I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of their filesystem (the first 0xc000 bytes are cf23 repeating) so that you have to use their boot disk which checks for hardware that no longer is available and mostly does not work. I am fairly sure the block size is 4k (0x1000). the first filename in a directory entry seems to always be at 0x20 relative to the block. The filesystem does not appear to be encrypted as text is identifiable and readable. Standard methods of identification (file, blkid, mount -t auto) do not work. I know that reiserfs is used in some parts of the system as is ext2 and ext3. If anyone has any tips for things to look for to identify the filesystem type or pointers to lists of identifying characteristics of file systems it would be appreciated.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top
ext2,ext3andreiserfsand Linux directory entries, see if they match? The inodes are pretty characteristic. The question might be more appropriate for the reverse engineering stackexchange. – dirkt Jun 21 '17 at 5:32binwalk. – dirkt Jun 21 '17 at 5:3749152 0xC000 Linux EXT filesystem, rev 1.0, ext2 filesystem data, UUID=...and mounts with losetup and the correct offset. Now all I need to do is fix the partition table. – hildred Jun 23 '17 at 19:04