Re: ReFS

[Karel Zak <kzak@redhat.com>]

On Tue, May 14, 2013 at 12:03:16PM +0100, Richard W.M. Jones wrote:
> ReFS is Microsoft's new filesystem used in Windows 2012 Server and
> above.  There's no support for this in Linux (although I'm hoping to
> change that) but it'd be nice if blkid could at least recognize it.
> 
> So I thought you might be interested in the filesystem signature for
> ReFS, which appears to be in the first 8 bytes:

 It seems like NTFS where is 

        struct ntfs_super_block {
            uint8_t		jump[3];
            uint8_t		oem_id[8];	    /* magic string */

 and the magic string is "NTFS    ".

> 00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|
> 00000010  46 53 52 53 00 02 c8 6b  00 00 4e 01 00 00 00 00  |FSRS...k..N.....|
> 00000020  00 02 00 00 80 00 00 00  01 01 00 00 00 00 00 00  |................|
> 00000030  00 00 00 00 00 00 00 00  95 0a d9 2c 1b d9 2c 02  |...........,..,.|
> 00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
> 
> There is nothing else that looks even vaguely like a superblock within
> the first few megabytes, so I'd go with those first 8 bytes for now.

 The question is where is UUID and LABEL :-) 

 BTW, I found:
    http://www.williballenthin.com/forensics/refs/

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com