file/magic/Magdir/filesystems

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0	string	\366\366\366\366	PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774	beshort		0xdabe		Sun disk label
>0	string		x		'%s
>>31  	string		>\0		\b%s
>>>63  	string		>\0		\b%s
>>>>95 	string		>\0		\b%s
>0	string		x		\b'
>0734	short		>0		%d rpm,
>0736	short		>0		%d phys cys,
>0740	short		>0		%d alts/cyl,
>0746	short		>0		%d interleave,
>0750	short		>0		%d data cyls,
>0752	short		>0		%d alt cyls,
>0754	short		>0		%d heads/partition,
>0756	short		>0		%d sectors/track,
>0764	long		>0		start cyl %ld,
>0770	long		x		%ld blocks
# Is there a boot block written 1 sector in?
>512    belong&077777777	0600407	\b, boot block present
0x1FE	leshort	0xAA55			x86 boot sector
>2	string	OSBS			\b, OS/BS MBR
# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
>0x9D	string	Invalid\ partition\ table	\b, DR-DOS MBR, version 7.01 to 7.03
>0x10F	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>0x8B	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 5.00 to 4.00.950
>0x145	string	Default:\ F			\b, FREE-DOS MBR
>0	string	\0\0\0\0		\b, extended partition table
# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
# older drives may use E9 xx xx
>0		lelong&0x009000EB	0x009000EB 
>0		lelong&0x000000E9	0x000000E9 
>>1		ubyte			>37	\b, code offset 0x%x
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize are from 32 to 2048
>>>11		uleshort	<2049	
>>>>11		uleshort	>31	
>>>>>3		string		>\0		\b, OEM-ID "%8.8s"
>>>>>11		uleshort	>512		\b, Bytes/sector %u
#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
>>>>>11		uleshort	<512		\b, Bytes/sector %u
>>>>>13		ubyte		>1		\b, sectors/cluster %u
#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
>>>>>14		uleshort	>32		\b, reserved sectors %u
#>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
#>>>>>14	uleshort	>1		\b, reserved sectors %u
#>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
>>>>>14		uleshort	<1		\b, reserved sectors %u
>>>>>16		ubyte		>2		\b, FATs %u
#>>>>>16	ubyte		=2		\b, FATs %u (usual)
>>>>>16		ubyte		=1		\b, FAT  %u
>>>>>16		ubyte		>0
>>>>>17		uleshort	>0		\b, root entries %u
#>>>>>17	uleshort	=0		\b, root entries %u=0 (usual Fat32)
>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB) 
#>>>>>19	uleshort	=0		\b, sectors %u=0 (usual Fat32)
>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
>>>>>22		uleshort	>0		\b, sectors/FAT %u
#>>>>>22	uleshort	=0		\b, sectors/FAT %u=0 (usual Fat32)
>>>>>26		ubyte		>2		\b, heads %u
#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
>>>>>26		ubyte		=1		\b, heads %u
>>>>>28		ulelong		>0		\b, hidden sectors %u
#>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
>>>>>32		ulelong		>0		\b, sectors %u (volumes > 32 MB) 
#>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB) 
# FAT<32 specific 
# NOT le FAT3=NOT 3TAF=0xCCABBEB9
>>>>>82		ulelong&0xCCABBEB9	>0
>>>>>>36	ubyte		>0x80		\b, physical drive 0x%x
#>>>>>>36	ubyte		=0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
>>>>>>36	ubyte&0x7F	>0		\b, physical drive 0x%x
#>>>>>>36	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>37	ubyte		>0		\b, reserved 0x%x
#>>>>>>37	ubyte		=0		\b, reserved 0x%x
>>>>>>38	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>38	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>38	ubyte		=0x29
>>>>>>>39	ulelong		x		\b, serial number 0x%x
>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>>43	string		=NO\ NAME	\b, unlabeled
>>>>>>54	string		FAT1		\b, FAT
>>>>>>>54	string		FAT12		\b (12 bit)
>>>>>>>54	string		FAT16		\b (16 bit)
# FAT32 specific
>>>>>82		string		FAT32		\b, FAT (32 bit)
>>>>>>36	ulelong		x		\b, sectors/FAT %u
>>>>>>40	uleshort	>0		\b, extension flags %u
#>>>>>>40	uleshort	=0		\b, extension flags %u
>>>>>>42	uleshort	>0		\b, fsVersion %u
#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
>>>>>>44	ulelong		>2		\b, rootdir cluster %u
#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
>>>>>>48	uleshort	>1		\b, infoSector %u
#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
>>>>>>48	uleshort	<1		\b, infoSector %u
>>>>>>50	uleshort	>6		\b, Backup boot sector %u
#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual) 
>>>>>>50	uleshort	<6		\b, Backup boot sector %u
>>>>>>54	ulelong		>0		\b, reserved1 0x%x
>>>>>>58	ulelong		>0		\b, reserved2 0x%x
>>>>>>62	ulelong		>0		\b, reserved3 0x%x
# same structure as FAT1X 
>>>>>>64	ubyte		>0x80		\b, physical drive 0x%x
#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
>>>>>>64	ubyte&0x7F	>0		\b, physical drive 0x%x
#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>65	ubyte		>0		\b, reserved 0x%x
>>>>>>66	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>66	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>66	ubyte		=0x29
>>>>>>>67	ulelong		x		\b, serial number 0x%x
>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>71	string		=NO\ NAME	\b, unlabeled
### FATs end
>0x200	lelong	0x82564557		\b, BSD disklabel
# FATX 
0		string		FATX		FATX filesystem data


# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410	leshort		0x137f		Minix filesystem
0x410	beshort		0x137f		Minix filesystem (big endian),
>0x402	beshort		!0		\b, %d zones
>0x1e	string		minix		\b, bootable
0x410	leshort		0x138f		Minix filesystem, 30 char names
0x410	leshort		0x2468		Minix filesystem, version 2
0x410	leshort		0x2478		Minix filesystem, version 2, 30 char names

# romfs filesystems - Juan Cespedes <cespedes@debian.org>
0	string		-rom1fs-\0	romfs filesystem, version 1
>8	belong	x			%d bytes,
>16	string	x			named %s.

# netboot image - Juan Cespedes <cespedes@debian.org>
0	lelong		0x1b031336L	Netboot image,
>4	lelong&0xFFFFFF00	0
>>4	lelong&0x100	0x000		mode 2
>>4	lelong&0x100	0x100		mode 3
>4	lelong&0xFFFFFF00	!0	unknown mode

0x18b	string	OS/2	OS/2 Boot Manager

9564	lelong		0x00011954	Unix Fast File system (little-endian),
>8404	string		x		last mounted on %s,
#>9504	ledate		x		last checked at %s,
>8224	ledate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	lelong		x		number of blocks %d,
>8232	lelong		x		number of data blocks %d,
>8236	lelong		x		number of cylinder groups %d,
>8240	lelong		x		block size %d,
>8244	lelong		x		fragment size %d,
>8252	lelong		x		minimum percentage of free blocks %d,
>8256	lelong		x		rotational delay %dms,
>8260	lelong		x		disk rotational speed %drps,
>8320	lelong		0		TIME optimization
>8320	lelong		1		SPACE optimization

9564	belong		0x00011954	Unix Fast File system (big-endian),
>7168   long		0x4c41424c	Apple UFS Volume
>>7186  string		x		named %s,
>>7176  belong		x		volume label version %d,
>>7180  bedate		x		created on %s,
>8404	string		x		last mounted on %s,
#>9504	bedate		x		last checked at %s,
>8224	bedate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	belong		x		number of blocks %d,
>8232	belong		x		number of data blocks %d,
>8236	belong		x		number of cylinder groups %d,
>8240	belong		x		block size %d,
>8244	belong		x		fragment size %d,
>8252	belong		x		minimum percentage of free blocks %d,
>8256	belong		x		rotational delay %dms,
>8260	belong		x		disk rotational speed %drps,
>8320	belong		0		TIME optimization
>8320	belong		1		SPACE optimization

# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
0x438	leshort		0xEF53		Linux
>0x44c	lelong		x		rev %d
>0x43e	leshort		x		\b.%d
>0x45c	lelong		^0x0000004	ext2 filesystem data
>>0x43a	leshort		^0x0000001	(mounted or unclean)
>0x45c	lelong		&0x0000004	ext3 filesystem data
>>0x460	lelong		&0x0000004	(needs journal recovery)
>0x43a	leshort		&0x0000002	(errors)
>0x460	lelong		&0x0000001	(compressed)
#>0x460	lelong		&0x0000002	(filetype)
#>0x464	lelong		&0x0000001	(sparse_super)
>0x464	lelong		&0x0000002	(large files)

# SGI disk labels - Nathan Scott <nathans@debian.org>
0	belong		0x0BE5A941	SGI disk label (volume header)

# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
0	belong		0x58465342	SGI XFS filesystem data
>0x4	belong		x		(blksz %d,
>0x68	beshort		x		inosz %d,
>0x64	beshort		^0x2004		v1 dirs)
>0x64	beshort		&0x2004		v2 dirs)

############################################################################
# Minix-ST kernel floppy
0x800	belong		0x46fc2700	Atari-ST Minix kernel image
>19	string		\240\5\371\5\0\011\0\2\0	\b, 720k floppy
>19	string		\320\2\370\5\0\011\0\1\0	\b, 360k floppy

############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
19	string		\320\2\360\3\0\011\0\1\0	DOS floppy 360k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\240\5\371\3\0\011\0\2\0	DOS floppy 720k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector

19	string		\240\5\371\5\0\011\0\2\0	DOS floppy 720k, IBM
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\100\013\371\5\0\011\0\2\0	DOS floppy 1440k, mkdosfs
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector

19	string		\320\2\370\5\0\011\0\1\0	Atari-ST floppy 360k
19	string		\240\5\371\5\0\011\0\2\0	Atari-ST floppy 720k

#  Valid media descriptor bytes for MS-DOS:
#
#     Byte   Capacity   Media Size and Type
#     -------------------------------------------------
#
#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
#     F9     720K       3.5-inch, 2-sided, 9-sector
#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
#     FD     360K       5.25-inch, 2-sided, 9-sector
#     FF     320K       5.25-inch, 2-sided, 8-sector
#     FC     180K       5.25-inch, 1-sided, 9-sector
#     FE     160K       5.25-inch, 1-sided, 8-sector
#     FE     250K       8-inch, 1-sided, single-density
#     FD     500K       8-inch, 2-sided, single-density
#     FE     1.2 MB     8-inch, 2-sided, double-density
#     F8     -----      Fixed disk 
#
#     FC     xxxK       Apricot 70x1x9 boot disk.
#
# Originally a bitmap:
#  xxxxxxx0	Not two sided
#  xxxxxxx1	Double sided
#  xxxxxx0x	Not 8 SPT
#  xxxxxx1x	8 SPT
#  xxxxx0xx	Not Removable drive
#  xxxxx1xx	Removable drive
#  11111xxx	Must be one.
#
# But now it's rather random:
#  111111xx	Low density disk
#        00	SS, Not 8 SPT
#        01	DS, Not 8 SPT
#        10	SS, 8 SPT
#        11	DS, 8 SPT
#
#  11111001	Double density 3½ floppy disk, high density 5¼
#  11110000	High density 3½ floppy disk
#  11111000	Hard disk any format
#

# CDROM Filesystems
32769    string    CD001     ISO 9660 CD-ROM filesystem data
# "application id" which appears to be used as a volume label
>32808	 string    >\0       '%s'
>34816	 string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
37633    string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
32776    string    CDROM     High Sierra CD-ROM filesystem data

# cramfs filesystem - russell@coker.com.au
0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
>4      lelong  x size %d
>8      lelong  &1 version #2
>8      lelong  &2 sorted_dirs
>8      lelong  &4 hole_support
>32     lelong  x CRC 0x%x,
>36     lelong  x edition %d,
>40     lelong  x %d blocks,
>44     lelong  x %d files

0       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
>4      belong  x size %d
>8      belong  &1 version #2
>8      belong  &2 sorted_dirs
>8      belong  &4 hole_support
>32     belong  x CRC 0x%x,
>36     belong  x edition %d,
>40     belong  x %d blocks,
>44     belong  x %d files

# reiserfs - russell@coker.com.au
0x10034		string	ReIsErFs	ReiserFS V3.5
0x10034		string	ReIsEr2Fs	ReiserFS V3.6
>0x1002c 	leshort	x		block size %d
>0x10032	leshort	&2		(mounted or unclean)
>0x10000	lelong	x		num blocks %d
>0x10040	lelong	1		tea hash
>0x10040	lelong	2		yura hash
>0x10040	lelong	3		r5 hash

# JFFS - russell@coker.com.au
0	lelong	0x34383931	Linux Journalled Flash File system, little endian
0	belong	0x34383931	Linux Journalled Flash File system, big endian

# EST flat binary format (which isn't, but anyway)
# From: Mark Brown <broonie@sirena.org.uk>
0	string	ESTFBINR	EST flat binary

# Aculab VoIP firmware
# From: Mark Brown <broonie@sirena.org.uk>
0	string	VoIP\ Startup\ and	Aculab VoIP firmware
>35	string	x	format %s

# PPCBoot image file
# From: Mark Brown <broonie@sirena.org.uk>
0	belong	0x27051956	PPCBoot image
>4	string  PPCBoot
>>12	string  x		version %s

# JFFS2 file system
0       leshort         0x1984                  Linux old jffs2 filesystem data little endian
0       lelong          0xe0011985              Linux jffs2 filesystem data little endian