From 5b510c8634e68f7297e88a36871918cbc87065f7 Mon Sep 17 00:00:00 2001 From: Christos Zoulas Date: Fri, 30 May 2014 15:07:02 +0000 Subject: [PATCH] recognize nonorton ghost files. Joerg Jenderek --- magic/Magdir/archive | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/magic/Magdir/archive b/magic/Magdir/archive index 29a0a4f1..236a3bc1 100644 --- a/magic/Magdir/archive +++ b/magic/Magdir/archive @@ -1,5 +1,5 @@ #------------------------------------------------------------------------------ -# $File: archive,v 1.84 2014/04/30 21:41:02 christos Exp $ +# $File: archive,v 1.85 2014/05/30 15:07:02 christos Exp $ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # @@ -921,3 +921,35 @@ >36 byte 16 \b, back-to-front >42 beshort x \b, (%dx, >44 beshort x %d) + +# Symantec GHOST image by Joerg Jenderek at May 2014 +# http://us.norton.com/ghost/ +# http://www.garykessler.net/library/file_sigs.html +0 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image +# *.GHO +>2 ubyte&0x08 0x00 \b, first file +# *.GHS or *.[0-9] with cns program option +>2 ubyte&0x08 0x08 \b, split file +# part of split index interesting for *.ghs +>>4 ubyte x id=0x%x +# compression tag minus one equals numeric compression command line switch z[1-9] +>3 ubyte 0 \b, no compression +>3 ubyte 2 \b, fast compression (Z1) +>3 ubyte 3 \b, medium compression (Z2) +>3 ubyte >3 +>>3 ubyte <11 \b, compression (Z%d-1) +>2 ubyte&0x08 0x00 +# ~ 30 byte password field only for *.gho +>>12 ubequad !0 \b, password protected +>>44 ubyte !1 +# 1~Image All, sector-by-sector only for *.gho +>>>10 ubyte 1 \b, sector copy +# 1~Image Boot track only for *.gho +>>>43 ubyte 1 \b, boot track +# 1~Image Disc only for *.gho implies Image Boot track and sector copy +>>44 ubyte 1 \b, disc sector copy +# optional image description only *.gho +>>0xff string >\0 "%-.254s" +# look for DOS sector end sequence +>0xE08 search/7776 \x55\xAA +>>&-512 indirect x \b; contains -- 2.49.0