1
2#------------------------------------------------------------------------------
3# filesystems: file(1) magic for different filesystems
4#
50 string \366\366\366\366 PC formatted floppy with no filesystem
6# Sun disk labels
7# From /usr/include/sun/dklabel.h:
80774 beshort 0xdabe Sun disk label
9>0 string x '%s
10>>31 string >\0 \b%s
11>>>63 string >\0 \b%s
12>>>>95 string >\0 \b%s
13>0 string x \b'
14>0734 short >0 %d rpm,
15>0736 short >0 %d phys cys,
16>0740 short >0 %d alts/cyl,
17>0746 short >0 %d interleave,
18>0750 short >0 %d data cyls,
19>0752 short >0 %d alt cyls,
20>0754 short >0 %d heads/partition,
21>0756 short >0 %d sectors/track,
22>0764 long >0 start cyl %ld,
23>0770 long x %ld blocks
24# Is there a boot block written 1 sector in?
25>512 belong&077777777 0600407 \b, boot block present
260x1FE leshort 0xAA55 x86 boot sector
27>2 string OSBS \b, OS/BS MBR
28# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
29>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
30>0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03
31>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
32>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
33>0x145 string Default:\ F \b, FREE-DOS MBR
34>0 string \0\0\0\0 \b, extended partition table
35# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
36# older drives may use E9 xx xx
37>0 lelong&0x009000EB 0x009000EB
38>0 lelong&0x000000E9 0x000000E9
39>>1 ubyte >37 \b, code offset 0x%x
40# mtools-3.9.8/msdos.h
41# usual values are marked with comments to get only informations of strange FAT systems
42# valid sectorsize are from 32 to 2048
43>>>11 uleshort <2049
44>>>>11 uleshort >31
45>>>>>3 string >\0 \b, OEM-ID "%8.8s"
46>>>>>11 uleshort >512 \b, Bytes/sector %u
47#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
48>>>>>11 uleshort <512 \b, Bytes/sector %u
49>>>>>13 ubyte >1 \b, sectors/cluster %u
50#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
51>>>>>14 uleshort >32 \b, reserved sectors %u
52#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
53#>>>>>14 uleshort >1 \b, reserved sectors %u
54#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
55>>>>>14 uleshort <1 \b, reserved sectors %u
56>>>>>16 ubyte >2 \b, FATs %u
57#>>>>>16 ubyte =2 \b, FATs %u (usual)
58>>>>>16 ubyte =1 \b, FAT %u
59>>>>>16 ubyte >0
60>>>>>17 uleshort >0 \b, root entries %u
61#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
62>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
63#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
64>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
65#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
66>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
67>>>>>22 uleshort >0 \b, sectors/FAT %u
68#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
69>>>>>26 ubyte >2 \b, heads %u
70#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
71>>>>>26 ubyte =1 \b, heads %u
72>>>>>28 ulelong >0 \b, hidden sectors %u
73#>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
74>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
75#>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
76# FAT<32 specific
77# NOT le FAT3=NOT 3TAF=0xCCABBEB9
78>>>>>82 ulelong&0xCCABBEB9 >0
79>>>>>>36 ubyte >0x80 \b, physical drive 0x%x
80#>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
81>>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x
82#>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
83>>>>>>37 ubyte >0 \b, reserved 0x%x
84#>>>>>>37 ubyte =0 \b, reserved 0x%x
85>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
86>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
87>>>>>>38 ubyte =0x29
88>>>>>>>39 ulelong x \b, serial number 0x%x
89>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
90>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
91>>>>>>>43 string =NO\ NAME \b, unlabeled
92>>>>>>54 string FAT1 \b, FAT
93>>>>>>>54 string FAT12 \b (12 bit)
94>>>>>>>54 string FAT16 \b (16 bit)
95# FAT32 specific
96>>>>>82 string FAT32 \b, FAT (32 bit)
97>>>>>>36 ulelong x \b, sectors/FAT %u
98>>>>>>40 uleshort >0 \b, extension flags %u
99#>>>>>>40 uleshort =0 \b, extension flags %u
100>>>>>>42 uleshort >0 \b, fsVersion %u
101#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
102>>>>>>44 ulelong >2 \b, rootdir cluster %u
103#>>>>>>44 ulelong =2 \b, rootdir cluster %u
104#>>>>>>44 ulelong =1 \b, rootdir cluster %u
105>>>>>>48 uleshort >1 \b, infoSector %u
106#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
107>>>>>>48 uleshort <1 \b, infoSector %u
108>>>>>>50 uleshort >6 \b, Backup boot sector %u
109#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
110>>>>>>50 uleshort <6 \b, Backup boot sector %u
111>>>>>>54 ulelong >0 \b, reserved1 0x%x
112>>>>>>58 ulelong >0 \b, reserved2 0x%x
113>>>>>>62 ulelong >0 \b, reserved3 0x%x
114# same structure as FAT1X
115>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
116#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
117>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
118#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
119>>>>>>65 ubyte >0 \b, reserved 0x%x
120>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
121>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
122>>>>>>66 ubyte =0x29
123>>>>>>>67 ulelong x \b, serial number 0x%x
124>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
125>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
126>>>>>>71 string =NO\ NAME \b, unlabeled
127### FATs end
128>0x200 lelong 0x82564557 \b, BSD disklabel
| 1
2#------------------------------------------------------------------------------
3# filesystems: file(1) magic for different filesystems
4#
50 string \366\366\366\366 PC formatted floppy with no filesystem
6# Sun disk labels
7# From /usr/include/sun/dklabel.h:
80774 beshort 0xdabe Sun disk label
9>0 string x '%s
10>>31 string >\0 \b%s
11>>>63 string >\0 \b%s
12>>>>95 string >\0 \b%s
13>0 string x \b'
14>0734 short >0 %d rpm,
15>0736 short >0 %d phys cys,
16>0740 short >0 %d alts/cyl,
17>0746 short >0 %d interleave,
18>0750 short >0 %d data cyls,
19>0752 short >0 %d alt cyls,
20>0754 short >0 %d heads/partition,
21>0756 short >0 %d sectors/track,
22>0764 long >0 start cyl %ld,
23>0770 long x %ld blocks
24# Is there a boot block written 1 sector in?
25>512 belong&077777777 0600407 \b, boot block present
260x1FE leshort 0xAA55 x86 boot sector
27>2 string OSBS \b, OS/BS MBR
28# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
29>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
30>0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03
31>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
32>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
33>0x145 string Default:\ F \b, FREE-DOS MBR
34>0 string \0\0\0\0 \b, extended partition table
35# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
36# older drives may use E9 xx xx
37>0 lelong&0x009000EB 0x009000EB
38>0 lelong&0x000000E9 0x000000E9
39>>1 ubyte >37 \b, code offset 0x%x
40# mtools-3.9.8/msdos.h
41# usual values are marked with comments to get only informations of strange FAT systems
42# valid sectorsize are from 32 to 2048
43>>>11 uleshort <2049
44>>>>11 uleshort >31
45>>>>>3 string >\0 \b, OEM-ID "%8.8s"
46>>>>>11 uleshort >512 \b, Bytes/sector %u
47#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
48>>>>>11 uleshort <512 \b, Bytes/sector %u
49>>>>>13 ubyte >1 \b, sectors/cluster %u
50#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
51>>>>>14 uleshort >32 \b, reserved sectors %u
52#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
53#>>>>>14 uleshort >1 \b, reserved sectors %u
54#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
55>>>>>14 uleshort <1 \b, reserved sectors %u
56>>>>>16 ubyte >2 \b, FATs %u
57#>>>>>16 ubyte =2 \b, FATs %u (usual)
58>>>>>16 ubyte =1 \b, FAT %u
59>>>>>16 ubyte >0
60>>>>>17 uleshort >0 \b, root entries %u
61#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
62>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
63#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
64>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
65#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
66>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
67>>>>>22 uleshort >0 \b, sectors/FAT %u
68#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
69>>>>>26 ubyte >2 \b, heads %u
70#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
71>>>>>26 ubyte =1 \b, heads %u
72>>>>>28 ulelong >0 \b, hidden sectors %u
73#>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
74>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
75#>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
76# FAT<32 specific
77# NOT le FAT3=NOT 3TAF=0xCCABBEB9
78>>>>>82 ulelong&0xCCABBEB9 >0
79>>>>>>36 ubyte >0x80 \b, physical drive 0x%x
80#>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
81>>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x
82#>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
83>>>>>>37 ubyte >0 \b, reserved 0x%x
84#>>>>>>37 ubyte =0 \b, reserved 0x%x
85>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
86>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
87>>>>>>38 ubyte =0x29
88>>>>>>>39 ulelong x \b, serial number 0x%x
89>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
90>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
91>>>>>>>43 string =NO\ NAME \b, unlabeled
92>>>>>>54 string FAT1 \b, FAT
93>>>>>>>54 string FAT12 \b (12 bit)
94>>>>>>>54 string FAT16 \b (16 bit)
95# FAT32 specific
96>>>>>82 string FAT32 \b, FAT (32 bit)
97>>>>>>36 ulelong x \b, sectors/FAT %u
98>>>>>>40 uleshort >0 \b, extension flags %u
99#>>>>>>40 uleshort =0 \b, extension flags %u
100>>>>>>42 uleshort >0 \b, fsVersion %u
101#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
102>>>>>>44 ulelong >2 \b, rootdir cluster %u
103#>>>>>>44 ulelong =2 \b, rootdir cluster %u
104#>>>>>>44 ulelong =1 \b, rootdir cluster %u
105>>>>>>48 uleshort >1 \b, infoSector %u
106#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
107>>>>>>48 uleshort <1 \b, infoSector %u
108>>>>>>50 uleshort >6 \b, Backup boot sector %u
109#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
110>>>>>>50 uleshort <6 \b, Backup boot sector %u
111>>>>>>54 ulelong >0 \b, reserved1 0x%x
112>>>>>>58 ulelong >0 \b, reserved2 0x%x
113>>>>>>62 ulelong >0 \b, reserved3 0x%x
114# same structure as FAT1X
115>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
116#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
117>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
118#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
119>>>>>>65 ubyte >0 \b, reserved 0x%x
120>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
121>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
122>>>>>>66 ubyte =0x29
123>>>>>>>67 ulelong x \b, serial number 0x%x
124>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
125>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
126>>>>>>71 string =NO\ NAME \b, unlabeled
127### FATs end
128>0x200 lelong 0x82564557 \b, BSD disklabel
|
130# Minix filesystems - Juan Cespedes <cespedes@debian.org>
1310x410 leshort 0x137f Minix filesystem
1320x410 beshort 0x137f Minix filesystem (big endian),
133>0x402 beshort !0 \b, %d zones
134>0x1e string minix \b, bootable
1350x410 leshort 0x138f Minix filesystem, 30 char names
1360x410 leshort 0x2468 Minix filesystem, version 2
1370x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
138
139# romfs filesystems - Juan Cespedes <cespedes@debian.org>
1400 string -rom1fs-\0 romfs filesystem, version 1
141>8 belong x %d bytes,
142>16 string x named %s.
143
144# netboot image - Juan Cespedes <cespedes@debian.org>
1450 lelong 0x1b031336L Netboot image,
146>4 lelong&0xFFFFFF00 0
147>>4 lelong&0x100 0x000 mode 2
148>>4 lelong&0x100 0x100 mode 3
149>4 lelong&0xFFFFFF00 !0 unknown mode
150
1510x18b string OS/2 OS/2 Boot Manager
152
1539564 lelong 0x00011954 Unix Fast File system (little-endian),
154>8404 string x last mounted on %s,
155#>9504 ledate x last checked at %s,
156>8224 ledate x last written at %s,
157>8401 byte x clean flag %d,
158>8228 lelong x number of blocks %d,
159>8232 lelong x number of data blocks %d,
160>8236 lelong x number of cylinder groups %d,
161>8240 lelong x block size %d,
162>8244 lelong x fragment size %d,
163>8252 lelong x minimum percentage of free blocks %d,
164>8256 lelong x rotational delay %dms,
165>8260 lelong x disk rotational speed %drps,
166>8320 lelong 0 TIME optimization
167>8320 lelong 1 SPACE optimization
168
1699564 belong 0x00011954 Unix Fast File system (big-endian),
170>7168 long 0x4c41424c Apple UFS Volume
171>>7186 string x named %s,
172>>7176 belong x volume label version %d,
173>>7180 bedate x created on %s,
174>8404 string x last mounted on %s,
175#>9504 bedate x last checked at %s,
176>8224 bedate x last written at %s,
177>8401 byte x clean flag %d,
178>8228 belong x number of blocks %d,
179>8232 belong x number of data blocks %d,
180>8236 belong x number of cylinder groups %d,
181>8240 belong x block size %d,
182>8244 belong x fragment size %d,
183>8252 belong x minimum percentage of free blocks %d,
184>8256 belong x rotational delay %dms,
185>8260 belong x disk rotational speed %drps,
186>8320 belong 0 TIME optimization
187>8320 belong 1 SPACE optimization
188
189# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
1900x438 leshort 0xEF53 Linux
191>0x44c lelong x rev %d
192>0x43e leshort x \b.%d
193>0x45c lelong ^0x0000004 ext2 filesystem data
194>>0x43a leshort ^0x0000001 (mounted or unclean)
195>0x45c lelong &0x0000004 ext3 filesystem data
196>>0x460 lelong &0x0000004 (needs journal recovery)
197>0x43a leshort &0x0000002 (errors)
198>0x460 lelong &0x0000001 (compressed)
199#>0x460 lelong &0x0000002 (filetype)
200#>0x464 lelong &0x0000001 (sparse_super)
201>0x464 lelong &0x0000002 (large files)
202
203# SGI disk labels - Nathan Scott <nathans@debian.org>
2040 belong 0x0BE5A941 SGI disk label (volume header)
205
206# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
2070 belong 0x58465342 SGI XFS filesystem data
208>0x4 belong x (blksz %d,
209>0x68 beshort x inosz %d,
210>0x64 beshort ^0x2004 v1 dirs)
211>0x64 beshort &0x2004 v2 dirs)
212
213############################################################################
214# Minix-ST kernel floppy
2150x800 belong 0x46fc2700 Atari-ST Minix kernel image
216>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
217>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
218
219############################################################################
220# Hmmm, is this a better way of detecting _standard_ floppy images ?
22119 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
222>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
22319 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
224>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
22519 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
226>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
227
22819 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
229>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
23019 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
231>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
232
23319 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
23419 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
235
236# Valid media descriptor bytes for MS-DOS:
237#
238# Byte Capacity Media Size and Type
239# -------------------------------------------------
240#
241# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
242# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
243# F9 720K 3.5-inch, 2-sided, 9-sector
244# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
245# FD 360K 5.25-inch, 2-sided, 9-sector
246# FF 320K 5.25-inch, 2-sided, 8-sector
247# FC 180K 5.25-inch, 1-sided, 9-sector
248# FE 160K 5.25-inch, 1-sided, 8-sector
249# FE 250K 8-inch, 1-sided, single-density
250# FD 500K 8-inch, 2-sided, single-density
251# FE 1.2 MB 8-inch, 2-sided, double-density
252# F8 ----- Fixed disk
253#
254# FC xxxK Apricot 70x1x9 boot disk.
255#
256# Originally a bitmap:
257# xxxxxxx0 Not two sided
258# xxxxxxx1 Double sided
259# xxxxxx0x Not 8 SPT
260# xxxxxx1x 8 SPT
261# xxxxx0xx Not Removable drive
262# xxxxx1xx Removable drive
263# 11111xxx Must be one.
264#
265# But now it's rather random:
266# 111111xx Low density disk
267# 00 SS, Not 8 SPT
268# 01 DS, Not 8 SPT
269# 10 SS, 8 SPT
270# 11 DS, 8 SPT
271#
272# 11111001 Double density 3� floppy disk, high density 5�
273# 11110000 High density 3� floppy disk
274# 11111000 Hard disk any format
275#
276
277# CDROM Filesystems
27832769 string CD001 ISO 9660 CD-ROM filesystem data
279# "application id" which appears to be used as a volume label
280>32808 string >\0 '%s'
281>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
28237633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
28332776 string CDROM High Sierra CD-ROM filesystem data
284
285# cramfs filesystem - russell@coker.com.au
2860 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
287>4 lelong x size %d
288>8 lelong &1 version #2
289>8 lelong &2 sorted_dirs
290>8 lelong &4 hole_support
291>32 lelong x CRC 0x%x,
292>36 lelong x edition %d,
293>40 lelong x %d blocks,
294>44 lelong x %d files
295
2960 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
297>4 belong x size %d
298>8 belong &1 version #2
299>8 belong &2 sorted_dirs
300>8 belong &4 hole_support
301>32 belong x CRC 0x%x,
302>36 belong x edition %d,
303>40 belong x %d blocks,
304>44 belong x %d files
305
306# reiserfs - russell@coker.com.au
3070x10034 string ReIsErFs ReiserFS V3.5
3080x10034 string ReIsEr2Fs ReiserFS V3.6
309>0x1002c leshort x block size %d
310>0x10032 leshort &2 (mounted or unclean)
311>0x10000 lelong x num blocks %d
312>0x10040 lelong 1 tea hash
313>0x10040 lelong 2 yura hash
314>0x10040 lelong 3 r5 hash
315
316# JFFS - russell@coker.com.au
3170 lelong 0x34383931 Linux Journalled Flash File system, little endian
3180 belong 0x34383931 Linux Journalled Flash File system, big endian
319
320# EST flat binary format (which isn't, but anyway)
321# From: Mark Brown <broonie@sirena.org.uk>
3220 string ESTFBINR EST flat binary
323
324# Aculab VoIP firmware
325# From: Mark Brown <broonie@sirena.org.uk>
3260 string VoIP\ Startup\ and Aculab VoIP firmware
327>35 string x format %s
328
329# PPCBoot image file
330# From: Mark Brown <broonie@sirena.org.uk>
3310 belong 0x27051956 PPCBoot image
332>4 string PPCBoot
333>>12 string x version %s
334
335# JFFS2 file system
3360 leshort 0x1984 Linux old jffs2 filesystem data little endian
3370 lelong 0xe0011985 Linux jffs2 filesystem data little endian
| 133# Minix filesystems - Juan Cespedes <cespedes@debian.org>
1340x410 leshort 0x137f Minix filesystem
1350x410 beshort 0x137f Minix filesystem (big endian),
136>0x402 beshort !0 \b, %d zones
137>0x1e string minix \b, bootable
1380x410 leshort 0x138f Minix filesystem, 30 char names
1390x410 leshort 0x2468 Minix filesystem, version 2
1400x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
141
142# romfs filesystems - Juan Cespedes <cespedes@debian.org>
1430 string -rom1fs-\0 romfs filesystem, version 1
144>8 belong x %d bytes,
145>16 string x named %s.
146
147# netboot image - Juan Cespedes <cespedes@debian.org>
1480 lelong 0x1b031336L Netboot image,
149>4 lelong&0xFFFFFF00 0
150>>4 lelong&0x100 0x000 mode 2
151>>4 lelong&0x100 0x100 mode 3
152>4 lelong&0xFFFFFF00 !0 unknown mode
153
1540x18b string OS/2 OS/2 Boot Manager
155
1569564 lelong 0x00011954 Unix Fast File system (little-endian),
157>8404 string x last mounted on %s,
158#>9504 ledate x last checked at %s,
159>8224 ledate x last written at %s,
160>8401 byte x clean flag %d,
161>8228 lelong x number of blocks %d,
162>8232 lelong x number of data blocks %d,
163>8236 lelong x number of cylinder groups %d,
164>8240 lelong x block size %d,
165>8244 lelong x fragment size %d,
166>8252 lelong x minimum percentage of free blocks %d,
167>8256 lelong x rotational delay %dms,
168>8260 lelong x disk rotational speed %drps,
169>8320 lelong 0 TIME optimization
170>8320 lelong 1 SPACE optimization
171
1729564 belong 0x00011954 Unix Fast File system (big-endian),
173>7168 long 0x4c41424c Apple UFS Volume
174>>7186 string x named %s,
175>>7176 belong x volume label version %d,
176>>7180 bedate x created on %s,
177>8404 string x last mounted on %s,
178#>9504 bedate x last checked at %s,
179>8224 bedate x last written at %s,
180>8401 byte x clean flag %d,
181>8228 belong x number of blocks %d,
182>8232 belong x number of data blocks %d,
183>8236 belong x number of cylinder groups %d,
184>8240 belong x block size %d,
185>8244 belong x fragment size %d,
186>8252 belong x minimum percentage of free blocks %d,
187>8256 belong x rotational delay %dms,
188>8260 belong x disk rotational speed %drps,
189>8320 belong 0 TIME optimization
190>8320 belong 1 SPACE optimization
191
192# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
1930x438 leshort 0xEF53 Linux
194>0x44c lelong x rev %d
195>0x43e leshort x \b.%d
196>0x45c lelong ^0x0000004 ext2 filesystem data
197>>0x43a leshort ^0x0000001 (mounted or unclean)
198>0x45c lelong &0x0000004 ext3 filesystem data
199>>0x460 lelong &0x0000004 (needs journal recovery)
200>0x43a leshort &0x0000002 (errors)
201>0x460 lelong &0x0000001 (compressed)
202#>0x460 lelong &0x0000002 (filetype)
203#>0x464 lelong &0x0000001 (sparse_super)
204>0x464 lelong &0x0000002 (large files)
205
206# SGI disk labels - Nathan Scott <nathans@debian.org>
2070 belong 0x0BE5A941 SGI disk label (volume header)
208
209# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
2100 belong 0x58465342 SGI XFS filesystem data
211>0x4 belong x (blksz %d,
212>0x68 beshort x inosz %d,
213>0x64 beshort ^0x2004 v1 dirs)
214>0x64 beshort &0x2004 v2 dirs)
215
216############################################################################
217# Minix-ST kernel floppy
2180x800 belong 0x46fc2700 Atari-ST Minix kernel image
219>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
220>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
221
222############################################################################
223# Hmmm, is this a better way of detecting _standard_ floppy images ?
22419 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
225>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
22619 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
227>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
22819 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
229>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
230
23119 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
232>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
23319 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
234>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
235
23619 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
23719 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
238
239# Valid media descriptor bytes for MS-DOS:
240#
241# Byte Capacity Media Size and Type
242# -------------------------------------------------
243#
244# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
245# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
246# F9 720K 3.5-inch, 2-sided, 9-sector
247# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
248# FD 360K 5.25-inch, 2-sided, 9-sector
249# FF 320K 5.25-inch, 2-sided, 8-sector
250# FC 180K 5.25-inch, 1-sided, 9-sector
251# FE 160K 5.25-inch, 1-sided, 8-sector
252# FE 250K 8-inch, 1-sided, single-density
253# FD 500K 8-inch, 2-sided, single-density
254# FE 1.2 MB 8-inch, 2-sided, double-density
255# F8 ----- Fixed disk
256#
257# FC xxxK Apricot 70x1x9 boot disk.
258#
259# Originally a bitmap:
260# xxxxxxx0 Not two sided
261# xxxxxxx1 Double sided
262# xxxxxx0x Not 8 SPT
263# xxxxxx1x 8 SPT
264# xxxxx0xx Not Removable drive
265# xxxxx1xx Removable drive
266# 11111xxx Must be one.
267#
268# But now it's rather random:
269# 111111xx Low density disk
270# 00 SS, Not 8 SPT
271# 01 DS, Not 8 SPT
272# 10 SS, 8 SPT
273# 11 DS, 8 SPT
274#
275# 11111001 Double density 3� floppy disk, high density 5�
276# 11110000 High density 3� floppy disk
277# 11111000 Hard disk any format
278#
279
280# CDROM Filesystems
28132769 string CD001 ISO 9660 CD-ROM filesystem data
282# "application id" which appears to be used as a volume label
283>32808 string >\0 '%s'
284>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
28537633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
28632776 string CDROM High Sierra CD-ROM filesystem data
287
288# cramfs filesystem - russell@coker.com.au
2890 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
290>4 lelong x size %d
291>8 lelong &1 version #2
292>8 lelong &2 sorted_dirs
293>8 lelong &4 hole_support
294>32 lelong x CRC 0x%x,
295>36 lelong x edition %d,
296>40 lelong x %d blocks,
297>44 lelong x %d files
298
2990 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
300>4 belong x size %d
301>8 belong &1 version #2
302>8 belong &2 sorted_dirs
303>8 belong &4 hole_support
304>32 belong x CRC 0x%x,
305>36 belong x edition %d,
306>40 belong x %d blocks,
307>44 belong x %d files
308
309# reiserfs - russell@coker.com.au
3100x10034 string ReIsErFs ReiserFS V3.5
3110x10034 string ReIsEr2Fs ReiserFS V3.6
312>0x1002c leshort x block size %d
313>0x10032 leshort &2 (mounted or unclean)
314>0x10000 lelong x num blocks %d
315>0x10040 lelong 1 tea hash
316>0x10040 lelong 2 yura hash
317>0x10040 lelong 3 r5 hash
318
319# JFFS - russell@coker.com.au
3200 lelong 0x34383931 Linux Journalled Flash File system, little endian
3210 belong 0x34383931 Linux Journalled Flash File system, big endian
322
323# EST flat binary format (which isn't, but anyway)
324# From: Mark Brown <broonie@sirena.org.uk>
3250 string ESTFBINR EST flat binary
326
327# Aculab VoIP firmware
328# From: Mark Brown <broonie@sirena.org.uk>
3290 string VoIP\ Startup\ and Aculab VoIP firmware
330>35 string x format %s
331
332# PPCBoot image file
333# From: Mark Brown <broonie@sirena.org.uk>
3340 belong 0x27051956 PPCBoot image
335>4 string PPCBoot
336>>12 string x version %s
337
338# JFFS2 file system
3390 leshort 0x1984 Linux old jffs2 filesystem data little endian
3400 lelong 0xe0011985 Linux jffs2 filesystem data little endian
|