#------------------------------------------------------------------------------ # filesystems: file(1) magic for different filesystems # 0 string \366\366\366\366 PC formatted floppy with no filesystem # Sun disk labels # From /usr/include/sun/dklabel.h: 0774 beshort 0xdabe Sun disk label >0 string x '%s >>31 string >\0 \b%s >>>63 string >\0 \b%s >>>>95 string >\0 \b%s >0 string x \b' >0734 short >0 %d rpm, >0736 short >0 %d phys cys, >0740 short >0 %d alts/cyl, >0746 short >0 %d interleave, >0750 short >0 %d data cyls, >0752 short >0 %d alt cyls, >0754 short >0 %d heads/partition, >0756 short >0 %d sectors/track, >0764 long >0 start cyl %ld, >0770 long x %ld blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present 0x1FE leshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR # J\xf6rg Jenderek <joerg.jenderek@gmx.net> >0x8C string Invalid\ partition\ table \b, MS-DOS MBR >0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03 >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 >0x145 string Default:\ F \b, FREE-DOS MBR >0 string \0\0\0\0 \b, extended partition table # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # older drives may use E9 xx xx >0 lelong&0x009000EB 0x009000EB >0 lelong&0x000000E9 0x000000E9 >>1 ubyte >37 \b, code offset 0x%x # mtools-3.9.8/msdos.h # usual values are marked with comments to get only informations of strange FAT systems # valid sectorsize are from 32 to 2048 >>>11 uleshort <2049 >>>>11 uleshort >31 >>>>>3 string >\0 \b, OEM-ID "%8.8s" >>>>>11 uleshort >512 \b, Bytes/sector %u #>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) >>>>>11 uleshort <512 \b, Bytes/sector %u >>>>>13 ubyte >1 \b, sectors/cluster %u #>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) >>>>>14 uleshort >32 \b, reserved sectors %u #>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) #>>>>>14 uleshort >1 \b, reserved sectors %u #>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) >>>>>14 uleshort <1 \b, reserved sectors %u >>>>>16 ubyte >2 \b, FATs %u #>>>>>16 ubyte =2 \b, FATs %u (usual) >>>>>16 ubyte =1 \b, FAT %u >>>>>16 ubyte >0 >>>>>17 uleshort >0 \b, root entries %u #>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) >>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) #>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) >>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x #>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) >>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x >>>>>22 uleshort >0 \b, sectors/FAT %u #>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) >>>>>26 ubyte >2 \b, heads %u #>>>>>26 ubyte =2 \b, heads %u (usual floppy) >>>>>26 ubyte =1 \b, heads %u >>>>>28 ulelong >0 \b, hidden sectors %u #>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) >>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) #>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 specific # NOT le FAT3=NOT 3TAF=0xCCABBEB9 >>>>>82 ulelong&0xCCABBEB9 >0 >>>>>>36 ubyte >0x80 \b, physical drive 0x%x #>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk) >>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x #>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>37 ubyte >0 \b, reserved 0x%x #>>>>>>37 ubyte =0 \b, reserved 0x%x >>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>38 ubyte =0x29 >>>>>>>39 ulelong x \b, serial number 0x%x >>>>>>>43 string <NO\ NAME \b, label: "%11.11s" >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>43 string =NO\ NAME \b, unlabeled >>>>>>54 string FAT1 \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific >>>>>82 string FAT32 \b, FAT (32 bit) >>>>>>36 ulelong x \b, sectors/FAT %u >>>>>>40 uleshort >0 \b, extension flags %u #>>>>>>40 uleshort =0 \b, extension flags %u >>>>>>42 uleshort >0 \b, fsVersion %u #>>>>>>42 uleshort =0 \b, fsVersion %u (usual) >>>>>>44 ulelong >2 \b, rootdir cluster %u #>>>>>>44 ulelong =2 \b, rootdir cluster %u #>>>>>>44 ulelong =1 \b, rootdir cluster %u >>>>>>48 uleshort >1 \b, infoSector %u #>>>>>>48 uleshort =1 \b, infoSector %u (usual) >>>>>>48 uleshort <1 \b, infoSector %u >>>>>>50 uleshort >6 \b, Backup boot sector %u #>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) >>>>>>50 uleshort <6 \b, Backup boot sector %u >>>>>>54 ulelong >0 \b, reserved1 0x%x >>>>>>58 ulelong >0 \b, reserved2 0x%x >>>>>>62 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X >>>>>>64 ubyte >0x80 \b, physical drive 0x%x #>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) >>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x #>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) >>>>>>65 ubyte >0 \b, reserved 0x%x >>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) >>>>>>66 ubyte =0x29 >>>>>>>67 ulelong x \b, serial number 0x%x >>>>>>>71 string <NO\ NAME \b, label: "%11.11s" >>>>>>71 string >NO\ NAME \b, label: "%11.11s" >>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel # Minix filesystems - Juan Cespedes <cespedes@debian.org> 0x410 leshort 0x137f Minix filesystem 0x410 beshort 0x137f Minix filesystem (big endian), >0x402 beshort !0 \b, %d zones >0x1e string minix \b, bootable 0x410 leshort 0x138f Minix filesystem, 30 char names 0x410 leshort 0x2468 Minix filesystem, version 2 0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names # romfs filesystems - Juan Cespedes <cespedes@debian.org> 0 string -rom1fs-\0 romfs filesystem, version 1 >8 belong x %d bytes, >16 string x named %s. # netboot image - Juan Cespedes <cespedes@debian.org> 0 lelong 0x1b031336L Netboot image, >4 lelong&0xFFFFFF00 0 >>4 lelong&0x100 0x000 mode 2 >>4 lelong&0x100 0x100 mode 3 >4 lelong&0xFFFFFF00 !0 unknown mode 0x18b string OS/2 OS/2 Boot Manager 9564 lelong 0x00011954 Unix Fast File system (little-endian), >8404 string x last mounted on %s, #>9504 ledate x last checked at %s, >8224 ledate x last written at %s, >8401 byte x clean flag %d, >8228 lelong x number of blocks %d, >8232 lelong x number of data blocks %d, >8236 lelong x number of cylinder groups %d, >8240 lelong x block size %d, >8244 lelong x fragment size %d, >8252 lelong x minimum percentage of free blocks %d, >8256 lelong x rotational delay %dms, >8260 lelong x disk rotational speed %drps, >8320 lelong 0 TIME optimization >8320 lelong 1 SPACE optimization 9564 belong 0x00011954 Unix Fast File system (big-endian), >7168 long 0x4c41424c Apple UFS Volume >>7186 string x named %s, >>7176 belong x volume label version %d, >>7180 bedate x created on %s, >8404 string x last mounted on %s, #>9504 bedate x last checked at %s, >8224 bedate x last written at %s, >8401 byte x clean flag %d, >8228 belong x number of blocks %d, >8232 belong x number of data blocks %d, >8236 belong x number of cylinder groups %d, >8240 belong x block size %d, >8244 belong x fragment size %d, >8252 belong x minimum percentage of free blocks %d, >8256 belong x rotational delay %dms, >8260 belong x disk rotational speed %drps, >8320 belong 0 TIME optimization >8320 belong 1 SPACE optimization # ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d >0x43e leshort x \b.%d >0x45c lelong ^0x0000004 ext2 filesystem data >>0x43a leshort ^0x0000001 (mounted or unclean) >0x45c lelong &0x0000004 ext3 filesystem data >>0x460 lelong &0x0000004 (needs journal recovery) >0x43a leshort &0x0000002 (errors) >0x460 lelong &0x0000001 (compressed) #>0x460 lelong &0x0000002 (filetype) #>0x464 lelong &0x0000001 (sparse_super) >0x464 lelong &0x0000002 (large files) # SGI disk labels - Nathan Scott <nathans@debian.org> 0 belong 0x0BE5A941 SGI disk label (volume header) # SGI XFS filesystem - Nathan Scott <nathans@debian.org> 0 belong 0x58465342 SGI XFS filesystem data >0x4 belong x (blksz=3D%d, >0x68 beshort x inosz=3D%d, >0x64 beshort ^0x2004 v1 dirs) >0x64 beshort &0x2004 v2 dirs) ############################################################################ # Minix-ST kernel floppy 0x800 belong 0x46fc2700 Atari-ST Minix kernel image >19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy >19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy ############################################################################ # Hmmm, is this a better way of detecting _standard_ floppy images ? 19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs >0x1FE leshort 0xAA55 \b, x86 hard disk boot sector 19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k 19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k # Valid media descriptor bytes for MS-DOS: # # Byte Capacity Media Size and Type # ------------------------------------------------- # # F0 2.88 MB 3.5-inch, 2-sided, 36-sector # F0 1.44 MB 3.5-inch, 2-sided, 18-sector # F9 720K 3.5-inch, 2-sided, 9-sector # F9 1.2 MB 5.25-inch, 2-sided, 15-sector # FD 360K 5.25-inch, 2-sided, 9-sector # FF 320K 5.25-inch, 2-sided, 8-sector # FC 180K 5.25-inch, 1-sided, 9-sector # FE 160K 5.25-inch, 1-sided, 8-sector # FE 250K 8-inch, 1-sided, single-density # FD 500K 8-inch, 2-sided, single-density # FE 1.2 MB 8-inch, 2-sided, double-density # F8 ----- Fixed disk # # FC xxxK Apricot 70x1x9 boot disk. # # Originally a bitmap: # xxxxxxx0 Not two sided # xxxxxxx1 Double sided # xxxxxx0x Not 8 SPT # xxxxxx1x 8 SPT # xxxxx0xx Not Removable drive # xxxxx1xx Removable drive # 11111xxx Must be one. # # But now it's rather random: # 111111xx Low density disk # 00 SS, Not 8 SPT # 01 DS, Not 8 SPT # 10 SS, 8 SPT # 11 DS, 8 SPT # # 11111001 Double density 3½ floppy disk, high density 5¼ # 11110000 High density 3½ floppy disk # 11111000 Hard disk any format # # CDROM Filesystems 32769 string CD001 ISO 9660 CD-ROM filesystem data 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 32776 string CDROM High Sierra CD-ROM filesystem data