ReFS

ReFS

[Richard W.M. Jones]

ReFS is Microsoft's new filesystem used in Windows 2012 Server and
above.  There's no support for this in Linux (although I'm hoping to
change that) but it'd be nice if blkid could at least recognize it.

So I thought you might be interested in the filesystem signature for
ReFS, which appears to be in the first 8 bytes:

00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|
00000010  46 53 52 53 00 02 c8 6b  00 00 4e 01 00 00 00 00  |FSRS...k..N.....|
00000020  00 02 00 00 80 00 00 00  01 01 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  95 0a d9 2c 1b d9 2c 02  |...........,..,.|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

There is nothing else that looks even vaguely like a superblock within
the first few megabytes, so I'd go with those first 8 bytes for now.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)

Re: ReFS

[Richard W.M. Jones]

Here's a blank, freshly created ReFS disk image (no partition table -
just the contents of the partition) if you want to look into this
further.

http://oirase.annexia.org/tmp/refs-blank.img.xz
8c72f6ef6541ad752a106604541055c7  refs-blank.img.xz

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org

Re: ReFS

[Richard W.M. Jones]

On Tue, May 14, 2013 at 12:03:16PM +0100, Richard W.M. Jones wrote:
> ReFS is Microsoft's new filesystem used in Windows 2012 Server and
> above.  There's no support for this in Linux (although I'm hoping to
> change that) but it'd be nice if blkid could at least recognize it.
> 
> So I thought you might be interested in the filesystem signature for
> ReFS, which appears to be in the first 8 bytes:
> 
> 00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|

After further research, I found some preliminary analysis:

http://libfslibs.googlecode.com/files/Resilient%20File%20System%20(ReFS).pdf

which is the best we have to go on so far.  There is no superblock as
such, but there is a level 0 metadata block.  In any case that
analysis agrees with me that you should just check the first 8 bytes
of the filesystem / partition.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top

Re: ReFS

[Karel Zak]

On Tue, May 14, 2013 at 12:03:16PM +0100, Richard W.M. Jones wrote:
> ReFS is Microsoft's new filesystem used in Windows 2012 Server and
> above.  There's no support for this in Linux (although I'm hoping to
> change that) but it'd be nice if blkid could at least recognize it.
> 
> So I thought you might be interested in the filesystem signature for
> ReFS, which appears to be in the first 8 bytes:

 It seems like NTFS where is 

        struct ntfs_super_block {
            uint8_t		jump[3];
            uint8_t		oem_id[8];	    /* magic string */

 and the magic string is "NTFS    ".

> 00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|
> 00000010  46 53 52 53 00 02 c8 6b  00 00 4e 01 00 00 00 00  |FSRS...k..N.....|
> 00000020  00 02 00 00 80 00 00 00  01 01 00 00 00 00 00 00  |................|
> 00000030  00 00 00 00 00 00 00 00  95 0a d9 2c 1b d9 2c 02  |...........,..,.|
> 00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
> 
> There is nothing else that looks even vaguely like a superblock within
> the first few megabytes, so I'd go with those first 8 bytes for now.

 The question is where is UUID and LABEL :-) 

 BTW, I found:
    http://www.williballenthin.com/forensics/refs/

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: ReFS

[Karel Zak]

On Tue, May 14, 2013 at 02:27:07PM +0100, Richard W.M. Jones wrote:
> On Tue, May 14, 2013 at 12:03:16PM +0100, Richard W.M. Jones wrote:
> > ReFS is Microsoft's new filesystem used in Windows 2012 Server and
> > above.  There's no support for this in Linux (although I'm hoping to
> > change that) but it'd be nice if blkid could at least recognize it.
> > 
> > So I thought you might be interested in the filesystem signature for
> > ReFS, which appears to be in the first 8 bytes:
> > 
> > 00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|

 I have added this magic string to libblkid.

> After further research, I found some preliminary analysis:
> 
> http://libfslibs.googlecode.com/files/Resilient%20File%20System%20(ReFS).pdf

 Thanks.

> which is the best we have to go on so far.  There is no superblock as
> such, but there is a level 0 metadata block.  In any case that

 Yes, expected, I guess all is stored in some key-value DB (b-trees or
 so).

    Karel


-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: ReFS

[Richard W.M. Jones]

On Tue, May 14, 2013 at 03:56:15PM +0200, Karel Zak wrote:
>  Yes, expected, I guess all is stored in some key-value DB (b-trees or
>  so).

Yeah, it seems very similar to btrfs.  I'm trying to write a program
that will dump out the B-/+tree, which will be a good start for anyone
who wants to have a go at writing a r/o filesystem driver (which ISN'T
going to be me -- no time).

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v