View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0000197fileGeneralpublic2020-09-11 04:492020-10-11 20:26
Reporterfactoreal Assigned Tochristos  
PrioritynormalSeverityminorReproducibilityN/A
Status resolvedResolutionfixed 
Fixed in Version5.40 
Summary0000197: Be File System (bfs) file recognition
DescriptionHi all,

I don't know here is the right place for suggesting a new file type, but I do it and I hope it's useful.
When I was working on some file systems in the forensics lab, I noticed that the BFS file system has not been detected by file. According to the [Wikipedia] page:

>> The Be File System (BFS) is the native file system for the BeOS. In the Linux kernel, it is referred to as "BeFS" to avoid confusion with Boot File System.

So I decided to report this as an issue. Generating a BFS file image is very easy:

$ sudo dd if=/dev/random of=my_bfs.img bs=1M count=50
$ sudo mkfs.bfs my_bfs.img

Again reviewing the BFS file structure [here], we can find that the magic number is `1BADFACE'.
Hence adding the BFS file type to the file magic header list is very straightforward.

Regards

[Wikipedia]:https://en.wikipedia.org/wiki/Be_File_System
[here]:http://martin.hinner.info/fs/bfs/bfs-structure.html
Tagsbfs, file system

Activities

polluks

2020-10-09 08:28

reporter   ~0003485

Attention!
You mixed two different file systems, please read your own quote!

BEFS_SUPER_MAGIC1 = 0x42465331, /* BFS1 */
BEFS_SUPER_MAGIC2 = 0xdd121031,
BEFS_SUPER_MAGIC3 = 0x15b6830e,

christos

2020-10-11 20:26

manager   ~0003491

Added both.

Issue History

Date Modified Username Field Change
2020-09-11 04:49 factoreal New Issue
2020-09-11 04:49 factoreal Tag Attached: bfs
2020-09-11 04:49 factoreal Tag Attached: file system
2020-10-09 08:28 polluks Note Added: 0003485
2020-10-11 20:26 christos Assigned To => christos
2020-10-11 20:26 christos Status new => assigned
2020-10-11 20:26 christos Status assigned => resolved
2020-10-11 20:26 christos Resolution open => fixed
2020-10-11 20:26 christos Fixed in Version => 5.40
2020-10-11 20:26 christos Note Added: 0003491