On Tue, May 14, 2013 at 12:03:16PM +0100, Richard W.M. Jones wrote:
> ReFS is Microsoft's new filesystem used in Windows 2012 Server and
> above. There's no support for this in Linux (although I'm hoping to
> change that) but it'd be nice if blkid could at least recognize it.
>
> So I thought you might be interested in the filesystem signature for
> ReFS, which appears to be in the first 8 bytes:
It seems like NTFS where is
struct ntfs_super_block {
uint8_t jump[3];
uint8_t oem_id[8]; /* magic string */
and the magic string is "NTFS ".
> 00000000 00 00 00 52 65 46 53 00 00 00 00 00 00 00 00 00 |...ReFS.........|
> 00000010 46 53 52 53 00 02 c8 6b 00 00 4e 01 00 00 00 00 |FSRS...k..N.....|
> 00000020 00 02 00 00 80 00 00 00 01 01 00 00 00 00 00 00 |................|
> 00000030 00 00 00 00 00 00 00 00 95 0a d9 2c 1b d9 2c 02 |...........,..,.|
> 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
>
> There is nothing else that looks even vaguely like a superblock within
> the first few megabytes, so I'd go with those first 8 bytes for now.
The question is where is UUID and LABEL :-)
BTW, I found:
http://www.williballenthin.com/forensics/refs/
Karel
--
Karel Zak <kzak@xxxxxxxxxx>
http://karelzak.blogspot.com
--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
