diff options
Diffstat (limited to 'contrib/file/Magdir/macintosh')
| -rw-r--r-- | contrib/file/Magdir/macintosh | 93 |
1 files changed, 93 insertions, 0 deletions
diff --git a/contrib/file/Magdir/macintosh b/contrib/file/Magdir/macintosh index b6dc91c..1fb8241 100644 --- a/contrib/file/Magdir/macintosh +++ b/contrib/file/Magdir/macintosh @@ -240,3 +240,96 @@ 0 string $FL2 SPSS System File >24 string x %s + +# Macintosh filesystem data +# From "Tom N Harris" <telliamed@mac.com> +# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these +# entries depend on the data arithmetic added after v.35 +# There's also some Pascal strings in here, ditto... + +# The boot block signature, according to IM:Files, is +# "for HFS volumes, this field always contains the value 0x4C4B." +# But if this is true for MFS or HFS+ volumes, I don't know. +# Alternatively, the boot block is supposed to be zeroed if it's +# unused, so a simply >0 should suffice. + +0x400 beshort 0xD2D7 Macintosh MFS data +>0 beshort 0x4C4B (bootable) +>0x40a beshort &0x8000 (locked) +>0x402 beldate-0x7C25B080 x created: %s, +>0x406 beldate-0x7C25B080 >0 last backup: %s, +>0x414 belong x block size: %d, +>0x412 beshort x number of blocks: %d, +>0x424 pstring x volume name: %s + +0x400 beshort 0x4244 Macintosh HFS data +>0 beshort 0x4C4B (bootable) +>0x40a beshort &0x8000 (locked) +>0x40a beshort ^0x0100 (mounted) +>0x40a beshort &0x0800 (unclean) +>0x402 beldate-0x7C25B080 x created: %s, +>0x406 beldate-0x7C25B080 x last modified: %s, +>0x440 beldate-0x7C25B080 >0 last backup: %s, +>0x414 belong x block size: %d, +>0x412 beshort x number of blocks: %d, +>0x424 pstring x volume name: %s +#>0x480 beshort =0x482B Embedded HFS+ Volume: +#>>((0x482*(0x414))+(0x41c*512)) x \b +# Well, this is (theoretically) how we could do this. But it occurs to +# me that we likely don't read in a large enough chunk. I don't have any +# HFS+ volumes to see what a typical offset would be. + +0x400 beshort 0x482B Macintosh HFS Extended +>&2 beshort x version %d data +>0 beshort 0x4C4B (bootable) +>&4 belong ^0x00000100 (mounted) +>&4 belong &0x00000800 (unclean) +>&4 belong &0x00008000 (locked) +>&8 string x last mounted by: '%.4s', +# really, that should be treated as a belong and we print a string +# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" +>&16 beldate-0x7C25B080 x created: %s, +>&20 beldate-0x7C25B080 x last modified: %s, +>&24 beldate-0x7C25B080 >0 last backup: %s, +>&28 beldate-0x7C25B080 >0 last checked: %s, +>&40 belong x block size: %d, +>&44 belong x number of blocks: %d, +>&48 belong x free blocks: %d + +# I don't think this is really necessary since it doesn't do much and +# anything with a valid driver descriptor will also have a valid +# partition map +#0 beshort 0x4552 Apple Device Driver data +#>&24 beshort =1 \b, MacOS + +# Is that the partition type a cstring or a pstring? Well, IM says "strings +# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a +# cstring. Of course, partitions can contain more than four entries, but +# what're you gonna do? +0x200 beshort 0x504D Apple Partition data +>&2 beshort x block size: %d +>&48 string x first type: %s, +>&12 belong x number of blocks: %d, +>(&0x2.S) beshort 0x504D +>>&48 string x second type: %s +>>&12 belong x number of blocks: %d, +>>(&0x2.S) beshort 0x504D +>>>&48 string x third type: %s +>>>&12 belong x number of blocks: %d, +>>>(&0x2.S) beshort 0x504D +>>>>&48 string x fourth type: %s +>>>>&12 belong x number of blocks: %d, +# AFAIK, only the signature is different +0x200 beshort 0x5453 Apple Old Partition data +>&2 beshort x block size: %d +>&48 string x first type: %s, +>&12 belong x number of blocks: %d, +>(&0x2.S) beshort 0x504D +>>&48 string x second type: %s +>>&12 belong x number of blocks: %d, +>>(&0x2.S) beshort 0x504D +>>>&48 string x third type: %s +>>>&12 belong x number of blocks: %d, +>>>(&0x2.S) beshort 0x504D +>>>>&48 string x fourth type: %s +>>>>&12 belong x number of blocks: %d, |
