Flash Filesystem

NAND structure

The Switch's eMMC storage features a large user area, two smaller boot partitions and a replay-protected memory block which is unused (no authentication key is programmed).

All official partition names come from SystemInitializer.

Boot Partitions

Boot Partition 0 (0 of 1)

The official name for this partition is "BootPartition1Root" and it has Bis Partition ID == 0.

Offset	Size	Description
0x000000	0x4000	Normal Firmware BCT from Title 0100000000000819
0x004000	0x4000	SafeMode Firmware BCT from Title 010000000000081A
0x008000	0x4000	Normal Firmware BCT from Title 0100000000000819 (backup)
0x00C000	0x4000	SafeMode Firmware BCT from Title 010000000000081A (backup)
0x010000	0xEC000	59 additional BCTs, normally unused/empty on retail systems.
0x0FC000	0x4000	System Update Control area
0x100000	0x40000	Normal Firmware package1 from Title 0100000000000819
0x140000	0x40000	Normal Firmware package1 from Title 0100000000000819 (backup)
0x180000	0x4000	Keyblob area
0x184000	0x200	[2.0.0+] NAND Patrol area

Boot Partition 1 (1 of 1)

The official name for this partition is "BootPartition2Root" and it has Bis Partition ID == 10.

Offset	Size	Description
0x000000	0x40000	SafeMode Firmware package1 from Title 010000000000081A
0x040000	0x40000	SafeMode Firmware package1 from Title 010000000000081A (backup)
0x080000	0x40000	Reserved
0x0C0000	0x40000	Reserved

System Update Control

The 0x4000 bytes at offset 0xFC000 are used by NS and boot for keeping track of the status of a system update. This area is used by the ISystemUpdateControl commands ApplyDownloadedUpdate, ApplyCardUpdate and ApplyReceivedUpdate.

Offset	Size	Description
0x0	0x1	BootImages status. Set to 1 by NS during a system update and cleared by boot after restarting.
0x1	0x1	BootImagesSafe status. Set to 1 by NS during a system update and cleared by boot after restarting.

Keyblob

Starting at offset 0x180000 is an array of 0x200-byte entries, for a total of 32 keyblobs. Each one is unique compared to the others and they are all console unique. This is officially known as the "EKS" (encryption key source) area.

From each 0x200-byte entry only the first 0xB0 bytes effectively form the keyblob as below.

Offset	Size	Description
0x0	0x10	Keyblob AES-CMAC over the next 0xA0 bytes (safe against timing attacks)
0x10	0x10	Keyblob AES CTR
0x20	0x90	Keyblob encrypted payload
0xB0	0x150	Unused, all-zero.

The active bootloader's version (offset 0x2330 in the BCT) acts as an index to control which keyblob should be installed into the system. NS uses this during system updates to install the keyblob into the customer data section in BCTs (offset 0x450).

Boot also uses this index for repairing corrupt sectors.

The currently active keyblob is officially known as "SecureInfo".

NAND Patrol

The 0x200 bytes at offset 0x184000 are used by FS for keeping track of NAND patrolling.

Offset	Size	Description
0x0	0x20	HMAC-SHA-256 over the next 0x1E0 bytes
0x20	0x4	Last patrolled NAND block's offset
0x24	0x4	NAND patrol count
0x28	0x1D8	Unused, all-zero.

User Partitions

Partition name	Partition type GUID	Offset	Size	Bis Partition ID	Encrypted	Description
N/A		0x0		20	No	GPT header, Bis-storage also allows raw access to the entire NAND eMMC sectors starting at sector0. The official name for this partition is "UserDataRoot".
PRODINFO	{98109E25-64E2-4C95-8A77-414916F5BCEB}	0x00004400	0x003FBC00	27	Yes (Bis key 0)	"CAL0" raw partition containing set:cal data. The official name for this partition is "CalibrationBinary".
PRODINFOF	{F3056AEC-5449-494C-9F2C-5FDCB75B6E6E}	0x00400000	0x00400000	28	Yes (Bis key 0)	FAT12 filesystem, additional calibration. The official name for this partition is "CalibrationFile".
BCPKG2-1-Normal-Main	{5365DE36-911B-4BB4-8FF9-AA1EBCD73990}	0x00800000	0x00800000	21	No	Raw partition where the first 0x4000 bytes (usually empty) contain the BootConfig and the remaining space contains the package2 image from Title 0100000000000819 by default. With the exFAT update installed, the package2 image is switched to the one from Title 010000000000081B. The official name for this partition is "BootConfigAndPackage2Part1".
BCPKG2-2-Normal-Sub	{8455717B-BD2B-4162-8454-91695218FC38}	0x01000000	0x00800000	22	No	Backup partition for BCPKG2-1-Normal-Main. The official name for this partition is "BootConfigAndPackage2Part2".
BCPKG2-3-SafeMode-Main	{8ED6C9A6-9C48-490B-BBEB-001D17A4C0F7}	0x01800000	0x00800000	23	No	Raw partition where the first 0x4000 bytes (usually empty) contain the BootConfig and the remaining space contains the package2 image from Title 010000000000081A by default. On [4.0.0+] and with the exFAT update installed, the package2 image is switched to the one from Title 010000000000081C. The official name for this partition is "BootConfigAndPackage2Part3".
BCPKG2-4-SafeMode-Sub	{5E99751C-56C9-47CC-AA30-B65039888917}	0x02000000	0x00800000	24	No	Backup partition for BCPKG2-3-SafeMode-Main. The official name for this partition is "BootConfigAndPackage2Part4".
BCPKG2-5-Repair-Main	{C447D9A2-24B7-468A-98C8-595CD077165A}	0x02800000	0x00800000	25	No	Installed at the factory, never written afterwards on retail. In one case this is identical to normal 1.0.0 package2, except this has encrypted data at the end padded for 0x1000-byte alignment. The official name for this partition is "BootConfigAndPackage2Part5".
BCPKG2-6-Repair-Sub	{9586E1A1-3AA2-4C90-91B3-2F4A5195B4D2}	0x03000000	0x00800000	26	No	Backup partition for BCPKG2-5-Repair-Main. The official name for this partition is "BootConfigAndPackage2Part6".
SAFE	{A44F9F6B-4ED3-441F-A34A-56AAA136BC6A}	0x03800000	0x04000000	29	Yes (Bis key 1)	FAT32 filesystem. The official name for this partition is "SafeMode".
SYSTEM	{ACB0CDF0-4F72-432D-AA0D-5388C733B224}	0x07800000	0xA0000000	31, 32 and 33	Yes (Bis key 2)	FAT32 filesystem. The official names for these partitions are "System", "SystemProperEncryption" and "SystemProperPartition".
USER	{2B777F63-E842-47AF-94C4-25A7F18B2280}	0xA7800000	0x680000000	30	Yes (Bis key 3)	FAT32 filesystem.
		0x747BFFE00	0x200		No	This is the backup GPT header specified by the main GPT header. This is also the last sector readable with Bis-storage paritionID 20.

If the client process lacks the relevant permission for any of the above partition IDs, error 0x2EE202 is returned.

NCAs stored in NAND are raw, identical to the data readable with NCM_services#ReadContentIdFile.

The filenames for saveimages is just "<lower-case hex u64 saveID>". SYSTEM-partition saveIDs are specified by FS commands, while USER-partition saveIDs are determined by FS-module internally. The high u32 of the saveID is normally either 0x00000000 or 0x80000000.

Encrypted partitions use AES-XTS using the same non-standard tweak (tweak[0] = sectorIdx[MSB] .. tweak[15] = sectorIdx[LSB], if using 32bit sectorIdx that means tweak[0]..tweak[11] are 0, with tweak[12]..tweak[15] containing big-endian sectorIdx) as other Nintendo AES-XTS code, initial_sector = 0, and sector size 0x4000. All encrypted partitions use console unique keydata.

PRODINFOF

PRODINFOF
├── Certifications
│   └── WirelessCertification.png
└── ptd
    ├── DeviceIdWithEmsBit.dat
    ├── Ecid.dat
    ├── prodCode.dat
    └── log
        ├── Process_asm1.log
        ├── Process_board1.log
        ├── TestFlagLine.log
        ├── TestFlagQc.log
        ├── AGING
        │   └── Sequence.log
        ├── BOARD_TEST
        │   └── Sequence.log
        ├── BOARD_WIRELESS
        │   └── Sequence.log
        ├── FINAL_CHECK
        │   └── Sequence.log
        ├── LCD_AND_KEY
        │   └── Sequence.log
        └── USB_AND_HP
            └── Sequence.log

DeviceIdWithEmsBit.dat

Contains a 0x10-byte uppercase hex string, identical to the DeviceId in the DeviceCert.

SYSTEM

SYSTEM
├── PRF2SAFE.RCV
├── Contents
│   ├── registered
│   │   └── ... NCA
│   └── placehld
│       └── ... NCA
├── save
│   └── ...
└── saveMeta
    └── ... (empty?)

The saves stored under this partition are only for system-titles / etc.

USER

USER
├── PRF2SAFE.RCV
├── Album (Same layout as SD)
├── Contents
│   ├── registered
│   │   └── ... NCA
│   └── placehld
│       └── ... NCA
├── save
│   └── ...
├── saveMeta
│   └── ... 
└── temp 

The saves for all non-system applications, regardless of where the application is located(storageID), is stored here. Each user account which has savedata has a separate saveimage. Save-common for an application is presumably a separate saveimage too. Every saveimage here is only for applications.

SAFE

SAFE
├── PRF2SAFE.RCV
├── Contents
│   ├── registered
│   │   └── ... NCA (nothing installed?)
│   └── placehld
│       └── ... NCA
└── save
    ├── 8000000000000000
    └── 8000000000000120

On a v2.1 system with MountBis, the only thing under here is "PRF2SAFE.RCV".

System Savegames

This is a listing of known System Savedata and what titles they correspond to.

SaveID	Owner	Mount	Notes
0x8000000000000000	fs	saveDataIxrDb:/, saveDataIxrDbSf:/, saveDataIxrDbPr:/, saveDataIxrDbSd:/	Contains imkvdb.arc and "lastPublishedId".
0x8000000000000010	account	account:/	Account database.
0x8000000000000011	account	idgen:/
0x8000000000000020	nfc	data:/	NFC data and backups.
0x8000000000000030	ns	mii:/	Mii database.
0x8000000000000031	ns	mii:/	Mii test mode database.
0x8000000000000040	ns	apprecdb:/
0x8000000000000041	ns	nsaccache:/	Home menu icondata/lru list for recently played games.
0x8000000000000043	ns	ns_appman:/
0x8000000000000044	ns	ns_sysup:/	Content update context.
0x8000000000000045	ns	[1.0.0-6.2.0] vmdb:/, [7.0.0+] lrdb:/	Required Version List storage. Also contained Version List storage before 7.0.0.
0x8000000000000046	ns	dtlman:/
0x8000000000000047	ns	ns_exfat:/
0x8000000000000048	ns	ns_systemseed:/
0x8000000000000049	ns	ns_ssversion:/	Safe System version.
0x800000000000004A	ns	ns_rightsid:/	List of RightsIDs with NCA IDs for corresponding Program title.
0x8000000000000050	settings	SystemSettings:/
0x8000000000000051	settings	FwdbgSettingsS:/
0x8000000000000052	settings	PrivateSettings:/
0x8000000000000053	settings	DeviceSettings:/
0x8000000000000054	settings	ApplnSettings:/
0x8000000000000060	ssl	SslSave:/
0x8000000000000070	nim	nim_sys:/
0x8000000000000071	nim	nim_net:/
0x8000000000000072	nim	nim_tmp:/
0x8000000000000073	nim	nim_dac:/
0x8000000000000074	nim	nim_delta:/
0x8000000000000075	nim	nim_vac:/
0x8000000000000076	nim	nim_local:/
0x8000000000000077	nim	nim_lsys:/
0x8000000000000078	nim	nim_eca_dbg:/
0x8000000000000080	friends	friends:/	Per-user savedata.
0x8000000000000081	friends	friends-sys:/
0x8000000000000082	friends	friends-image:/
0x8000000000000090	bcat	news:/	Actual news msgpack archives.
0x8000000000000091	bcat	news-sys:/	News metadata, tasklist, history, database, required system version, etc.
0x8000000000000092	bcat	news-dl:/	Storage for newly(?) downloaded news list/data.
0x80000000000000A0	bcat	prepo-sys:/	Play Report system information.
0x80000000000000A1	bcat	prepo:/	Play Report msgpack archives.
0x80000000000000A2	bcat	prepo-ap:/	Play Report msgpack archives of EventId "application_execution_history".
0x80000000000000B0	bsdsockets	nsdsave:/	Socket configuration saved data.
0x80000000000000C1	bcat	bcat-sys:/
0x80000000000000C2	bcat	bcat-dl:/
0x80000000000000D1	erpt	save:/	Contains "/journal" report listing + actual crash reports ("/%08x-%04x-%04x-%02x%02x-%04x%08x"), which are serialized via MsgPack.
0x80000000000000E0	es	escertificate:/
0x80000000000000E1	es	escommon:/
0x80000000000000E2	es	espersonalized:/
0x80000000000000E3	es	esmetarecord:/
0x80000000000000E4	es	eselicense:/
0x80000000000000F0	ns	pdm:/	Play Data log. Per-user savedata.
0x8000000000000100	pctl	pctlss:/	Parental Control settings.
0x8000000000000110	npns	npns_save:/	Push notifications persistent storage.
0x8000000000000120	ncm	?	meta/imkvdb.arc for system partition. Cache of data extracted from the CNMT for installed firmware titles (including 816).
0x8000000000000121	ncm	?	meta/imkvdb.arc for user partition. Cache of data extracted from the CNMT for installed game, update, and DLC titles.
0x8000000000000122	ncm
0x8000000000000130	migration	state:/
0x8000000000000131	migration	context:/
0x8000000000000132	migration	sd_state:/
0x8000000000000133	migration	sd_context:/
0x8000000000000140	capsrv	TM:/
0x8000000000000150	olsc	olsc:/
0x8000000000000151	olsc	olsc:/
0x8000000000000152	olsc	olsc:/
0x8000000000000153	olsc	repair:/
0x8000000000000180	sdb	[7.0.0+] vmdb:/	Version list was moved here in 7.0.0 or 7.0.1
0x8000000000000190	glue	?
0x8000000000000200	bcat	mnpp_m:/
0x8000000000000220	erpt	sprof:/
0x8000000000001010	qlaunch		Contains "savedata.dat".
0x8000000000001020	swkbd		Per-user savedata.
0x8000000000001040	miiEdit
0x8000000000001050	miiEdit		Contains "database.dat". Possibly Mii data and Mii texture data?
0x8000000000001060	shop
0x8000000000001061	shop		Per-user savedata.
0x8000000000001070	web
0x8000000000001071	web		Per-user savedata.
0x8000000000001091	loginShare		Per-user savedata.
0x80000000000010B0	playerSelect		Contains "savedata.dat". Per-user savedata.
0x80000000000010C0	myPage		Per-user savedata.
0x8000000000002020	ns	ns_confidential:/
0x8000000000010002	bcat		Delivery cache storage for application 010099F00D810000
0x8000000000010003	bcat		Delivery cache storage for application 0100000000001033
0x8000000000010004	bcat		Delivery cache storage for application 0100000000001034
0x8000000000010005	bcat		Delivery cache storage for application 010000000000102E