0

The question is how to recognize what is the file system type that resides on a device (LUN) when I can't mount the device, but I can access(read) to any LBA on the device.

I'm looking for something like: NTFS keeps it's file system type on LBA number X, ext3 keeps it's file system type on LBA number Y.

The main FS that I'm wondering about are: NTFS, ext3, ext4 and VMFS.

The environment is a linux box that can access blocks from the device using dd commands.

Thanks for the help.

Elia
  • 193
  • 1
  • 3
  • 11

2 Answers2

1

I can't directly give you the info you need, but the file utility can:

e.g.: 

$ file -s /dev/sda*
/dev/sda:  x86 boot sector; partition 1: ID=0x83, s.......
/dev/sda1: Linux rev 1.0 ext4 filesystem data, UUID=3e.....
/dev/sda2: x86 boot sector; partition 1: ID=0x8e, ......
/dev/sda3: x86 boot sector, code offset 0x52, OEM-ID "NTFS    .....
/dev/sda4: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ....
/dev/sda5: LVM2 PV (Linux Logical Volume Manager), .....

That means you might be able to find the clues in the source code for file/libmagic, or for C/C++ code, you can use libmagic(part of the file tool) to extract the same info.

nos
  • 223,662
  • 58
  • 417
  • 506
0

This is a bit tricky since the volume on the device might not start at sector 0 (usually LBA 0 through 511). The thing is you have to first recognize the structure which has the layout of the drive like a type of Master Boot Record (http://en.wikipedia.org/wiki/Master_boot_record) or GUID Partition Table (http://en.wikipedia.org/wiki/GUID_Partition_Table). Some MBR structures hold a partition type identifier (http://en.wikipedia.org/wiki/Partition_type). GPT has a GUID that identifies the file system stored on a partition.

If the partition identifier is unavailable in such a structure you have to look either for markers of a boot sector or somehow recognize the start of the volume. Typically the first sector of the volume contains the boot record structure. For example, NTFS has a field in it's boot record called OEM ID at offset 0x03 which hold the characters "NTFS" as ASCII (http://www.ntfs.com/ntfs-partition-boot-sector.htm).

Sebastian-Laurenţiu Plesciuc
  • 2,413
  • 1
  • 24
  • 41