, IoT flash images, and embedded device storage encountered during security research, vulnerability assessment, or forensic investigations without needing external tools or knowing the flash geometry parameters.

F2FS Format Package

We are happy to announce support for the F2FS (Flash-Friendly File System) format. The new F2FS Format package lets you browse and extract files from F2FS images directly within the application.

F2FS is a log-structured file system designed by Samsung for NAND flash storage, merged into the Linux kernel in version 3.8. It is the default user-data file system on many Android devices and is also used on Chrome OS, Tizen, and other flash-based storage systems. F2FS employs a Node Address Table (NAT) for efficient inode resolution, multi-level hash-based directories, and supports inline data for small files, extended attributes, and transparent compression (LZO, LZ4, ZSTD). Having native support in Cerbero Suite means analysts can inspect Android user-data partitions, IoT firmware, and flash storage images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

EROFS Format Package

We are happy to announce support for the EROFS (Enhanced Read-Only File System) format. The new EROFS Format package lets you browse and extract files from EROFS images directly within the application.

EROFS is a high-performance, read-only compressed file system for Linux, merged into the mainline kernel in version 4.19. It was originally developed by Huawei and is now the standard file system for Android system partitions starting from Android 10. EROFS is also used in container images (Docker, Nydus) and embedded systems. Unlike older read-only file systems such as SquashFS and CRAMFS, EROFS uses a pcluster-based compressed data layout that offers efficient random read access without decompressing entire blocks. It supports multiple compression algorithms including LZ4 and DEFLATE. Having native support in Cerbero Suite means analysts can inspect Android system images, container images, and embedded firmware encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

ROMFS Format Package

We are happy to announce support for the ROMFS (ROM File System) format in Cerbero Suite. The new ROMFS Format package lets you browse and extract files from ROMFS images directly within the application.

ROMFS is a simple, space-efficient, read-only file system designed for Linux. It was introduced in Linux 2.1.21 as a minimal alternative to ext2 for boot media and embedded devices. ROMFS stores data uncompressed with all on-disk structures in big-endian byte order, resulting in very low overhead and fast read access. ROMFS is commonly found in embedded systems, firmware images, initial RAM file systems (initramfs/initrd), and bootloaders. Its simplicity and small kernel footprint make it a popular choice for resource-constrained environments where read-only access is sufficient. Having native support in Cerbero Suite means analysts can inspect firmware dumps and ROM images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

CRAMFS Format Package

We are happy to announce support for CRAMFS file system images. The new CRAMFS Format package lets you browse and extract files from CRAMFS images directly within the application.

CRAMFS (Compressed ROM File System) is a simple, read-only compressed file system designed for Linux ROM devices. It compresses file data one page at a time using zlib, keeping the image compact while allowing random read access. CRAMFS is commonly found in embedded systems, firmware images, set-top boxes, and devices with limited flash storage. Having native support in Cerbero Suite means analysts can inspect firmware dumps and ROM images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

YAFFS Format Package

We are happy to announce support for YAFFS and YAFFS2 file system images. The new YAFFS Format package lets you browse and extract files from YAFFS flash dumps directly within the application.

YAFFS2 (Yet Another Flash File System 2) is a log-structured file system designed for NAND flash memory. It is widely used in embedded Linux devices such as Android phones, routers, set-top boxes, IoT hardware, and industrial controllers. YAFFS stores data in fixed-size chunks (pages) interleaved with spare (out-of-band) areas that contain metadata tags. Having native support in Cerbero Suite means analysts can inspect firmware dumps and flash images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools or knowing the NAND geometry parameters.

JFFS2 Format Package

We are happy to announce support for JFFS2 file system images. The new JFFS2 Format package lets you browse and extract files from JFFS2 images directly within the application.

JFFS2 (Journalling Flash File System v2) is a log-structured file system designed for raw NOR and NAND flash memory. It is widely used in embedded Linux devices such as routers, access points, IoT hardware, industrial controllers, and consumer electronics. JFFS2 stores data as a sequential log of nodes on flash, with each node carrying file metadata, directory entries, or compressed data fragments. Having native support in Cerbero Suite means analysts can inspect firmware dumps and flash images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.

DMG Format Package

We are happy to announce support for Apple Disk Image (DMG) files. The new DMG Format package lets you inspect and extract the contents of DMG images directly within the application.

DMG is Apple’s native disk image format, widely used for distributing macOS software. A DMG file packages one or more partitions, each typically containing a file system such as APFS or HFS+. The data within these partitions is often compressed using algorithms like zlib, bzip2, LZFSE, LZMA, or ADC to reduce file size. Some DMG files are also encrypted with AES-128 or AES-256, requiring a password to access.

Having native DMG support in Cerbero Suite means analysts can examine macOS disk images encountered during forensic investigations, malware analysis, or software distribution review. Combined with our existing APFS and HFS+ support, this provides a complete pipeline for going from a DMG file all the way down to individual files within an APFS and HFS+ volumes.

APFS Format Package

We are happy to announce support for the Apple File System (APFS). The new APFS Format package lets you browse and extract files from APFS containers and volumes directly within the application.

APFS is Apple’s proprietary file system, introduced in 2017 as the default for macOS, iOS, watchOS, and tvOS. It replaced HFS+ with a modern design featuring copy-on-write metadata, space sharing across volumes, snapshots, clones, and transparent file compression. An APFS container holds one or more volumes that share the same underlying storage pool. Having native support in Cerbero Suite means analysts can inspect macOS and iOS disk images encountered during forensic investigations, malware analysis, or security research without needing external tools or a Mac.

UBI Format Package

We are happy to announce support for UBI images and the UBIFS file system. The new UBI Format package lets you inspect UBI volumes and browse UBIFS file systems directly within the application.

UBI (Unsorted Block Image) is a volume management layer for raw NAND flash memory, widely used in embedded Linux devices such as routers, IoT hardware, industrial controllers, and consumer electronics. A UBI image contains one or more logical volumes that may hold kernel images, SquashFS partitions, or UBIFS file systems. UBIFS is a log-structured file system designed specifically for UBI volumes, featuring a B-tree index and transparent data compression. Having native support in Cerbero Suite means analysts can inspect firmware dumps and flash images encountered during security research, vulnerability assessment, or forensic investigations without needing external tools.