View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000710 | file | General | public | 2026-01-22 06:12 | 2026-01-22 06:19 |
| Reporter | davidsong | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 5.46 | ||||
| Summary | 0000710: Parallels disk image rule file update | ||||
| Description | `file` detects parallels images using the "WithoutFreeSpace" string. This is the older format for disk images under 2TB. The extended format, used by default by `qemu-img` uses the string "WithouFreSpacExt" See link for details: https://github.com/libyal/libphdi/blob/main/documentation/Parallels%20Hard%20Disk%20image%20format.asciidoc#411-sparse-storage-data-image-file-header | ||||
| Steps To Reproduce | $ qemu-img create -f parallels test.hdd 1M Formatting 'test.hdd', fmt=parallels size=1048576 cluster_size=1048576 $ file test.hdd test.hdd: data | ||||
| Additional Information | $ cat test.hdd | xxd | head 00000000: 5769 7468 6f75 4672 6553 7061 6345 7874 WithouFreSpacExt 00000010: 0200 0000 1000 0000 0400 0000 0008 0000 ................ 00000020: 0100 0000 0008 0000 0000 0000 0000 0000 ................ 00000030: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................ $ file --version file-5.46 magic file from /etc/magic:/usr/share/misc/magic $ qemu-img --version qemu-img version 10.1.0 (Debian 1:10.1.0+ds-5ubuntu2.1) Copyright (c) 2003-2025 Fabrice Bellard and the QEMU Project developers | ||||
| Tags | No tags attached. | ||||
|
|
Oops, turns out parallels disk images aren't supported in magic all. I must have stolen my faulty detection rule from somewhere else 😂 Here's the rules to add it (magic/Magdir/virtual): # Parallels disk image 0 string WithoutFreeSpace Parallels disk image 0 string WithouFreSpacExt Parallels disk image (extended) |
