1

I'm having an odd time trying to get the volume label of a disk image in C. I understand that for FAT12 disks this piece of information is located at offset 0x2b or 43 in decimal and is 11 bytes in length. Anyway here is my code right now:

void main(int argc, char *argv[]) {
    ...
    FILE *fp = fopen(argv[1], "rb");
    printf("Volume Label: %s\n", seekData(fp, 43, 11));
    ...
}

unsigned char* seekData(FILE *fp, int offset, int bytes) {
    unsigned char* buff = malloc(sizeof(unsigned char)*bytes);
    fseek(fp, offset, SEEK_SET);
    fread(buff, 1, bytes, fp);
    rewind(fp);
    return buff;
}

For any input file I use (.IMA) I keep getting back 20 20 20 20 20 20 20 20 20 20 20 in hex. Or just Volume Label:(nothing here) when the above code is run. Am I missing something super obvious here? Any help would be appreciated

JFord
  • 126
  • 1
  • 9
  • 3
    Is this a partitioned device like a hard drive? In which case the Boot Sector comes after the MBR. You may have to read the MBR to figure out where the FAT12 partition starts. Also, are you sure the disk has a label? – Schwern Nov 20 '16 at 01:32
  • I have no idea of its quality, but this might help. http://www.dailyfreecode.com/code/file-allocation-table-2866.aspx – Schwern Nov 20 '16 at 01:46
  • 1
    Rather than starting with C code, start with a hex editor. Figure out where the volume label *really* is, then go from there. – John Zwinck Nov 20 '16 at 01:48
  • 2
    buff contains 11 bytes, and is NOT null terminated, which your printf() expects... change your printf to: printf("Volume Label: %.11s\n", seekData(fp, 43, 11)); – TonyB Nov 20 '16 at 06:56
  • @Schwern I am running this code on a IMA file that I created with WinImage. Also, when I run the code for finding the OEM (Offset 3) or the File System Type (Offset 54). I get those values correctly. The former output `MSDOS5.0` and the latter `FAT12`. At this point I'm thinking its probably something wrong with my input file but I have put a label on it. Unless the label option is different than Volume Label in WinImage I'm still confused why its not showing up. Using xxd it is showing the label with the names of the other files in the root directory. – JFord Nov 20 '16 at 22:45
  • 1) never access anything beyond `argv[0]` without first checking `argc` to assure the command line parameter actually exists. 2) when calling `fopen()`, always check (!=NULL) the returned value to assure the operation was successful. – user3629249 Nov 21 '16 at 02:07

1 Answers1

1

So I have found the problem. It seems volume label isn't stored at the previously mentioned location anymore and is usually located in the root directory as a special file.

Source: http://www.ntfs.com/fat-partition-sector.htm

"Volume Label. This field was used to store the volume label, but the volume label is now stored as special file in the root directory."

JFord
  • 126
  • 1
  • 9