3

I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of their filesystem (the first 0xc000 bytes are cf23 repeating) so that you have to use their boot disk which checks for hardware that no longer is available and mostly does not work. I am fairly sure the block size is 4k (0x1000). the first filename in a directory entry seems to always be at 0x20 relative to the block. The filesystem does not appear to be encrypted as text is identifiable and readable. Standard methods of identification (file, blkid, mount -t auto) do not work. I know that reiserfs is used in some parts of the system as is ext2 and ext3. If anyone has any tips for things to look for to identify the filesystem type or pointers to lists of identifying characteristics of file systems it would be appreciated.

|improve this question
  • Google formats of ext2, ext3 and reiserfs and Linux directory entries, see if they match? The inodes are pretty characteristic. The question might be more appropriate for the reverse engineering stackexchange. – dirkt Jun 21 '17 at 5:32
  • Also, try binwalk. – dirkt Jun 21 '17 at 5:37
  • If nobody here can help, you may wish to request a migration to Reverse Engineering. – Gilles 'SO- stop being evil' Jun 22 '17 at 23:06
  • Did you run binwalk over the filesystem? – Guntram Blohm supports Monica Jun 23 '17 at 11:32
  • @GuntramBlohm, yes and it does appear to be a et2 file system 49152 0xC000 Linux EXT filesystem, rev 1.0, ext2 filesystem data, UUID=... and mounts with losetup and the correct offset. Now all I need to do is fix the partition table. – hildred Jun 23 '17 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.