1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
#------------------------------------------------------------------------------
# filesystems: file(1) magic for different filesystems
#
0 string \366\366\366\366 PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774 beshort 0xdabe Sun disk label
>0 string x '%s
>>31 string >\0 \b%s
>>>63 string >\0 \b%s
>>>>95 string >\0 \b%s
>0 string x \b'
>0734 short >0 %d rpm,
>0736 short >0 %d phys cys,
>0740 short >0 %d alts/cyl,
>0746 short >0 %d interleave,
>0750 short >0 %d data cyls,
>0752 short >0 %d alt cyls,
>0754 short >0 %d heads/partition,
>0756 short >0 %d sectors/track,
>0764 long >0 start cyl %ld,
>0770 long x %ld blocks
# Is there a boot block written 1 sector in?
>512 belong&077777777 0600407 \b, boot block present
0x1FE leshort 0xAA55 x86 boot sector
>2 string OSBS \b, OS/BS MBR
# J\xf6rg Jenderek <joerg@pcialias.localnet>
>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
>0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03
>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
>0x145 string Default:\ F \b, FREE-DOS MBR
>0 string \0\0\0\0 \b, extended partition table
>0 leshort 0x3CEB \b, system
>>3 string >\0 %s
>>0x36 string FAT \b, %s
>>>0x39 string 12 (%s bit)
>>>0x39 string 16 (%s bit)
>0x52 string FAT32 \b, FAT (32 bit)
>>>43 string >NO\ NAME label: %.11s,
>>>43 string <NO\ NAME label: %.11s,
>>>43 string NO\ NAME unlabeled,
>>>19 leshort >0 %d sectors
>>>19 leshort 0
>>>>32 lelong x %d sectors
>0x200 lelong 0x82564557 \b, BSD disklabel
# Solaris 7 FAT12 floppies J\xf6rg Jenderek <joerg@pcialias.localnet>
>0 leshort 0x7AEB \b, system
>>3 string >\0 %s
>>0x36 string FAT \b, %s
>>>0x39 string 12 (%s bit)
# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410 leshort 0x137f Minix filesystem
0x410 beshort 0x137f Minix filesystem (big endian),
>0x402 beshort !0 \b, %d zones
>0x1e string minix \b, bootable
0x410 leshort 0x138f Minix filesystem, 30 char names
0x410 leshort 0x2468 Minix filesystem, version 2
0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
# romfs filesystems - Juan Cespedes <cespedes@debian.org>
0 string -rom1fs-\0 romfs filesystem, version 1
>8 belong x %d bytes,
>16 string x named %s.
# netboot image - Juan Cespedes <cespedes@debian.org>
0 lelong 0x1b031336L Netboot image,
>4 lelong&0xFFFFFF00 0
>>4 lelong&0x100 0x000 mode 2
>>4 lelong&0x100 0x100 mode 3
>4 lelong&0xFFFFFF00 !0 unknown mode
0x18b string OS/2 OS/2 Boot Manager
9564 lelong 0x00011954 Unix Fast File system (little-endian),
>8404 string x last mounted on %s,
#>9504 ledate x last checked at %s,
>8224 ledate x last written at %s,
>8401 byte x clean flag %d,
>8228 lelong x number of blocks %d,
>8232 lelong x number of data blocks %d,
>8236 lelong x number of cylinder groups %d,
>8240 lelong x block size %d,
>8244 lelong x fragment size %d,
>8252 lelong x minimum percentage of free blocks %d,
>8256 lelong x rotational delay %dms,
>8260 lelong x disk rotational speed %drps,
>8320 lelong 0 TIME optimization
>8320 lelong 1 SPACE optimization
9564 belong 0x00011954 Unix Fast File system (big-endian),
>8404 string x last mounted on %s,
#>9504 bedate x last checked at %s,
>8224 bedate x last written at %s,
>8401 byte x clean flag %d,
>8228 belong x number of blocks %d,
>8232 belong x number of data blocks %d,
>8236 belong x number of cylinder groups %d,
>8240 belong x block size %d,
>8244 belong x fragment size %d,
>8252 belong x minimum percentage of free blocks %d,
>8256 belong x rotational delay %dms,
>8260 belong x disk rotational speed %drps,
>8320 belong 0 TIME optimization
>8320 belong 1 SPACE optimization
# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
0x438 leshort 0xEF53 Linux
>0x44c lelong x rev %d
>0x43e leshort x \b.%d
>0x45c lelong ^0x0000004 ext2 filesystem data
>>0x43a leshort ^0x0000001 (mounted or unclean)
>0x45c lelong &0x0000004 ext3 filesystem data
>>0x460 lelong &0x0000004 (needs journal recovery)
>0x43a leshort &0x0000002 (errors)
>0x460 lelong &0x0000001 (compressed)
#>0x460 lelong &0x0000002 (filetype)
#>0x464 lelong &0x0000001 (sparse_super)
>0x464 lelong &0x0000002 (large files)
# SGI disk labels - Nathan Scott <nathans@debian.org>
0 belong 0x0BE5A941 SGI disk label (volume header)
# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
0 belong 0x58465342 SGI XFS filesystem data
>0x4 belong x (blksz=3D%d,
>0x68 beshort x inosz=3D%d,
>0x64 beshort ^0x2004 v1 dirs)
>0x64 beshort &0x2004 v2 dirs)
############################################################################
# Minix-ST kernel floppy
0x800 belong 0x46fc2700 Atari-ST Minix kernel image
>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
# Valid media descriptor bytes for MS-DOS:
#
# Byte Capacity Media Size and Type
# -------------------------------------------------
#
# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
# F9 720K 3.5-inch, 2-sided, 9-sector
# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
# FD 360K 5.25-inch, 2-sided, 9-sector
# FF 320K 5.25-inch, 2-sided, 8-sector
# FC 180K 5.25-inch, 1-sided, 9-sector
# FE 160K 5.25-inch, 1-sided, 8-sector
# FE 250K 8-inch, 1-sided, single-density
# FD 500K 8-inch, 2-sided, single-density
# FE 1.2 MB 8-inch, 2-sided, double-density
# F8 ----- Fixed disk
#
# FC xxxK Apricot 70x1x9 boot disk.
#
# Originally a bitmap:
# xxxxxxx0 Not two sided
# xxxxxxx1 Double sided
# xxxxxx0x Not 8 SPT
# xxxxxx1x 8 SPT
# xxxxx0xx Not Removable drive
# xxxxx1xx Removable drive
# 11111xxx Must be one.
#
# But now it's rather random:
# 111111xx Low density disk
# 00 SS, Not 8 SPT
# 01 DS, Not 8 SPT
# 10 SS, 8 SPT
# 11 DS, 8 SPT
#
# 11111001 Double density 3½ floppy disk, high density 5¼
# 11110000 High density 3½ floppy disk
# 11111000 Hard disk any format
#
# CDROM Filesystems
32769 string CD001 ISO 9660 CD-ROM filesystem data
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
32776 string CDROM High Sierra CD-ROM filesystem data
|
