#--------------------File Systems--------------------- # Minix filesystems 0x410 string \x7f\x13\x00\x00\x00\x00 Minix filesystem, V1, little endian, >0x402 beshort x %d zones >0x402 beshort <1 \b, invalid zone count {invalid} >0x1e string minix \b, bootable >0x1e string !minix >>0x1e string !\x00\x00\x00\x00\x00 {invalid} 0x410 string \x13\x7f\x00\x00\x00\x00 Minix filesystem, V1, big endian, >0x402 beshort x %d zones >0x402 beshort <1 \b, invalid zone count {invalid} >0x1e string minix \b, bootable >0x1e string !minix >>0x1e string !\x00\x00\x00\x00\x00 {invalid} 0x410 string \x8f\x13\x00\x00\x00\x00 Minix filesystem, V1, little endian, 30 char names, >0x402 beshort x %d zones >0x402 beshort <1 \b, invalid zone count {invalid} >0x1e string minix \b, bootable >0x1e string !minix >>0x1e string !\x00\x00\x00\x00\x00 {invalid} 0x410 string \x13\x8f\x00\x00\x00\x00 Minix filesystem, V1, big endian, 30 char names, >0x402 beshort x %d zones >0x402 beshort <1 \b, invalid zone count {invalid} >0x1e string minix \b, bootable >0x1e string !minix >>0x1e string !\x00\x00\x00\x00\x00 {invalid} #0x410 leshort 0x2468 Minix filesystem, V2, little endian, #>0x402 beshort x %d zones #>0x1e string minix \b, bootable #0x410 beshort 0x2468 Minix filesystem, V2, big endian, #>0x402 beshort x %d zones #>0x1e string minix \b, bootable # YAFFS 0 string \x03\x00\x00\x00\x01\x00\x00\x00\xFF\xFF\x00\x00 YAFFS filesystem, little endian # The big endian signature has to be done a bit differently to prevent it from being self-overlapping 4 string \x00\x00\x00\x01\xFF\xFF YAFFS filesystem, big endian >0 string !\x00\x00\x00\x03 {invalid}(first object is not a directory) >10 string !\x00 {invalid}(unexpected name in the first object entry) # EFS2 file system - jojo@utulsa.edu 0 lelong 0x53000000 EFS2 Qualcomm filesystem super block, little endian, >8 string !EFSSuper {invalid}, >4 leshort&0x01 1 NAND >4 leshort&0x01 0 NOR >4 leshort x version 0x%x, >24 lelong x %d blocks, >16 lelong x 0x%x pages per block, >20 lelong x 0x%x bytes per page 0 belong 0x53000000 EFS2 Qualcomm filesystem super block, big endian, >8 string !SSFErepu {invalid}, >4 beshort&0x01 1 NAND >4 beshort&0x01 0 NOR >4 beshort x version 0x%x, >24 belong x %d blocks, >16 belong x 0x%x pages per block, >20 belong x 0x%x bytes per page # TROC file system 0 string TROC TROC filesystem, >4 lelong x %d file entries >4 lelong <1 {invalid} # PFS file system 0 string PFS/ PFS filesystem, >5 byte !0x2E {invalid} >4 string x version %s, >14 leshort x %d files # MPFS file system 0 string MPFS MPFS filesystem, Microchip, >4 byte <0 {invalid} >4 byte >10 {invalid} >5 byte <0 {invalid} >4 byte 0 >>5 byte 0 {invalid} >4 byte x version %d. >5 byte x \b%d, >6 leshort <0 {invalid} >6 leshort x %d file entries # cramfs filesystem - russell@coker.com.au 0 lelong 0x28cd3d45 CramFS filesystem, little endian, >4 lelong <1 invalid size,{invalid} >4 lelong >1073741824 invalid size,{invalid} >4 ulelong x size: %u, >8 lelong &1 version 2, >8 lelong &2 sorted_dirs, >8 lelong &4 hole_support, >32 ulelong 0 invalid{invalid} >32 ulelong x CRC 0x%.8X, >36 ulelong x edition %u, >40 lelong <1 invalid blocks,{invalid} >40 ulelong x %u blocks, >44 lelong <1 invalid file count,{invalid} >44 lelong >1000000 invalid file count,{invalid} >44 ulelong x %u files >4 ulelong x {jump:%u} >4 ulelong x {size:%u} 0 belong 0x28cd3d45 CramFS filesystem, big endian, >4 belong <1 {invalid} >4 belong >1073741824 {invalid} >4 belong x size %u, >8 belong &1 version 2, >8 belong &2 sorted_dirs, >8 belong &4 hole_support, >32 ubelong 0 invalid{invalid} >32 ubelong x CRC 0x%.8X, >36 belong x edition %u, >40 belong <1 invalid blocks,{invalid} >40 ubelong x %u blocks, >44 belong <1 invalid file count,{invalid} >44 belong >1000000 invalid file count,{invalid} >44 ubelong x %u files >4 ubelong x {jump:%u} >4 ubelong x {size:%u} # http://www.dubeiko.com/development/FileSystems/UBI/ubidesign.pdf 0 string UBI! UBI volume ID header, >4 ubyte x version: %d, >5 ubyte x type: %d, >8 ubelong x volume id: %d, >8 ubelong >256 {invalid} >12 ubelong x size: %d >12 ubelong !0 {invalid} >28 string !\x00*12 {invalid} # http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h 0 string UBI\x23 UBI erase count header, >4 ubyte x version: %d, >5 string !\x00*3 {invalid} >8 ubequad x EC: 0x%lX, >16 ubelong x VID header offset: 0x%X, >20 ubelong x data offset: 0x%X # dummy jump - actual jump value is determined in UBIValidPlugin >20 ubyte x {jump:0} # http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h 0 lelong 0x06101831 UBIFS filesystem >20 ubyte <6 {invalid} >20 ubyte >7 {invalid} # Only look for superblock and master nodes >22 leshort !0 {invalid} # 2 bytes of padding should be filled with NULLs >20 ubyte 6 superblock node, >20 ubyte 7 master node, >4 ulelong x CRC: 0x%X, # Master node >20 ubyte 7 >>24 lequad x highest inode: %d, >>32 lequad x commit number: %d # Superblock node >20 ubyte 6 >>24 leshort !0 {invalid} >>28 ulelong x flags: 0x%X, >>32 lelong x min I/O unit size: %d, >>36 lelong x erase block size: %d, >>40 lelong x erase block count: %d, >>44 lelong x max erase blocks: %d, >>80 lelong x format version: %d, >>84 uleshort >2 {invalid} >>84 uleshort x compression type: >>84 uleshort 0 none >>84 uleshort 1 lzo >>84 uleshort 2 zlib >>86 leshort !0 invalid padding,{invalid} # JFFS2 file system # If used with binwalk's smart signature feature (on by default, -S to disable) # this signature can potentially lead to missing some JFFS2 file systems if there # are multiple JFFS2 file systems in a target file and there are no other identified # files in between the JFFS2 file systems. This is an unlikely scenario however, and # the below signatures are much improved in terms of readability and accuracy in the # vast majority of real world scenarios. 0 uleshort 0x1985 JFFS2 filesystem, little endian >2 uleshort !0xE001 >>2 uleshort !0xE002 >>>2 uleshort !0x2003 >>>>2 uleshort !0x2004 >>>>>2 uleshort !0x2006 >>>>>>2 uleshort !0xE008 >>>>>>>2 uleshort !0xE009 {invalid} >4 lelong 0 {invalid} >4 lelong <0 {invalid} >4 lelong x {many}{jump:%d} 0 ubeshort 0x1985 JFFS2 filesystem, big endian >2 ubeshort !0xE001 >>2 ubeshort !0xE002 >>>2 ubeshort !0x2003 >>>>2 ubeshort !0x2004 >>>>>2 ubeshort !0x2006 >>>>>>2 ubeshort !0xE008 >>>>>>>2 ubeshort !0xE009 {invalid} >4 belong 0 {invalid} >4 belong <0 {invalid} >4 belong x {many}{jump:%d} # Squashfs, big endian 0 string sqsh Squashfs filesystem, big endian, >28 beshort >10 {invalid} >28 beshort <1 {invalid} >30 beshort >10 {invalid} >28 beshort x version %d. >30 beshort x \b%d, >28 beshort >3 compression: >>20 beshort 1 \bgzip, >>20 beshort 2 \blzma, >>20 beshort 3 \bgzip (non-standard type definition), >>20 beshort 4 \bxz, >>20 beshort 5 \blz4, >>20 beshort 6 \bzstd, >>20 beshort 0 \b{invalid}, >>20 beshort >6 \b{invalid}, >28 beshort <3 >>8 belong x size: %d bytes, >>8 belong x \b{jump:%d} >>8 belong x \b{size:%d} >28 beshort 3 >>63 bequad x size: %ld bytes, >>63 bequad x \b{jump:%ld} >>63 bequad x \b{size:%ld} >28 beshort >3 >>40 bequad x size: %ld bytes, >>40 bequad x \b{jump:%ld} >>40 bequad x \b{size:%ld} >4 belong x %d inodes, >28 beshort >3 >>12 belong x blocksize: %d bytes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort 2 >>51 belong x blocksize: %d bytes, >28 beshort 3 >>51 belong x blocksize: %d bytes, >28 beshort <4 >>39 ubedate x created: %s >28 beshort >3 >>8 ubedate x created: %s # Squashfs, little endian 0 string hsqs Squashfs filesystem, little endian, >28 leshort >10 {invalid} >28 leshort <1 {invalid} >30 leshort >10 {invalid} >28 leshort x version %d. >30 leshort x \b%d, >28 leshort >3 compression: >>20 leshort 1 \bgzip, >>20 leshort 2 \blzma, >>20 leshort 3 \bgzip (non-standard type definition), >>20 leshort 4 \bxz, >>20 leshort 5 \blz4, >>20 leshort 6 \bzstd, >>20 leshort 0 \b{invalid}, >>20 leshort >6 \b{invalid}, >28 leshort <3 >>8 lelong x size: %d bytes, >>8 lelong x {size:%d} >28 leshort 3 >>63 lequad x size: %ld bytes, >>63 lequad x {size:%ld} >28 leshort >3 >>40 lequad x size: %ld bytes, >>40 lequad x {size:%ld} >4 lelong x %d inodes, >28 leshort >3 >>12 lelong x blocksize: %d bytes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort 2 >>51 lelong x blocksize: %d bytes, >28 leshort 3 >>51 lelong x blocksize: %d bytes, >28 leshort <4 >>39 uledate x created: %s >28 leshort >3 >>8 uledate x created: %s >28 leshort <3 >>8 lelong x {jump:%d} >28 leshort 3 >>63 lequad x {jump:%ld} >28 leshort >3 >>40 lequad x {jump:%ld} # Squashfs with LZMA compression 0 string sqlz Squashfs filesystem, big endian, lzma compression, >28 beshort >10 {invalid} >28 beshort <1 {invalid} >30 beshort >10 {invalid} >28 beshort x version %d. >30 beshort x \b%d, >28 beshort >3 compression: >>20 beshort 1 \bgzip, >>20 beshort 2 \blzma, >>20 beshort 3 \bgzip (non-standard type definition), >>20 beshort 4 \blzma (non-standard type definition), >>20 beshort 5 \blz4, >>20 beshort 6 \bzstd, >>20 beshort 0 \b{invalid}, >>20 beshort >6 \b{invalid}, >28 beshort <3 >>8 belong x size: %d bytes, >>8 belong x {size:%d} >28 beshort 3 >>63 bequad x size: %ld bytes, >>63 bequad x {size:%ld} >28 beshort >3 >>40 bequad x size: %ld bytes, >>40 bequad x {size:%ld} >4 belong x %d inodes, >28 beshort >3 >>12 belong x blocksize: %d bytes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort 2 >>51 belong x blocksize: %d bytes, >28 beshort 3 >>51 belong x blocksize: %d bytes, >28 beshort <4 >>39 ubedate x created: %s >28 beshort >3 >>8 ubedate x created: %s >28 beshort <3 >>8 belong x {jump:%d} >28 beshort 3 >>63 bequad x {jump:%ld} >28 beshort >3 >>40 bequad x {jump:%ld} # Squashfs 3.3 LZMA signature 0 string qshs Squashfs filesystem, big endian, lzma signature, >28 beshort >10 {invalid} >28 beshort <1 {invalid} >30 beshort >10 {invalid} >28 beshort x version %d. >30 beshort x \b%d, >28 beshort >3 compression: >>20 beshort 1 \bgzip, >>20 beshort 2 \blzma, >>20 beshort 3 \bgzip (non-standard type definition), >>20 beshort 4 \bxz, >>20 beshort 5 \blz4, >>20 beshort 6 \bzstd, >>20 beshort 0 \b{invalid}, >>20 beshort >6 \b{invalid}, >28 beshort <3 >>8 belong x size: %d bytes, >>8 belong x {size:%d} >28 beshort 3 >>63 bequad x size: %ld bytes, >>63 bequad x {size:%ld} >28 beshort >3 >>40 bequad x size: %ld bytes, >>40 bequad x {size:%ld} >4 belong x %d inodes, >28 beshort >3 >>12 belong x blocksize: %d bytes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort 2 >>51 belong x blocksize: %d bytes, >28 beshort 3 >>51 belong x blocksize: %d bytes, >28 beshort <4 >>39 ubedate x created: %s >28 beshort >3 >>8 ubedate x created: %s >28 beshort <3 >>8 belong x {jump:%d} >28 beshort 3 >>63 bequad x {jump:%ld} >28 beshort >3 >>40 bequad x {jump:%ld} # Squashfs for DD-WRT 0 string tqsh Squashfs filesystem, big endian, DD-WRT signature, >28 beshort >10 {invalid} >28 beshort <1 {invalid} >30 beshort >10 {invalid} >30 beshort <1 {invalid} >28 beshort x version %d. >30 beshort x \b%d, >28 beshort >3 compression: >>20 beshort 1 \bgzip, >>20 beshort 2 \blzma, >>20 beshort 3 \bgzip (non-standard type definition), >>20 beshort 4 \bxz, >>20 beshort 5 \blz4, >>20 beshort 6 \bzstd, >>20 beshort 0 \b{invalid}, >>20 beshort >6 \b{invalid}, >28 beshort <3 >>8 belong x size: %d bytes, >>8 belong <1 {invalid} >>8 belong x {size:%d} >28 beshort 3 >>63 bequad x size: %ld bytes, >>63 bequad <1 {invalid} >>63 bequad x {size:%ld} >28 beshort >3 >>40 bequad x size: %ld bytes, >>40 bequad <1 {invalid} >>40 bequad x {size:%ld} >4 belong x %d inodes, >28 beshort >3 >>12 belong x blocksize: %d bytes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, >28 beshort 2 >>51 belong x blocksize: %d bytes, >28 beshort 3 >>51 belong x blocksize: %d bytes, >28 beshort <4 >>39 ubedate x created: %s >28 beshort >3 >>8 ubedate x created: %s >28 beshort <3 >>8 belong x {jump:%d} >28 beshort 3 >>63 bequad x {jump:%ld} >28 beshort >3 >>40 bequad x {jump:%ld} # Squashfs for DD-WRT 0 string hsqt Squashfs filesystem, little endian, DD-WRT signature, >28 leshort >10 {invalid} >28 leshort <1 {invalid} >30 leshort >10 {invalid} >28 leshort x version %d. >30 leshort x \b%d, >28 leshort >3 compression: >>20 leshort 1 \bgzip, >>20 leshort 2 \blzma, >>20 leshort 3 \bgzip (non-standard type definition), >>20 leshort 4 \bxz, >>20 leshort 5 \blz4, >>20 leshort 6 \bzstd, >>20 leshort 0 \b{invalid}, >>20 leshort >6 \b{invalid}, >28 leshort <3 >>8 lelong x size: %d bytes, >>8 lelong x {size:%d} >28 leshort 3 >>63 lequad x size: %ld bytes, >>63 lequad x {size:%ld} >28 leshort >3 >>40 lequad x size: %ld bytes, >>40 lequad x {size:%ld} >4 lelong x %d inodes, >28 leshort >3 >>12 lelong x blocksize: %d bytes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort 2 >>51 lelong x blocksize: %d bytes, >28 leshort 3 >>51 lelong x blocksize: %d bytes, >28 leshort <4 >>39 uledate x created: %s >28 leshort >3 >>8 uledate x created: %s >28 leshort <3 >>8 lelong x {jump:%d} >28 leshort 3 >>63 lequad x {jump:%ld} >28 leshort >3 >>40 lequad x {jump:%ld} # Non-standard Squashfs signature found on some D-Link routers 0 string shsq Squashfs filesystem, little endian, non-standard signature, >28 leshort >10 {invalid} >28 leshort <1 {invalid} >30 leshort >10 {invalid} >28 leshort x version %d. >30 leshort x \b%d, >28 leshort >3 compression: >>20 leshort 1 \bgzip, >>20 leshort 2 \blzma, >>20 leshort 3 \bgzip (non-standard type definition), >>20 leshort 4 \bxz, >>20 leshort 5 \blz4, >>20 leshort 6 \bzstd, >>20 leshort 0 \b{invalid}, >>20 leshort >6 \b{invalid}, >28 leshort <3 >>8 lelong x size: %d bytes, >>8 lelong x {size:%d} >28 leshort 3 >>63 lequad x size: %ld bytes, >>63 lequad x {size:%ld} >28 leshort >3 >>40 lequad x size: %ld bytes, >>40 lequad x {size:%ld} >4 lelong x %d inodes, >28 leshort >3 >>12 lelong x blocksize: %d bytes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort 2 >>51 lelong x blocksize: %d bytes, >28 leshort 3 >>51 lelong x blocksize: %d bytes, >28 leshort <4 >>39 uledate x created: %s >28 leshort >3 >>8 uledate x created: %s >28 leshort <3 >>8 lelong x {jump:%d} >28 leshort 3 >>63 lequad x {jump:%ld} >28 leshort >3 >>40 lequad x {jump:%ld} # ext2/ext3 filesystems - Andreas Dilger # ext4 filesystem - Eric Sandeen # volume label and UUID Russell Coker # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 0x438 uleshort 0xEF53 Linux EXT filesystem, >0x404 ulelong x blocks count: %d, >0x404 ulelong*1024 x image size: %d,{jump:%d} >0x43A leshort >4 {invalid}invalid state >0x43A leshort 3 {invalid}invalid state >0x43A leshort <0 {invalid}invalid state >0x43C leshort >3 {invalid}invalid error behavior >0x43C leshort <0 {invalid}invalid error behavior >0x43C lelong >4 {invalid}invalid major revision >0x43C lelong <0 {invalid}invalid major revision >0x43C lelong x rev %d >0x43E leshort x \b.%d, # No journal? ext2 >0x438+36 lelong&0x04 0 ext2 filesystem data >>0x43A leshort&0x01 0 (mounted or unclean) # Has a journal? ext3 or ext4 >0x438+36 lelong &0x0000004 # and small INCOMPAT? >>0x438+40 lelong <0x0000040 # and small RO_COMPAT? >>>0x438+44 lelong <0x0000008 ext3 filesystem data # else large RO_COMPAT? >>>0x438+44 lelong >0x0000007 ext4 filesystem data # else large INCOMPAT? >>0x438+40 lelong >0x000003f ext4 filesystem data >0x438+48 ubelong x \b, UUID=%08x >0x438+52 ubeshort x \b-%04x >0x438+54 ubeshort x \b-%04x >0x438+56 ubeshort x \b-%04x >0x438+58 ubelong x \b-%08x >0x438+60 ubeshort x \b%04x >0x438+64 byte !0 >>0x438+64 string x \b, volume name "%s" #romfs filesystems - Juan Cespedes 0 string -rom1fs-\0 romfs filesystem, version 1 >8 belong >10000000 {invalid} >8 belong <1 {invalid} >8 belong x size: %d bytes, >16 string x {name:%s} >16 string x named "%s" >8 belong x {size:%d} >8 belong x {jump:%d} # Not to be confused with an actual romfs image! # ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revC1_3-05B15__all_en_20120216.zip 0x10 string ROMFS\x20v D-Link ROMFS filesystem, >0x17 string x version %s, >0 string !\x2EmoR >>0 string !Rom\x2E {invalid} unknown endianness >0 string \x2EmoR little endian, >>8 lelong x size: <= %d #>>8 lelong-0x20 x {jump:%d} >0 string Rom\x2E big endian, >>8 belong x size: <= %d #>>8 belong-0x20 x {jump:%d} # Wind River MemFS file system, found in some VxWorks devices 0 string owowowowowowowowowowowowowowow Wind River management filesystem,{overlap} >30 string !ow {invalid}, >32 belong 1 compressed, >32 belong 2 plain text, >32 belong <1 {invalid} >32 belong >2 {invalid} >36 belong x %d files # Wind River MemFS file system, found in some VxWorks devices 0 string OWOWOWOWOWOWOWOWOWOWOWOWOWOWOW Wind River management filesystem,{overlap} >30 string !OW {invalid}, >32 lelong 1 compressed, >32 lelong 2 plain text, >32 lelong <1 {invalid} >32 lelong >2 {invalid} >36 lelong x %d files # ISO 9660 Boot Record - http://wiki.osdev.org/ISO_9660 32768 string \x00CD001\x01 ISO 9660 Boot Record,{end} >7 byte !0 >>7 string x Boot System Identifier: "%.32s", >39 byte !0 >>39 string x Boot Identifier: "%.32s" # ISO 9660 Primary Volume - http://wiki.osdev.org/ISO_9660 32768 string \x01CD001\x01\x00 ISO 9660 Primary Volume,{end} >8 byte !0 >>8 string x System Identifier: "%.32s", >40 byte !0 >>40 string x Volume Identifier: "%.32s" # netboot image - Juan Cespedes 0 lelong 0x1b031336 Netboot image, >4 lelong&0xFFFFFF00 0 >>4 lelong&0x100 0x000 mode 2 >>4 lelong&0x100 0x100 mode 3 >4 lelong&0xFFFFFF00 !0 unknown mode {invalid} 18 string WDK\x202.0\x00 WDK file system, version 2.0, >11 byte !0 %d files, >4 ubedate !0 Last modified %s GMT 32769 string CD001 ISO{end} >6144 string !NSR0 9660 CD-ROM filesystem data, >6144 string NSR0 UDF filesystem data, >32770 byte !1 {invalid} >6148 string 1 version 1.0, >6148 string 2 version 2.0, >6148 string 3 version 3.0 >6148 byte >0x33 {invalid} version, >6148 byte <0x31 {invalid} version, >38 byte !0 >>38 string x volume name: "%s", >2047 string \000CD001\001EL\x20TORITO\x20SPECIFICATION bootable # updated by Joerg Jenderek at Nov 2012 # DOS Emulator image is 128 byte, null right padded header + harddisc image 0 string DOSEMU\0 DOS Emulator image >0x27E leshort !0xAA55 {invalid} >0x27E leshort 0xAA55 #offset is 128 >>19 byte 128 >>>(19.b-1) byte 0x0 >>>>7 lelong >0 \b, %d heads >>>>11 lelong >0 \b, %d sectors/track >>>>15 lelong >0 \b, %d cylinders # From: Alex Beregszaszi 0 string COWD\x03 VMWare3 disk image, >32 lelong x (%d/ >36 lelong x \b%d/ >40 lelong x \b%d) 0 string COWD\x02 VMWare3 undoable disk image, >32 byte !0 >32 string x "%s" # TODO: Add header validation 0 string VMDK VMware4 disk image 0 string KDMV VMware4 disk image #-------------------------------------------------------------------- # Qemu Emulator Image # Lines written by Friedrich Schwittay (f.schwittay@yousable.de) # Updated by Adam Buchbinder (adam.buchbinder@gmail.com) # Made by reading sources, reading documentation, and doing trial and error # on existing QCOW files 0 string QFI\xFB QEMU QCOW Image # BSD 2.x file system image; used in RetroBSD for PIC32. 0 string FS\x3C\x3C BSD 2.x filesystem, >1020 string !\x3E\x3EFS {invalid}(missing FSMAGIC2), >8 lelong*1024 x size: %d bytes, >8 lelong*1024 x {size:%d} >8 lelong*1024 x {jump:%d} >8 lelong x total blocks: %d, >972 lelong x free blocks: %d, >968 uledate x last modified: %s >980 byte !0 >>980 string x \b, last mounted on: "%s" # Simple file system found in Foscam camera firmware 0 beshort 0xbd9a Foscam WebUI filesystem, >2 uleshort x checksum: 0x%X, >16 lelong <3 {invalid}invalid first file name length, >16 lelong >127 {invalid}invalid first file name length, >20 byte 0 {invalid}invalid first file name, >20 byte !0x2E >>20 byte !0x2F >>>20 byte <65 {invalid}invalid first file name, >>>20 byte >122 {invalid}invalid first file name, >16 lelong x {strlen:%d} >20 string x first file name: "{string}" # QNX4 Filesystem 0 string \xEB\x10\x90\x00 QNX4 Boot Block # QNX6 Filesystem # https://www.forensicfocus.com/Forums/viewtopic/t=16846/ # Also known as the QNX6_SUPER_MAGIC (in linux sources) 0 string \x68\x19\x11\x22 QNX6 Super Block # QNX IFS 0 string \xEB\x7E\xFF\x00 QNX IFS, >7 byte !0 {invalid} >50 leshort !0 {invalid} >52 string !\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 {invalid} >36 lelong x size: %d bytes, >36 lelong x {size:%d} >10 leshort x machine-type: 0x%x, >6 byte&0x02 0 little endian, >6 byte&0x02 !0 big endian, >6 byte&0x1c 0 plain text, >6 byte&0x1c !0 >>36 lelong x {jump:%d} >6 byte&0x1c 0x02 SHIFT-compressed, >6 byte&0x1c 0x04 ZLIB-compressed, >6 byte&0x1c 0x08 LZO-compressed, >6 byte&0x1c 0x0c UCL-compressed, >4 uleshort x version: %d