-
-
Save futpib/cfb04a9843b8f176d5c2ed3364fc8527 to your computer and use it in GitHub Desktop.
ext2scan: scan for ext2/ext3/ext4 partitions
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/* ext2scan: | |
* Scans an input stream, sector by sector, for something that looks like an ext{2,3,4} partition. | |
* It does this by looking for a magic WORD, 0xEF53, at a known offset into the sector. | |
* For random data, this will occur by chance around once per 32MB of data, so we also | |
* check whether the first two sectors are all zeros, which is commonly true for ext partitions. | |
* | |
* Compile with: | |
* gcc ./ext2scan.c -o ./ext2scan | |
* | |
* Example usage: | |
* dd if=/dev/sda [skip=$START_SECTOR] | ./ext2scan [$START_SECTOR] | |
* | |
* Or for more speed, use a larger block size: | |
* dd if=/dev/sda bs=1M [iflag=skip_bytes skip=$(($START_SECTOR*512))] | ./ext2scan [$START_SECTOR] | |
* | |
* References: | |
* - http://unix.stackexchange.com/questions/103919/how-do-i-find-the-offset-of-an-ext4-filesystem | |
* - http://uranus.chrysocome.net/explore2fs/es2fs.htm | |
*/ | |
#include <unistd.h> | |
#include <stdio.h> | |
#include <string.h> | |
int main(int arg_c, char **arg_v) { | |
unsigned char const MAGIC[2] = {0x53, 0xef}; | |
unsigned char const CREATOR_OS_LINUX[4] = {0x00, 0x00, 0x00, 0x00}; | |
char buf[4][512]; | |
long long int sector = 0; | |
long long int offset = 0; | |
if (arg_c == 2) sscanf(arg_v[1], "%lld", &offset); | |
while (read(STDIN_FILENO, buf[sector&3], 512) > 0) { | |
if (!memcmp(buf[sector&3] + 0x38, MAGIC, 2)) { | |
if (!memcmp(buf[sector&3] + 0x48, CREATOR_OS_LINUX, 4)) { | |
printf("Found a superblock (or a backup) with linux creator at sector %lld\n", ((offset+sector) * 512) / 4096); | |
} | |
} | |
sector++; | |
} | |
} | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Just for reference: https://gist.github.com/countingpine/0fd04b99058ebc910fefc910606ae6d0