[File] [PATCH] Magdir/filesystems for 16 byte volume name of ext2 + *.img
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Sat Apr 11 22:54:04 UTC 2020
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello,
some days ago i run file command version 5.38 on ext2/ext3/ext4
filesystems and saved start sectors of such filesystems. When i run
file with --keep-going and -m Magdir/filesystems i get output like:
ext2-revision0-3MB.ext2: Linux rev 0.0 ext2 filesystem data,
UUID=767cc322-ac54-4bc7-81a8-
224f30538398,
volume name "EXT_media_ext2_"
MiSd32GBhama-ext4-sdb2.bin: Linux rev 1.0 ext4 filesystem data,
UUID=c2f90193-e8cc-48bf-9d4a-
bbcef4cbcd80,
volume name "9_32GB_SDp2_ext4/mnt
/media_rw
/c2f90193-e8cc-48bf-9d4a-bbcef4cbcd80"
(extents) (large files) (huge files)
sda4-ext4.bin: Linux rev 1.0 ext4 filesystem data,
UUID=71cb4e67-c07f-4a82-9bc9-
56c1128c5b71,
volume name "suse-13.2-ako"
(needs journal recovery)
(extents) (large files) (huge files)
vu-ext3.bin: Linux rev 1.0 ext3 filesystem data,
UUID=dd6d2e5d-0a97-4364-8c88-
307a5dfee63f,
volume name "HGST-VU-ultimo4k/media/hdd"
(needs journal recovery) (large files)
Apparently for partition images with "short" volume names like
"EXT_media_ext2_" like in example ext2-revision0-3MB.ext2
displaying is OK, but for examples with 16 byte volume name like
"HGST-VU-ultimo4k" in example vu-ext3.bin obviously the mount point
directory like "/media/hdd" is appended to volume name.
Further more with -i option only generic mime type
"application/octet-stream" is shown and with --extension option
only ??? is displayed.
Some information about the Linux Extended file system is found on
Wikipedia. So i add to Magdir/filesystems a comment line like:
# URL: https://en.wikipedia.org/wiki/Extended_file_system
More exact information can be seen in c-header file ext2_fs.h used
for example in e2fsprogs tool collection found at sourceforge. This
is expressed by reference lines like
# Reference: https://sourceforge.net/projects/e2fsprogs/
# files/e2fsprogs/
# v1.45.6/e2fsprogs-1.45.6.tar.gz/
# e2fsprogs-1.45.6/lib/ext2fs/ext2_fs.h
In current Magdir/filesystems the volume name is shown by line
>0x478 string >0 \b, volume name "%s"
According to header file at that position file system name is
stored as field s_volume_name[EXT2_LABEL_LEN], where EXT2_LABEL_LEN
value is 16. That field is followed by last mounted directory name
stored as s_last_mounted[64]. So if volume name is shorter than 16
bytes volume name is right padded with null bytes and output looks
OK. But for 16 byte sized volume names there is no null appended
and right afterwards mount directory name follows. So i correct
this and also shown last mounted directory. This now becomes:
>0x478 string >0 \b, volume name "%.16s"
>0x488 string >\0 \b, last mounted "%.64s"
Disk utilities like SUSE Image writer and Gnome disk utility use
specific mime type for disc images. That is now expressed by
additional line:
!:mime application/x-raw-disk-image
These utilities use "img" as file name extension. That extension is
also used for raw disc images with other file system types. So
apparently according to web sites like filesuffix.com and
dotwhat.net also special extensions like ext4 is used to emphasise
specific Linux file system type. This is now expressed by
additional lines like:
!:ext ext4/img
After applying the above mentioned modifications by patch
file-5.38-filesystems-ext.diff then all ext filesystem/images
with "long" names are now described correctly and also last mount
point is shown like:
ext2-revision0-3MB.ext2: Linux rev 0.0 ext2 filesystem data,
UUID=767cc322-ac54-4bc7-81a8-
224f30538398,
volume name "EXT_media_ext2_",
last mounted "/media/ext2"
MiSd32GBhama-ext4-sdb2.bin: Linux rev 1.0 ext4 filesystem data,
UUID=c2f90193-e8cc-48bf-
9d4a-bbcef4cbcd80,
volume name "9_32GB_SDp2_ext4",
last mounted "/mnt/media_rw/
c2f90193-e8cc-48bf-9d4a-bbcef4cbcd80"
(extents) (large files) (huge files)
sda4-ext4.bin: Linux rev 1.0 ext4 filesystem data,
UUID=71cb4e67-c07f-4a82-9bc9-
56c1128c5b71,
volume name "suse-13.2-ako",
last mounted "/"
(needs journal recovery)
(extents) (large files) (huge files)
vu-ext3.bin: Linux rev 1.0 ext3 filesystem data,
UUID=dd6d2e5d-0a97-4364-8c88-
307a5dfee63f,
volume name "HGST-VU-ultimo4k",
last mounted "/media/hdd"
(needs journal recovery)
(large files)
I hope my diff file can be applied in future version of file utility.
With best wishes
Jörg Jenderek
- --
Jörg Jenderek
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXpJKjAAKCRCv8rHJQhrU
1pmDAJ4r7+w+uYDZj9lSeTK/dOR5RROmRACeIeUGA6yi0fsTDDW+vHtNwEEGAdg=
=oIo8
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.38/magic/Magdir/filesystems.old 2019-11-15 23:49:38 +0000
+++ file-5.38/magic/Magdir/filesystems 2020-04-11 21:31:33 +0000
@@ -1713,4 +1713,8 @@
# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
+# URL: https://en.wikipedia.org/wiki/Extended_file_system
+# Reference: https://sourceforge.net/projects/e2fsprogs/files/e2fsprogs/
+# v1.45.6/e2fsprogs-1.45.6.tar.gz/e2fsprogs-1.45.6/lib/ext2fs/ext2_fs.h
0x438 leshort 0xEF53 Linux
>0x44c lelong x rev %d
+!:mime application/x-raw-disk-image
>0x43e leshort x \b.%d
@@ -1718,2 +1722,4 @@
>0x45c lelong ^0x0000004 ext2 filesystem data
+# https://www.filesuffix.com/en/extension/ext2
+!:ext ext2/img
>>0x43a leshort ^0x0000001 (mounted or unclean)
@@ -1725,6 +1731,10 @@
>>>0x464 lelong <0x0000008 ext3 filesystem data
+# http://dotwhat.net/file/extension/ext3/3354
+!:ext ext3/img
# else large RO_COMPAT?
>>>0x464 lelong >0x0000007 ext4 filesystem data
+!:ext ext4/img
# else large INCOMPAT?
>>0x460 lelong >0x000003f ext4 filesystem data
+!:ext ext4/img
>0x468 belong x \b, UUID=%08x
@@ -1735,3 +1745,6 @@
>0x476 beshort x \b%04x
->0x478 string >0 \b, volume name "%s"
+# file system name s_volume_name[EXT2_LABEL_LEN] like 9_32GB_SDp2_ext4
+>0x478 string >0 \b, volume name "%.16s"
+# last mounted directory name s_last_mounted[64]
+>0x488 string >\0 \b, last mounted "%.64s"
# General flags for any ext* fs
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.38-filesystems-ext.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20200412/b53b87a6/attachment.obj>
More information about the File
mailing list