recognize nonorton ghost files. Joerg Jenderek

diff --git a/magic/Magdir/archive b/magic/Magdir/archive
index 29a0a4f1f9e472d2ce360f9972e562e76d0bb3ca..236a3bc10564c41147653ca0bba2839a305cf386 100644 (file)
--- a/magic/Magdir/archive
+++ b/magic/Magdir/archive
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: archive,v 1.84 2014/04/30 21:41:02 christos Exp $
+# $File: archive,v 1.85 2014/05/30 15:07:02 christos Exp $
 # archive:  file(1) magic for archive formats (see also "msdos" for self-
 #           extracting compressed archives)
 #
@@ -921,3 +921,35 @@
 >36    byte    16              \b, back-to-front
 >42    beshort x               \b, (%dx,
 >44    beshort x               %d)
+
+# Symantec GHOST image by Joerg Jenderek at May 2014
+# http://us.norton.com/ghost/
+# http://www.garykessler.net/library/file_sigs.html
+0              ubelong&0xFFFFf7f0      0xFEEF0100      Norton GHost image
+# *.GHO
+>2             ubyte&0x08              0x00            \b, first file
+# *.GHS or *.[0-9] with cns program option
+>2             ubyte&0x08              0x08            \b, split file
+# part of split index interesting for *.ghs
+>>4            ubyte                   x               id=0x%x
+# compression tag minus one equals numeric compression command line switch z[1-9]
+>3             ubyte                   0               \b, no compression
+>3             ubyte                   2               \b, fast compression (Z1)
+>3             ubyte                   3               \b, medium compression (Z2)
+>3             ubyte                   >3              
+>>3            ubyte                   <11             \b, compression (Z%d-1)
+>2             ubyte&0x08              0x00            
+# ~ 30 byte password field only for *.gho
+>>12           ubequad                 !0              \b, password protected
+>>44           ubyte                   !1              
+# 1~Image All, sector-by-sector only for *.gho
+>>>10          ubyte                   1               \b, sector copy
+# 1~Image Boot track only for *.gho
+>>>43          ubyte                   1               \b, boot track
+# 1~Image Disc only for *.gho implies Image Boot track and sector copy
+>>44           ubyte                   1               \b, disc sector copy
+# optional image description only *.gho
+>>0xff         string                  >\0             "%-.254s"
+# look for DOS sector end sequence
+>0xE08 search/7776             \x55\xAA        
+>>&-512        indirect                x               \b; contains