Hi all,
I’m analyzing a firmware image dumped from a Ubiquiti device with UART, and I’m running into issues trying to extract user-modified configuration files from what appears to be a JFFS2 partition.
Goal:
Access the writable partition (JFFS2) to extract actual user data (credentials, configs). I’ve already extracted the squashfs successfully, but that only contains factory defaults.
What I’ve done so far:
• Identified JFFS2 signature (0x85 0x19) at offset 0x55686.
• Tried extracting from both:
• Used jefferson (latest version from GitHub):
• No error messages, but the output folder is empty.
• Tried a 130 MB full extract from 0x55686 to EOF – same result.
Things I’ve tried:
• Tried older Jefferson versions
• Binwalk with --extract, still no usable JFFS2 filesystem, same result empty folder
Questions:
1. Has anyone encountered similar issues with Ubiquiti firmware and Jefferson?
2. Could it be a fragmented or raw NAND layout that Jefferson cannot parse?
3. Any tools or techniques recommended to recover real user data from this type of dump?
Any insight would be really appreciated.
Thanks in advance!