1 2#------------------------------------------------------------------------------ |
3# $File: macintosh,v 1.25 2014/09/03 13:34:16 christos Exp $ |
4# macintosh description 5# 6# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 7# Daniel Quinlan, quinlan@yggdrasil.com 811 string must\ be\ converted\ with\ BinHex BinHex binary text 9!:mime application/mac-binhex40 10>41 string x \b, version %.3s 11 --- 148 unchanged lines hidden (view full) --- 160#>65 string TOVF (Eudora table of contents) 161#>65 string WDBN (Microsoft Word word processor) 162#>65 string WORD (MacWrite word processor) 163#>65 string XLS\ (Microsoft Excel) 164#>65 string ZIVM (compress (.Z)) 165#>65 string ZSYS (Pre-System 7 system file) 166#>65 string acf3 (Aldus FreeHand) 167#>65 string cdev (control panel) |
168#>65 string dfil (Desk Accessory suitcase) |
169#>65 string libr (library) 170#>65 string nX^d (WriteNow word processor) 171#>65 string nX^w (WriteNow dictionary) 172#>65 string rsrc (resource) 173#>65 string scbk (Scrapbook) 174#>65 string shlb (shared library) 175#>65 string ttro (SimpleText read-only) 176#>65 string zsys (system file) --- 106 unchanged lines hidden (view full) --- 283>0 beshort 0x4C4B (bootable) 284>0x40a beshort &0x8000 (locked) 285>0x402 beldate-0x7C25B080 x created: %s, 286>0x406 beldate-0x7C25B080 >0 last backup: %s, 287>0x414 belong x block size: %d, 288>0x412 beshort x number of blocks: %d, 289>0x424 pstring x volume name: %s 290 |
291# *.hfs updated by Joerg Jenderek 292# http://en.wikipedia.org/wiki/Hierarchical_File_System |
293# "BD" gives many false positives |
2940x400 beshort 0x4244 295# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 296# first block of volume bit map (always 3) 297>0x40e ubeshort 0x0003 298# maximal length of volume name is 27 299>>0x424 ubyte <28 Macintosh HFS data 300#!:mime application/octet-stream 301# these mime and apple types are not sure 302!:mime application/x-apple-diskimage 303#!:apple hfsdINIT 304#!:apple MACSdisk 305>>>0 beshort 0x4C4B (bootable) 306#>>>0 beshort 0x0000 (not bootable) 307>>>0x40a beshort &0x8000 (locked) 308>>>0x40a beshort ^0x0100 (mounted) 309>>>0x40a beshort &0x0200 (spared blocks) 310>>>0x40a beshort &0x0800 (unclean) 311>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 312# http://www.epochconverter.com/ 313# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 314# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 315# construct not working 316#>>>0x402 beldate-0x7C25B080 x created: %s, 317#>>>0x406 beldate-0x7C25B080 x last modified: %s, 318#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 319# found block sizes 200h,1200h,2800h 320>>>0x414 belong x block size: %d, 321>>>0x412 beshort x number of blocks: %d, 322>>>0x424 pstring x volume name: %s |
323 3240x400 beshort 0x482B Macintosh HFS Extended 325>&0 beshort x version %d data 326>0 beshort 0x4C4B (bootable) 327>0x404 belong ^0x00000100 (mounted) 328>&2 belong &0x00000200 (spared blocks) 329>&2 belong &0x00000800 (unclean) 330>&2 belong &0x00008000 (locked) --- 4 unchanged lines hidden (view full) --- 335# only the creation date is local time, all other timestamps in HFS+ are UTC. 336>&18 bedate-0x7C25B080 x last modified: %s, 337>&22 bedate-0x7C25B080 >0 last backup: %s, 338>&26 bedate-0x7C25B080 >0 last checked: %s, 339>&38 belong x block size: %d, 340>&42 belong x number of blocks: %d, 341>&46 belong x free blocks: %d 342 |
343## AFAIK, only the signature is different |
344# same as Apple Partition Map 345# GRR: This magic is too weak, it is just "TS" |
346#0x200 beshort 0x5453 Apple Old Partition data 347#>0x2 beshort x block size: %d, 348#>0x230 string x first type: %s, 349#>0x210 string x name: %s, 350#>0x254 belong x number of blocks: %d, 351#>0x400 beshort 0x504D 352#>>0x430 string x second type: %s, 353#>>0x410 string x name: %s, --- 24 unchanged lines hidden --- |