# ====================== file Systems ======================

# Squashfs - original code from file magic db
0	string	sqsh	Squashfs filesystem, big endian,
!:mime filesystem/squashfs
>28	beshort	x	version %d.
>30	beshort x	\b%d,
>28	beshort <3
>>8	belong	x	%d bytes,
>28	beshort >2
>>28 beshort <4
>>>63	bequad x	%lld bytes,
>>28 beshort >3
>>>40	bequad x	%lld bytes,
#>>67	belong	x	%d bytes,
>4	belong	x	%d inodes,
>28	beshort <2
>>32	beshort	x	blocksize: %d bytes,
>28	beshort >1
>>28 beshort <4
>>>51	belong	x	blocksize: %d bytes,
>>28 beshort >3
>>>12	belong	x	blocksize: %d bytes,
>28 beshort <4
>>39	bedate	x	created: %s
>28 beshort >3
>>8	bedate	x	created: %s
0	string	hsqs	Squashfs filesystem, little endian,
!:mime filesystem/squashfs
>28	leshort	x	version %d.
>30	leshort	x	\b%d,
>28	leshort <3
>>8	lelong	x	%d bytes,
>28	leshort >2
>>28 leshort <4
>>>63	lequad x	%lld bytes,
>>28 leshort >3
>>>40	lequad x	%lld bytes,
#>>63	lelong	x	%d bytes,
>4	lelong	x	%d inodes,
>28	leshort <2
>>32	leshort	x	blocksize: %d bytes,
>28	leshort >1
>>28 leshort <4
>>>51	lelong	x	blocksize: %d bytes,
>>28 leshort >3
>>>12	lelong	x	blocksize: %d bytes,
>28 leshort <4
>>39	ledate	x	created: %s
>28 leshort >3
>>8	ledate	x	created: %s

0	string	qshs	Squashfs filesystem
!:mime filesystem/squashfs

0	string	shsq	Squashfs filesystem
!:mime filesystem/squashfs

## AVM Squashfs Fake
0	string sqsh\x00\x00\x00\x00\x00\x00		AVM SquashFs Fake
!:mime filesystem/avm-sqfs-fake


# cramfs filesystem - original code from file magic db
0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
!:mime filesystem/cramfs
>4      lelong  x size %u
>8      lelong  &1 version #2
>8      lelong  &2 sorted_dirs
>8      lelong  &4 hole_support
>32     lelong  x CRC 0x%x,
>36     lelong  x edition %u,
>40     lelong  x %u blocks,
>44     lelong  x %u files
0       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
!:mime filesystem/cramfs
>4      belong  x size %u
>8      belong  &1 version #2
>8      belong  &2 sorted_dirs
>8      belong  &4 hole_support
>32     belong  x CRC 0x%x,
>36     belong  x edition %u,
>40     belong  x %u blocks,
>44     belong  x %u files


# romfs - original code from file magic db
0	string		-rom1fs-	romfs filesystem, version 1
!:mime filesystem/romfs
>8	belong	x			%d bytes,
>16	string	x			named %s.

# Russell Coker <russell@coker.com.au>
0x10040		string	_BHRfS_M	BTRFS Filesystem
!:mime filesystem/btrfs
>0x1012b	string	>\0		label "%s",
>0x10090	lelong	x		sectorsize %d,
>0x10094	lelong	x		nodesize %d,
>0x10098	lelong	x		leafsize %d,
>0x10020	belong	x		UUID=%08x-
>0x10024	beshort	x		\b%04x-
>0x10026	beshort	x		\b%04x-
>0x10028	beshort	x		\b%04x-
>0x1002a	beshort	x		\b%04x
>0x1002c	belong	x		\b%08x,
>0x10078	lequad	x		%lld/
>0x10070	lequad	x		\b%lld bytes used,
>0x10088	lequad	x		%lld devices

# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
0x438   leshort         0xEF53          Linux
>0x44c  lelong          x               rev %d
>0x43e  leshort         x               \b.%d
# No journal?  ext2
>0x45c  lelong          ^0x0000004      ext2 filesystem data
!:mime filesystem/ext2
>>0x43a leshort         ^0x0000001      (mounted or unclean)
# Has a journal?  ext3 or ext4
>0x45c  lelong          &0x0000004
#  and small INCOMPAT?
>>0x460 lelong          <0x0000040
#   and small RO_COMPAT?
>>>0x464 lelong         <0x0000008      ext3 filesystem data
!:mime filesystem/ext3
#   else large RO_COMPAT?
>>>0x464 lelong         >0x0000007      ext4 filesystem data
!:mime filesystem/ext4
#  else large INCOMPAT?
>>0x460	lelong          >0x000003f      ext4 filesystem data
!:mime filesystem/ext4
>0x468	belong		x		\b, UUID=%08x
>0x46c	beshort		x		\b-%04x
>0x46e	beshort		x		\b-%04x
>0x470	beshort		x		\b-%04x
>0x472	belong		x		\b-%08x
>0x476	beshort		x		\b%04x
>0x478	string		>0		\b, volume name "%s"
# General flags for any ext* fs
>0x460	lelong          &0x0000004      (needs journal recovery)
>0x43a	leshort         &0x0000002      (errors)
# INCOMPAT flags
>0x460	lelong          &0x0000001      (compressed)
#>0x460	lelong          &0x0000002      (filetype)
#>0x460	lelong          &0x0000010      (meta bg)
>0x460	lelong          &0x0000040      (extents)
>0x460	lelong          &0x0000080      (64bit)
#>0x460	lelong          &0x0000100      (mmp)
#>0x460	lelong          &0x0000200      (flex bg)
# RO_INCOMPAT flags
#>0x464	lelong          &0x0000001      (sparse super)
>0x464	lelong          &0x0000002      (large files)
>0x464	lelong          &0x0000008      (huge files)
#>0x464	lelong          &0x0000010      (gdt checksum)
#>0x464	lelong          &0x0000020      (many subdirs)
#>0x463	lelong          &0x0000040      (extra isize)

# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410	leshort		0x137f
!:strength / 2
>0x402	beshort		< 100
>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
!:mime filesystem/minix
>0x1e	string		minix		\b, bootable
0x410	beshort		0x137f
!:strength / 2
>0x402	beshort		< 100
>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
!:mime filesystem/minix
>0x1e	string		minix		\b, bootable
0x410	leshort		0x138f
!:strength / 2
>0x402	beshort		< 100
>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
!:mime filesystem/minix
>0x1e	string		minix		\b, bootable
0x410	beshort		0x138f
!:strength / 2
>0x402	beshort		< 100
>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
!:mime filesystem/minix
>0x1e	string		minix		\b, bootable
!:mime filesystem/minix

# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# "BD" gives many false positives
0x400	beshort			0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
# first block of volume bit map (always 3)
>0x40e	ubeshort		0x0003
# maximal length of volume name is 27
>>0x424		ubyte			<28	Macintosh HFS data
!:mime	filesystem/hfs
>>>0		beshort			0x4C4B	(bootable)
#>>>0		beshort			0x0000	(not bootable)
>>>0x40a	beshort			&0x8000	(locked)
>>>0x40a	beshort			^0x0100	(mounted)
>>>0x40a	beshort			&0x0200	(spared blocks)
>>>0x40a	beshort			&0x0800	(unclean)
>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
>>>0x414	belong			x	block size: %d,
>>>0x412	beshort			x	number of blocks: %d,
>>>0x424	pstring			x	volume name: %s

0x400	beshort			0x482B		Macintosh HFS Extended
!:mime	filesystem/hfs
>&0	beshort			x		version %d data
>0	beshort			0x4C4B		(bootable)
>0x404	belong			^0x00000100	(mounted)
>&2	belong			&0x00000200	(spared blocks)
>&2	belong			&0x00000800	(unclean)
>&2	belong			&0x00008000	(locked)
>&6	string			x		last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&14	beldate-0x7C25B080	x		created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
>&18	bedate-0x7C25B080	x		last modified: %s,
>&22	bedate-0x7C25B080	>0		last backup: %s,
>&26	bedate-0x7C25B080	>0		last checked: %s,
>&38	belong			x		block size: %d,
>&42	belong			x		number of blocks: %d,
>&46	belong			x		free blocks: %d

# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
0x8000	string	JFS1	JFS filesystem image
!:mime filesystem/jfs
# Because it's text-only magic, check a binary value (version) to be sure.
# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
# mountable.
>&0	lelong	<3	JFS2 filesystem image
!:mime filesystem/jfs2
# Label is followed by a UUID; we have to limit string length to avoid
# appending the UUID in the case of a 16-byte label.
>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
>>&0	lequad	x	\b, %lld blocks
>>&8	lelong	x	\b, blocksize %d
>>&32	lelong&0x00000006	>0	(dirty)
>>&36	lelong	>0	(compressed)

# ISO 9660 CD-ROM
0	name				cdrom
>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
!:mime	application/x-iso9660-image
>38913	string    NSR0      UDF filesystem data
!:mime	filesystem/udf
>>38917	string    1         (version 1.0)
>>38917	string    2         (version 1.5)
>>38917	string    3         (version 2.0)
>>38917	byte     >0x33      (unknown version, ID 0x%X)
>>38917	byte     <0x31      (unknown version, ID 0x%X)
>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
# "application id" which appears to be used as a volume label
>32808	string/T  >\0       '%s'
>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
37633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime	application/x-iso9660-image
32777	string    CDROM     High Sierra CD-ROM filesystem data
0x8801	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime	application/x-iso9660-image
0x8801	string    NSR0     UDF filesystem data
!:mime	filesystem/udf

# reiserfs - russell@coker.com.au
0x10034		string	ReIsErFs	ReiserFS V3.5
!:mime	filesystem/reiserfs
0x10034		string	ReIsEr2Fs	ReiserFS V3.6
!:mime	filesystem/reiserfs
0x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
!:mime	filesystem/reiserfs
>0x1002c 	leshort	x		block size %d
>0x10032	leshort	&2		(mounted or unclean)
>0x10000	lelong	x		num blocks %d
>0x10040	lelong	1		tea hash
>0x10040	lelong	2		yura hash
>0x10040	lelong	3		r5 hash

# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
0	belong		0x58465342	SGI XFS filesystem data
!:mime	filesystem/xfs
>0x4	belong		x		(blksz %d,
>0x68	beshort		x		inosz %d,
>0x64	beshort		^0x2004		v1 dirs)
>0x64	beshort		&0x2004		v2 dirs)


# FAT and NTFS magic
0x36      string   FAT          FAT filesystem
!:mime  filesystem/fat

0x3      string   NTFS          NTFS filesystem
!:mime  filesystem/ntfs

# DOS/MBR signifier (55AA)
0x1FE      string   \x55\xAA     DOS boot sector
!:mime filesystem/dosmbr


9564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
!:mime	filesystem/ffs
>8404	string		x		last mounted on %s,
#>9504	ledate		x		last checked at %s,
>8224	ledate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	lelong		x		number of blocks %d,
>8232	lelong		x		number of data blocks %d,
>8236	lelong		x		number of cylinder groups %d,
>8240	lelong		x		block size %d,
>8244	lelong		x		fragment size %d,
>8252	lelong		x		minimum percentage of free blocks %d,
>8256	lelong		x		rotational delay %dms,
>8260	lelong		x		disk rotational speed %drps,
>8320	lelong		0		TIME optimization
>8320	lelong		1		SPACE optimization

42332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
!:mime	filesystem/ffs
>&-1164	string		x		last mounted on %s,
>&-696	string		>\0		volume name %s,
>&-304	leqldate	x		last written at %s,
>&-1167	byte		x		clean flag %d,
>&-1168	byte		x		readonly flag %d,
>&-296	lequad		x		number of blocks %lld,
>&-288	lequad		x		number of data blocks %lld,
>&-1332	lelong		x		number of cylinder groups %d,
>&-1328	lelong		x		block size %d,
>&-1324	lelong		x		fragment size %d,
>&-180	lelong		x		average file size %d,
>&-176	lelong		x		average number of files in dir %d,
>&-272	lequad		x		pending blocks to free %lld,
>&-264	lelong		x		pending inodes to free %d,
>&-664	lequad		x		system-wide uuid %0llx,
>&-1316	lelong		x		minimum percentage of free blocks %d,
>&-1248	lelong		0		TIME optimization
>&-1248	lelong		1		SPACE optimization

66908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
!:mime	filesystem/ffs
>&-1164	string		x		last mounted on %s,
>&-696	string		>\0		volume name %s,
>&-304	leqldate	x		last written at %s,
>&-1167	byte		x		clean flag %d,
>&-1168	byte		x		readonly flag %d,
>&-296	lequad		x		number of blocks %lld,
>&-288	lequad		x		number of data blocks %lld,
>&-1332	lelong		x		number of cylinder groups %d,
>&-1328	lelong		x		block size %d,
>&-1324	lelong		x		fragment size %d,
>&-180	lelong		x		average file size %d,
>&-176	lelong		x		average number of files in dir %d,
>&-272	lequad		x		pending blocks to free %lld,
>&-264	lelong		x		pending inodes to free %d,
>&-664	lequad		x		system-wide uuid %0llx,
>&-1316	lelong		x		minimum percentage of free blocks %d,
>&-1248	lelong		0		TIME optimization
>&-1248	lelong		1		SPACE optimization

9564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
!:mime	filesystem/ffs
>7168   belong		0x4c41424c	Apple UFS Volume
>>7186  string		x		named %s,
>>7176  belong		x		volume label version %d,
>>7180  bedate		x		created on %s,
>8404	string		x		last mounted on %s,
#>9504	bedate		x		last checked at %s,
>8224	bedate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	belong		x		number of blocks %d,
>8232	belong		x		number of data blocks %d,
>8236	belong		x		number of cylinder groups %d,
>8240	belong		x		block size %d,
>8244	belong		x		fragment size %d,
>8252	belong		x		minimum percentage of free blocks %d,
>8256	belong		x		rotational delay %dms,
>8260	belong		x		disk rotational speed %drps,
>8320	belong		0		TIME optimization
>8320	belong		1		SPACE optimization

42332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
!:mime	filesystem/ffs
>&-1164	string		x		last mounted on %s,
>&-696	string		>\0		volume name %s,
>&-304	beqldate	x		last written at %s,
>&-1167	byte		x		clean flag %d,
>&-1168	byte		x		readonly flag %d,
>&-296	bequad		x		number of blocks %lld,
>&-288	bequad		x		number of data blocks %lld,
>&-1332	belong		x		number of cylinder groups %d,
>&-1328	belong		x		block size %d,
>&-1324	belong		x		fragment size %d,
>&-180	belong		x		average file size %d,
>&-176	belong		x		average number of files in dir %d,
>&-272	bequad		x		pending blocks to free %lld,
>&-264	belong		x		pending inodes to free %d,
>&-664	bequad		x		system-wide uuid %0llx,
>&-1316	belong		x		minimum percentage of free blocks %d,
>&-1248	belong		0		TIME optimization
>&-1248	belong		1		SPACE optimization

66908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
!:mime	filesystem/ffs
>&-1164	string		x		last mounted on %s,
>&-696	string		>\0		volume name %s,
>&-304	beqldate	x		last written at %s,
>&-1167	byte		x		clean flag %d,
>&-1168	byte		x		readonly flag %d,
>&-296	bequad		x		number of blocks %lld,
>&-288	bequad		x		number of data blocks %lld,
>&-1332	belong		x		number of cylinder groups %d,
>&-1328	belong		x		block size %d,
>&-1324	belong		x		fragment size %d,
>&-180	belong		x		average file size %d,
>&-176	belong		x		average number of files in dir %d,
>&-272	bequad		x		pending blocks to free %lld,
>&-264	belong		x		pending inodes to free %d,
>&-664	bequad		x		system-wide uuid %0llx,
>&-1316	belong		x		minimum percentage of free blocks %d,
>&-1248	belong		0		TIME optimization
>&-1248	belong		1		SPACE optimization

# jffs2 - original code fom file magic db
0	leshort	0x1984		Linux old jffs2 filesystem data little endian
!:mime filesystem/jffs2
0	leshort	0x1985		Linux jffs2 filesystem data little endian
!:mime filesystem/jffs2
# jffs2 big endian addaption
0	leshort 0x8519		Linux jffs2 filesystem data big endian
!:mime filesystem/jffs2-big

# UBIfs
# Linux kernel sources: fs/ubifs/ubifs-media.h
0	lelong	0x06101831
>0x16	leshort	0		UBIfs image
!:mime filesystem/ubifs
>0x08	lequad	x		\b, sequence number %llu
>0x10	leshort x		\b, length %u
>0x04	lelong	x		\b, CRC 0x%08x

### YAFFS FKIE
## little endian YAFFS
# check if entry type is valid
0	lelong 	<6
# check if first element is on root level
>4	lelong	1
# check if obsolet checksum is set to FF FF
>>8	string	\xff\xff	YAFFS filesystem, little endian
!:mime filesystem/yaffs

## big endian YAFFS
0	belong  <6
>4	belong	1
>>8 string	\xff\xff	YAFFS filesystem, big endian
!:mime filesystem/yaffs

# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
# source: https://github.com/file/file/blob/master/magic/Magdir/filesystems
0x400	lelong		0xF2F52010	F2FS filesystem
!:mime filesystem/f2fs
