How to identify/determine linux filesystem type by reading raw disk?

How to identify/determine linux filesystem type by reading raw disk?

Post by zeo » Sat, 20 Aug 2005 15:14:31


How to identify/determine linux filesystem type by reading raw disk?
I am writing a program that needs the ability that identifies the type
of the filesystem installed on a disk by reading the sectors of that
disk (that is, reading raw mode).
My program runs on MS Windows and MS-DOS.

NTFS and FAT can be identified simply reading partition type ID on the
partition table. But I've heared that almost all filesystems for linux
shares the same partition type ID - which is 0x83. So, there must be
some methods that enables a program to identify the type of the
filesystem.
I've searched Google, only found that saying "use 'file' program.".
I want to know the inner workings of 'file' program.
But I failed to get the source code of the program. (Yes, I am almost
totally new to linux.) And there was no documentation for the

Any help will be appreciated.
Thanks in advance.
 
 
 

How to identify/determine linux filesystem type by reading raw disk?

Post by Kasper Dup » Sat, 20 Aug 2005 16:20:38


Most partition types Linux doesn't care about. So even though
there are about 20 different partition types for FAT, 4 for
NTFS and 2 for Linux, the kernel will in fact consider them to
be all the same. You could put any file system on almost any
type of partition, so the reliable way would be to look what
is inside the partition and not on the partition type. There
are some file systems which store their super blocks in
different locations, which means the contents could actually
be seen as valid with different types of file systems.


It reads the text file /usr/share/file/magic which contains
descriptions of a lot of formats. Each of those will tell
which location in the file to look at and which byte values
to look for.


I don't know where to find the "official" file sources.
But the one used by Fedora Core can be downloaded from here:
http://www.yqcomputer.com/

--
Kasper Dupont
Note to self: Don't try to allocate
256000 pages with GFP_KERNEL on x86.

 
 
 

How to identify/determine linux filesystem type by reading raw disk?

Post by Nils O. Se » Sat, 20 Aug 2005 17:44:35


Which btw is why you must often specifie -t fstype to mount..
 
 
 

How to identify/determine linux filesystem type by reading raw disk?

Post by Roger Leig » Sun, 21 Aug 2005 05:50:05

XXXX@XXXXX.COM writes:


$ sudo file -s /dev/mapper/hda_vg-sarge_chroot
/dev/mapper/hda_vg-sarge_chroot: Linux rev 1.0 ext3 filesystem data
(needs journal recovery)

$ sudo file -s /dev/ide/host0/bus0/target0/lun0/part4
/dev/ide/host0/bus0/target0/lun0/part4: Macintosh HFS Extended version 4 data last mounted by: 'HFSJ', created: Wed Mar 16 16:42:14 2005, last modified: Fri Aug 19 19:51:18 2005, last checked: Thu Mar 17 00:42:14 2005, block size: 4096, number of blocks: 5210102, free blocks: 1022721


man 5 magic

# ext2/ext3 filesystems - Andreas Dilger < XXXX@XXXXX.COM >
0x438 leshort 0xEF53 Linux
#>0x460 lelong &0x0000002 (filetype)
#>0x464 lelong &0x0000001 (sparse_super)

# Macintosh filesystem data
# From "Tom N Harris" < XXXX@XXXXX.COM >
# Fixed HFS+ and Partition map magic: Ethan Benson < XXXX@XXXXX.COM >
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.

0x400 beshort 0xD2D7 Macintosh MFS data

# "BD" is has many false positives
#0x400 beshort 0x4244 Macintosh HFS data
#>0 beshort 0x4C4B (bootable)
#>0x40a beshort &0x8000 (locked)
#>0x40a beshort ^0x0100 (mounted)
#>0x40a beshort &0x0200 (spared blocks)
#>0x40a beshort &0x0800 (unclean)
#>0x47C beshort 0x482B (Embedded HFS+ Volume)
#>0x402 beldate-0x7C25B080 x created: %s,
#>0x406 beldate-0x7C25B080 x last modified: %s,
#>0x440 beldate-0x7C25B080 >0 last backup: %s,
#>0x414 belong x block size: %d,
#>0x412 beshort x number of blocks: %d,
#>0x424 pstring x volume name: %s


--
Roger Leigh
Printing on GNU/Linux? http://gimp-print.sourceforge.net/
Debian GNU/Linux http://www.debian.org/
GPG Public Key: 0x25BFB848. Please sign and encrypt your mail.