[File] Magic for h2test, f3 USB test data *.h2w

[Jörg Jenderek]

Hello,

some times ago i use software h2testw to test some USB sticks for
faked capacity. This software writes and reads test data with file
name extension h2w starting with file 1.h2w and then incrementing the
number part.

When running running file command version 5.40 on such examples and
related files i get an output like:

1.h2w:        data
2.h2w:        data
2x1b&w.tga:   Targa image data - RGB 2 x 1 x 24
60.h2w:       data
FLOPPY95.ico: MS Windows icon resource - 10 icons, 256x256 with\040
	      PNG image data, 256 x 256, 8-bit/color RGBA,
	      non-interlaced, 24 bits/pixel, 48x48, 16 colors,
	      4 bits/pixel
plpbt.iso:    ISO 9660 CD-ROM filesystem data
	      'Plop Boot Manager 5.0.14' (bootable)

The H2W samples are described as "data".
The original Windows software can be found for example at
https://www.heise.de/download/product/h2testw-50539
Luckily the Unix software package f3 (Fight Flash Fraud; f3write
f3read, etc.) also use this file format.

When the test data are written the data files can be read again to
test integrity of storage device again and again. If you are
satisfied with test scenario you can delete this files. So i mention
this fact in remark note line. Because some times i test devices for
other people and forget to delete h2w files and then the other person
probably do not know that this files can be removed to gain more free
space on inspected storage device.

For comparison reason i run the file format identification utility
TrID ( See https://mark0.net/soft-trid-e.html). This recognizes all
samples as "h2testw test data" by definition h2w.trid.xml. By that
definitions all H2W samples are described (See appended
h2w-trid-v.txt.gz ). It also displays related URL and file name
extension h2w.

So i use the web site of the f3 software and the TrID definition as
reference by lines like:

# URL:		http://oss.digirati.com.br/f3/
# Reference:	http://mark0.net/download/triddefs_xml.7z
#		defs/h/h2w.trid.xml

The patterns used by TrID definition becomes in magic translation to
lines like:

0	short		0
 >8	ubeshort	0x1100	h2testw/f3 test data
#>>16	ubeshort	0x1001	\b, 3RD TEST
#>>24	ubeshort	0x0110	\b, 4th TEST
#>>32	ubeshort	0x20F0	\b, 5th TEST
!:mime	application/x-h2w
!:ext	h2w

Instead of generic mime type "application/octet-stream" i use a user
defined "application/x-h2w".
The first test for nils is too unspecific. This is also true for all
MS Windows icon resource like FLOPPY95.ico handled by Magdir/msdos.
It is also true for many ISO 9660 CD-ROM filesystem data like
plpbt.iso handled by Magdir/filesystems. It is also true for many
Targa image data like 2x1b&w.tga handled by Magdir/images.

With the second test line these misidentification vanish and
recognition was unique for my examples. If this is not true i add
more possible 3 test lines as comment lines.

After applying the above mentioned modifications by h2w.txt
then all my H2W samples and other files are now described like:

1.h2w:        h2testw/f3 test data
2.h2w:        h2testw/f3 test data
2x1b&w.tga:   Targa image data - RGB 2 x 1 x 24
60.h2w:       h2testw/f3 test data
FLOPPY95.ico: MS Windows icon resource - 10 icons, 256x256 with\040
	      PNG image data, 256 x 256, 8-bit/color RGBA,
	      non-interlaced, 24 bits/pixel, 48x48, 16 colors,
	      4 bits/pixel
plpbt.iso:    ISO 9660 CD-ROM filesystem data
	      'Plop Boot Manager 5.0.14' (bootable)

I hope my magic file can be applied in future version of file utility.

With best wishes
Jörg Jenderek
--
Jörg Jenderek



-------------- next part --------------
#
# From:		Joerg Jenderek
# URL:		http://oss.digirati.com.br/f3/
#		https://fight-flash-fraud.readthedocs.io/en/latest/usage.html
# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/h/h2w.trid.xml
# Note:		generated by h2testw.exe and f3write. Can be deleted after test
0	short		0
# skip all MS Windows icon resource like FLOPPY95.ico handled by ./msdos ,
# many ISO 9660 CD-ROM filesystem data like plpbt.iso handled by ./filesystems
# and many Targa image data like 2x1b&w.tga handled by ./images
>8	ubeshort	0x1100	h2testw/f3 test data
#>>16	ubeshort	0x1001	\b, 3RD TEST
#>>24	ubeshort	0x0110	\b, 4th TEST
#>>32	ubeshort	0x20F0	\b, 5th TEST
#!:mime	application/octet-stream
!:mime	application/x-h2w
# like: 1.h2w, 2.h2w ...
!:ext	h2w

-------------- next part --------------
A non-text attachment was scrubbed...
Name: h2w.txt.sig
Type: application/octet-stream
Size: 630 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20210706/f072015d/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: h2w-trid-v.txt.gz
Type: application/x-gzip
Size: 1453 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20210706/f072015d/attachment.bin>