#--------------------File Systems---------------------

# Minix filesystems
0x410   string      \x7f\x13\x00\x00\x00\x00    Minix filesystem, V1, little endian,
>0x402  beshort     x                           %d zones
>0x402  beshort     <1                          \b, invalid zone count {invalid}
>0x1e   string      minix                       \b, bootable
>0x1e   string      !minix
>>0x1e  string      !\x00\x00\x00\x00\x00       {invalid}

0x410   string      \x13\x7f\x00\x00\x00\x00    Minix filesystem, V1, big endian,
>0x402  beshort     x                           %d zones
>0x402  beshort     <1                          \b, invalid zone count {invalid}
>0x1e   string      minix                       \b, bootable
>0x1e   string      !minix
>>0x1e  string      !\x00\x00\x00\x00\x00       {invalid}

0x410   string      \x8f\x13\x00\x00\x00\x00    Minix filesystem, V1, little endian, 30 char names,
>0x402  beshort     x                           %d zones
>0x402  beshort     <1                          \b, invalid zone count {invalid}
>0x1e   string      minix                       \b, bootable
>0x1e   string      !minix
>>0x1e  string      !\x00\x00\x00\x00\x00       {invalid}

0x410   string      \x13\x8f\x00\x00\x00\x00    Minix filesystem, V1, big endian, 30 char names,
>0x402  beshort     x                           %d zones
>0x402  beshort     <1                          \b, invalid zone count {invalid}
>0x1e   string      minix                       \b, bootable
>0x1e   string      !minix
>>0x1e  string      !\x00\x00\x00\x00\x00       {invalid}

#0x410   leshort     0x2468      Minix filesystem, V2, little endian,
#>0x402  beshort     x           %d zones
#>0x1e   string      minix       \b, bootable

#0x410   beshort     0x2468      Minix filesystem, V2, big endian,
#>0x402  beshort     x           %d zones
#>0x1e   string      minix       \b, bootable

# YAFFS
0    string     \x03\x00\x00\x00\x01\x00\x00\x00\xFF\xFF\x00\x00    YAFFS filesystem, little endian
# The big endian signature has to be done a bit differently to prevent it from being self-overlapping
4    string     \x00\x00\x00\x01\xFF\xFF                            YAFFS filesystem, big endian
>0   string     !\x00\x00\x00\x03                                   {invalid}(first object is not a directory)
>10  string     !\x00                                               {invalid}(unexpected name in the first object entry)

# EFS2 file system - jojo@utulsa.edu
0      lelong       0x53000000       EFS2 Qualcomm filesystem super block, little endian,
>8     string       !EFSSuper        {invalid},
>4     leshort&0x01 1                NAND
>4     leshort&0x01 0                NOR
>4     leshort      x                version 0x%x,
>24    lelong       x                %d blocks,
>16    lelong       x                0x%x pages per block,
>20    lelong       x                0x%x bytes per page

0      belong       0x53000000       EFS2 Qualcomm filesystem super block, big endian,
>8     string       !SSFErepu        {invalid},
>4     beshort&0x01 1                NAND
>4     beshort&0x01 0                NOR
>4     beshort      x                version 0x%x,
>24    belong       x                %d blocks,
>16    belong       x                0x%x pages per block,
>20    belong       x                0x%x bytes per page

# TROC file system
0       string      TROC    TROC filesystem,
>4      lelong      x       %d file entries
>4      lelong      <1      {invalid}

# PFS file system
0       string    PFS/      PFS filesystem,
>5      byte      !0x2E     {invalid}
>4      string    x         version %s,
>14     leshort   x         %d files

# MPFS file system
0       string      MPFS     MPFS filesystem, Microchip,
>4      byte        <0       {invalid}
>4      byte        >10      {invalid}
>5      byte        <0       {invalid}
>4      byte        0
>>5     byte        0        {invalid}
>4      byte        x        version %d.
>5      byte        x        \b%d,
>6      leshort     <0       {invalid}
>6      leshort     x        %d file entries

# cramfs filesystem - russell@coker.com.au
0       lelong      0x28cd3d45      CramFS filesystem, little endian,
>4      lelong      <1              invalid size,{invalid}
>4      lelong      >1073741824     invalid size,{invalid}
>4      ulelong     x               size: %u,
>8      lelong      &1              version 2,
>8      lelong      &2              sorted_dirs,
>8      lelong      &4              hole_support,
>32     ulelong     0               invalid{invalid}
>32     ulelong     x               CRC 0x%.8X,
>36     ulelong     x               edition %u,
>40     lelong      <1              invalid blocks,{invalid}
>40     ulelong     x               %u blocks,
>44     lelong      <1              invalid file count,{invalid}
>44     lelong      >1000000        invalid file count,{invalid}
>44     ulelong     x               %u files
>4      ulelong     x               {jump:%u}
>4      ulelong     x               {size:%u}

0       belong      0x28cd3d45      CramFS filesystem, big endian,
>4      belong      <1              {invalid}
>4      belong      >1073741824     {invalid}
>4      belong      x               size %u,
>8      belong      &1              version 2,
>8      belong      &2              sorted_dirs,
>8      belong      &4              hole_support,
>32     ubelong     0               invalid{invalid}
>32     ubelong     x               CRC 0x%.8X,
>36     belong      x               edition %u,
>40     belong      <1              invalid blocks,{invalid}
>40     ubelong     x               %u blocks,
>44     belong      <1              invalid file count,{invalid}
>44     belong      >1000000        invalid file count,{invalid}
>44     ubelong     x               %u files
>4      ubelong     x               {jump:%u}
>4      ubelong     x               {size:%u}

# http://www.dubeiko.com/development/FileSystems/UBI/ubidesign.pdf
0       string      UBI!            UBI volume ID header,
>4      ubyte       x               version: %d,
>5      ubyte       x               type: %d,
>8      ubelong     x               volume id: %d,
>8      ubelong     >256            {invalid}
>12     ubelong     x               size: %d
>12     ubelong     !0              {invalid}
>28     string      !\x00*12        {invalid}

# http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h
0       string      UBI\x23         UBI erase count header,
>4      ubyte       x               version: %d,
>5      string      !\x00*3         {invalid}
>8      ubequad     x               EC: 0x%lX,
>16     ubelong     x               VID header offset: 0x%X,
>20     ubelong     x               data offset: 0x%X
# dummy jump - actual jump value is determined in UBIValidPlugin
>20       ubyte       x               {jump:0}

# http://lxr.free-electrons.com/source/fs/ubifs/ubifs-media.h
0        lelong      0x06101831     UBIFS filesystem
>20      ubyte       <6             {invalid}
>20      ubyte       >7             {invalid} # Only look for superblock and master nodes
>22      leshort     !0             {invalid} # 2 bytes of padding should be filled with NULLs
>20      ubyte       6              superblock node,
>20      ubyte       7              master node,
>4       ulelong     x              CRC: 0x%X,
# Master node
>20      ubyte       7
>>24     lequad      x              highest inode: %d,
>>32     lequad      x              commit number: %d
# Superblock node
>20      ubyte       6
>>24     leshort     !0             {invalid}
>>28     ulelong      x             flags: 0x%X,
>>32     lelong      x              min I/O unit size: %d,
>>36     lelong      x              erase block size: %d,
>>40     lelong      x              erase block count: %d,
>>44     lelong      x              max erase blocks: %d,
>>80     lelong      x              format version: %d,
>>84     uleshort    >2             {invalid}
>>84     uleshort    x              compression type:
>>84     uleshort    0              none
>>84     uleshort    1              lzo
>>84     uleshort    2              zlib
>>86     leshort     !0             invalid padding,{invalid}

# JFFS2 file system
# If used with binwalk's smart signature feature (on by default, -S to disable)
# this signature can potentially lead to missing some JFFS2 file systems if there
# are multiple JFFS2 file systems in a target file and there are no other identified
# files in between the JFFS2 file systems. This is an unlikely scenario however, and
# the below signatures are much improved in terms of readability and accuracy in the
# vast majority of real world scenarios.
0                   uleshort    0x1985      JFFS2 filesystem, little endian
>2                  uleshort    !0xE001
>>2                 uleshort    !0xE002
>>>2                uleshort    !0x2003
>>>>2               uleshort    !0x2004
>>>>>2              uleshort    !0x2006
>>>>>>2             uleshort    !0xE008
>>>>>>>2            uleshort    !0xE009     {invalid}
>4                  lelong      0           {invalid}
>4                  lelong      <0          {invalid}
>4                  lelong      x           {many}{jump:%d}

0                   ubeshort    0x1985      JFFS2 filesystem, big endian
>2                  ubeshort    !0xE001
>>2                 ubeshort    !0xE002
>>>2                ubeshort    !0x2003
>>>>2               ubeshort    !0x2004
>>>>>2              ubeshort    !0x2006
>>>>>>2             ubeshort    !0xE008
>>>>>>>2            ubeshort    !0xE009     {invalid}
>4                  belong      0           {invalid}
>4                  belong      <0          {invalid}
>4                  belong      x           {many}{jump:%d}


# Squashfs, big endian
0       string  sqsh    Squashfs filesystem, big endian,
>28     beshort >10     {invalid}
>28     beshort <1      {invalid}
>30     beshort >10     {invalid}
>28     beshort x       version %d.
>30     beshort x       \b%d,
>28     beshort >3      compression:
>>20    beshort 1       \bgzip,
>>20    beshort 2       \blzma,
>>20    beshort 3       \bgzip (non-standard type definition),
>>20    beshort 4       \bxz,
>>20    beshort 5       \blz4,
>>20    beshort 6       \bzstd,
>>20    beshort 0       \b{invalid},
>>20    beshort >6      \b{invalid},
>28     beshort <3
>>8     belong  x       size: %d bytes,
>>8     belong  x       \b{jump:%d}
>>8     belong  x       \b{size:%d}
>28     beshort 3
>>63    bequad  x       size: %ld bytes,
>>63    bequad  x       \b{jump:%ld}
>>63    bequad  x       \b{size:%ld}
>28     beshort >3
>>40    bequad  x       size: %ld bytes,
>>40    bequad  x       \b{jump:%ld}
>>40    bequad  x       \b{size:%ld}
>4      belong  x       %d inodes,
>28     beshort >3
>>12    belong  x       blocksize: %d bytes,
>28     beshort <2
>>32    beshort x       blocksize: %d bytes,
>28     beshort 2
>>51    belong  x       blocksize: %d bytes,
>28     beshort 3
>>51    belong  x       blocksize: %d bytes,
>28     beshort <4
>>39    ubedate  x       created: %s
>28     beshort >3
>>8     ubedate  x       created: %s

# Squashfs, little endian
0       string  hsqs    Squashfs filesystem, little endian,
>28     leshort >10     {invalid}
>28     leshort <1      {invalid}
>30     leshort >10     {invalid}
>28     leshort x       version %d.
>30     leshort x       \b%d,
>28     leshort >3      compression:
>>20    leshort 1       \bgzip,
>>20    leshort 2       \blzma,
>>20    leshort 3       \bgzip (non-standard type definition),
>>20    leshort 4       \bxz,
>>20    leshort 5       \blz4,
>>20    leshort 6       \bzstd,
>>20    leshort 0       \b{invalid},
>>20    leshort >6      \b{invalid},
>28     leshort <3
>>8     lelong  x       size: %d bytes,
>>8     lelong  x       {size:%d}
>28     leshort 3
>>63    lequad  x       size: %ld bytes,
>>63    lequad  x       {size:%ld}
>28     leshort >3    
>>40    lequad  x       size: %ld bytes,
>>40    lequad  x       {size:%ld}
>4      lelong  x       %d inodes,
>28     leshort >3
>>12    lelong  x       blocksize: %d bytes,
>28     leshort <2
>>32    leshort x       blocksize: %d bytes,
>28     leshort 2
>>51    lelong  x       blocksize: %d bytes,
>28     leshort 3
>>51    lelong  x       blocksize: %d bytes,
>28     leshort <4
>>39    uledate  x       created: %s
>28     leshort >3
>>8     uledate  x       created: %s
>28     leshort <3
>>8     lelong  x       {jump:%d}
>28     leshort 3
>>63    lequad  x       {jump:%ld}
>28     leshort >3
>>40    lequad  x       {jump:%ld}

# Squashfs with LZMA compression
0       string  sqlz    Squashfs filesystem, big endian, lzma compression, 
>28     beshort >10     {invalid}
>28     beshort <1      {invalid}
>30     beshort >10     {invalid}
>28     beshort x       version %d.
>30     beshort x       \b%d,
>28     beshort >3      compression:
>>20    beshort 1       \bgzip,
>>20    beshort 2       \blzma,
>>20    beshort 3       \bgzip (non-standard type definition),
>>20    beshort 4       \blzma (non-standard type definition),
>>20    beshort 5       \blz4,
>>20    beshort 6       \bzstd,
>>20    beshort 0       \b{invalid},
>>20    beshort >6      \b{invalid},
>28     beshort <3
>>8     belong  x       size: %d bytes,
>>8     belong  x       {size:%d}
>28     beshort 3
>>63    bequad  x       size: %ld bytes,
>>63    bequad  x       {size:%ld}
>28     beshort >3
>>40    bequad  x       size: %ld bytes,
>>40    bequad  x       {size:%ld}
>4      belong  x       %d inodes,
>28     beshort >3
>>12    belong  x       blocksize: %d bytes,
>28     beshort <2
>>32    beshort x       blocksize: %d bytes,
>28     beshort 2
>>51    belong  x       blocksize: %d bytes,
>28     beshort 3
>>51    belong  x       blocksize: %d bytes,
>28     beshort <4
>>39    ubedate  x       created: %s
>28     beshort >3
>>8     ubedate  x       created: %s
>28     beshort <3
>>8     belong  x       {jump:%d}
>28     beshort 3
>>63    bequad  x       {jump:%ld}
>28     beshort >3
>>40    bequad  x       {jump:%ld}

# Squashfs 3.3 LZMA signature
0       string  qshs    Squashfs filesystem, big endian, lzma signature,
>28     beshort >10     {invalid}
>28     beshort <1      {invalid}
>30     beshort >10     {invalid}
>28     beshort x       version %d.
>30     beshort x       \b%d,
>28     beshort >3      compression:
>>20    beshort 1       \bgzip,
>>20    beshort 2       \blzma,
>>20    beshort 3       \bgzip (non-standard type definition),
>>20    beshort 4       \bxz,
>>20    beshort 5       \blz4,
>>20    beshort 6       \bzstd,
>>20    beshort 0       \b{invalid},
>>20    beshort >6      \b{invalid},
>28     beshort <3
>>8     belong  x       size: %d bytes,
>>8     belong  x       {size:%d}
>28     beshort 3
>>63    bequad  x       size: %ld bytes,
>>63    bequad  x       {size:%ld}
>28     beshort >3
>>40    bequad  x       size: %ld bytes,
>>40    bequad  x       {size:%ld}
>4      belong  x       %d inodes,
>28     beshort >3
>>12    belong  x       blocksize: %d bytes,
>28     beshort <2
>>32    beshort x       blocksize: %d bytes,
>28     beshort 2
>>51    belong  x       blocksize: %d bytes,
>28     beshort 3
>>51    belong  x       blocksize: %d bytes,
>28     beshort <4
>>39    ubedate  x       created: %s
>28     beshort >3
>>8     ubedate  x       created: %s
>28     beshort <3
>>8     belong  x       {jump:%d}
>28     beshort 3
>>63    bequad  x       {jump:%ld}
>28     beshort >3
>>40    bequad  x       {jump:%ld}

# Squashfs for DD-WRT
0       string  tqsh    Squashfs filesystem, big endian, DD-WRT signature,
>28     beshort >10     {invalid}
>28     beshort <1      {invalid}
>30     beshort >10     {invalid}
>30     beshort <1      {invalid}
>28     beshort x       version %d.
>30     beshort x       \b%d,
>28     beshort >3      compression:
>>20    beshort 1       \bgzip,
>>20    beshort 2       \blzma,
>>20    beshort 3       \bgzip (non-standard type definition),
>>20    beshort 4       \bxz,
>>20    beshort 5       \blz4,
>>20    beshort 6       \bzstd,
>>20    beshort 0       \b{invalid},
>>20    beshort >6      \b{invalid},
>28     beshort <3
>>8     belong  x       size: %d bytes,
>>8     belong  <1      {invalid}
>>8     belong  x       {size:%d}
>28     beshort 3
>>63    bequad  x       size: %ld bytes,
>>63    bequad  <1      {invalid}
>>63    bequad  x       {size:%ld}
>28     beshort >3
>>40    bequad  x       size: %ld bytes,
>>40    bequad  <1      {invalid}
>>40    bequad  x       {size:%ld}
>4      belong  x       %d inodes,
>28     beshort >3
>>12    belong  x       blocksize: %d bytes,
>28     beshort <2
>>32    beshort x       blocksize: %d bytes,
>28     beshort 2
>>51    belong  x       blocksize: %d bytes,
>28     beshort 3
>>51    belong  x       blocksize: %d bytes,
>28     beshort <4
>>39    ubedate  x       created: %s
>28     beshort >3
>>8     ubedate  x       created: %s
>28     beshort <3
>>8     belong  x       {jump:%d}
>28     beshort 3
>>63    bequad  x       {jump:%ld}
>28     beshort >3
>>40    bequad  x       {jump:%ld}

# Squashfs for DD-WRT
0       string  hsqt    Squashfs filesystem, little endian, DD-WRT signature,
>28     leshort >10     {invalid}
>28     leshort <1      {invalid}
>30     leshort >10     {invalid}
>28     leshort x       version %d.
>30     leshort x       \b%d,
>28     leshort >3      compression:
>>20    leshort 1       \bgzip,
>>20    leshort 2       \blzma,
>>20    leshort 3       \bgzip (non-standard type definition),
>>20    leshort 4       \bxz,
>>20    leshort 5       \blz4,
>>20    leshort 6       \bzstd,
>>20    leshort 0       \b{invalid},
>>20    leshort >6      \b{invalid},
>28     leshort <3
>>8     lelong  x       size: %d bytes,
>>8     lelong  x       {size:%d}
>28     leshort 3
>>63    lequad  x       size: %ld bytes,
>>63    lequad  x       {size:%ld}
>28     leshort >3
>>40    lequad  x       size: %ld bytes,
>>40    lequad  x       {size:%ld}
>4      lelong  x       %d inodes,
>28     leshort >3
>>12    lelong  x       blocksize: %d bytes,
>28     leshort <2
>>32    leshort x       blocksize: %d bytes,
>28     leshort 2
>>51    lelong  x       blocksize: %d bytes,
>28     leshort 3
>>51    lelong  x       blocksize: %d bytes,
>28     leshort <4
>>39    uledate  x       created: %s
>28     leshort >3
>>8     uledate  x       created: %s
>28     leshort <3
>>8     lelong  x       {jump:%d}
>28     leshort 3
>>63    lequad  x       {jump:%ld}
>28     leshort >3
>>40    lequad  x       {jump:%ld}

# Non-standard Squashfs signature found on some D-Link routers
0       string  shsq    Squashfs filesystem, little endian, non-standard signature, 
>28     leshort >10     {invalid}
>28     leshort <1      {invalid}
>30     leshort >10     {invalid}
>28     leshort x       version %d.
>30     leshort x       \b%d,
>28     leshort >3      compression:
>>20    leshort 1       \bgzip,
>>20    leshort 2       \blzma,
>>20    leshort 3       \bgzip (non-standard type definition),
>>20    leshort 4       \bxz,
>>20    leshort 5       \blz4,
>>20    leshort 6       \bzstd,
>>20    leshort 0       \b{invalid},
>>20    leshort >6      \b{invalid},
>28     leshort <3
>>8     lelong  x       size: %d bytes,
>>8     lelong  x       {size:%d}
>28     leshort 3
>>63    lequad  x       size: %ld bytes,
>>63    lequad  x       {size:%ld}
>28     leshort >3
>>40    lequad  x       size: %ld bytes,
>>40    lequad  x       {size:%ld}
>4      lelong  x       %d inodes,
>28     leshort >3
>>12    lelong  x       blocksize: %d bytes,
>28     leshort <2
>>32    leshort x       blocksize: %d bytes,
>28     leshort 2
>>51    lelong  x       blocksize: %d bytes,
>28     leshort 3
>>51    lelong  x       blocksize: %d bytes,
>28     leshort <4
>>39    uledate  x       created: %s
>28     leshort >3
>>8     uledate  x       created: %s
>28     leshort <3
>>8     lelong  x       {jump:%d}
>28     leshort 3
>>63    lequad  x       {jump:%ld}
>28     leshort >3
>>40    lequad  x       {jump:%ld}

# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
0x438       uleshort        0xEF53          Linux EXT filesystem,
>0x404      ulelong         x               blocks count: %d,
>0x404      ulelong*1024    x               image size: %d,{jump:%d}
>0x43A      leshort         >4              {invalid}invalid state
>0x43A      leshort         3               {invalid}invalid state
>0x43A      leshort         <0              {invalid}invalid state
>0x43C      leshort         >3              {invalid}invalid error behavior
>0x43C      leshort         <0              {invalid}invalid error behavior
>0x43C      lelong          >4              {invalid}invalid major revision
>0x43C      lelong          <0              {invalid}invalid major revision
>0x43C      lelong          x               rev %d
>0x43E      leshort         x               \b.%d,
# No journal?  ext2
>0x438+36   lelong&0x04     0               ext2 filesystem data
>>0x43A     leshort&0x01    0               (mounted or unclean)
# Has a journal?  ext3 or ext4
>0x438+36   lelong          &0x0000004
#  and small INCOMPAT?
>>0x438+40  lelong          <0x0000040
#   and small RO_COMPAT?
>>>0x438+44 lelong          <0x0000008      ext3 filesystem data
#   else large RO_COMPAT?
>>>0x438+44 lelong          >0x0000007      ext4 filesystem data
#  else large INCOMPAT?
>>0x438+40  lelong          >0x000003f      ext4 filesystem data
>0x438+48   ubelong         x               \b, UUID=%08x
>0x438+52   ubeshort        x               \b-%04x
>0x438+54   ubeshort        x               \b-%04x
>0x438+56   ubeshort        x               \b-%04x
>0x438+58   ubelong         x               \b-%08x
>0x438+60   ubeshort        x               \b%04x
>0x438+64   byte            !0
>>0x438+64  string          x               \b, volume name "%s"


#romfs filesystems - Juan Cespedes <cespedes@debian.org>
0       string      -rom1fs-\0      romfs filesystem, version 1
>8      belong      >10000000       {invalid}
>8      belong      <1              {invalid}
>8      belong      x               size: %d bytes,
>16     string      x               {name:%s}
>16     string      x               named "%s"
>8      belong      x               {size:%d}
>8      belong      x               {jump:%d}

# Not to be confused with an actual romfs image!
# ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revC1_3-05B15__all_en_20120216.zip
0x10    string          ROMFS\x20v      D-Link ROMFS filesystem,
>0x17   string          x               version %s,
>0      string          !\x2EmoR
>>0     string          !Rom\x2E        {invalid} unknown endianness
>0      string          \x2EmoR         little endian,
>>8     lelong          x               size: <= %d
#>>8     lelong-0x20     x               {jump:%d}
>0      string          Rom\x2E         big endian,
>>8     belong          x               size: <= %d
#>>8     belong-0x20     x               {jump:%d}

# Wind River MemFS file system, found in some VxWorks devices
0       string    owowowowowowowowowowowowowowow    Wind River management filesystem,{overlap}
>30     string    !ow                               {invalid},
>32     belong    1                                 compressed,
>32     belong    2                                 plain text,
>32     belong    <1                                {invalid}
>32     belong    >2                                {invalid}
>36     belong    x                                 %d files

# Wind River MemFS file system, found in some VxWorks devices
0       string    OWOWOWOWOWOWOWOWOWOWOWOWOWOWOW    Wind River management filesystem,{overlap}
>30     string    !OW                               {invalid},
>32     lelong    1                                 compressed,
>32     lelong    2                                 plain text,
>32     lelong    <1                                {invalid}
>32     lelong    >2                                {invalid}
>36     lelong    x                                 %d files

# ISO 9660 Boot Record - http://wiki.osdev.org/ISO_9660
32768    string      \x00CD001\x01                   ISO 9660 Boot Record,{end}
>7       byte        !0
>>7      string      x                               Boot System Identifier: "%.32s",
>39      byte        !0
>>39     string      x                               Boot Identifier: "%.32s"

# ISO 9660 Primary Volume - http://wiki.osdev.org/ISO_9660
32768    string      \x01CD001\x01\x00               ISO 9660 Primary Volume,{end}
>8       byte        !0
>>8      string      x                               System Identifier: "%.32s",
>40      byte        !0
>>40     string      x                               Volume Identifier: "%.32s"

# netboot image - Juan Cespedes <cespedes@debian.org>
0       lelong              0x1b031336      Netboot image,
>4      lelong&0xFFFFFF00   0
>>4     lelong&0x100        0x000           mode 2
>>4     lelong&0x100        0x100           mode 3
>4      lelong&0xFFFFFF00   !0              unknown mode {invalid}

18      string            WDK\x202.0\x00    WDK file system, version 2.0,
>11     byte              !0                %d files,
>4      ubedate            !0                Last modified %s GMT

32769   string        CD001                                         ISO{end}
>6144   string        !NSR0                                         9660 CD-ROM filesystem data,
>6144   string        NSR0                                          UDF filesystem data,
>32770  byte          !1                                            {invalid}
>6148   string        1                                             version 1.0,
>6148   string        2                                             version 2.0,
>6148   string        3                                             version 3.0
>6148   byte          >0x33                                         {invalid} version,
>6148   byte          <0x31                                         {invalid} version,
>38     byte          !0
>>38    string        x                                             volume name: "%s",
>2047   string        \000CD001\001EL\x20TORITO\x20SPECIFICATION    bootable

# updated by Joerg Jenderek at Nov 2012
# DOS Emulator image is 128 byte, null right padded header + harddisc image
0               string      DOSEMU\0        DOS Emulator image
>0x27E          leshort     !0xAA55         {invalid}
>0x27E          leshort     0xAA55
#offset is 128
>>19            byte        128
>>>(19.b-1)     byte        0x0
>>>>7           lelong      >0              \b, %d heads
>>>>11          lelong      >0              \b, %d sectors/track
>>>>15          lelong      >0              \b, %d cylinders

# From: Alex Beregszaszi <alex@fsn.hu>
0       string  COWD\x03        VMWare3 disk image,
>32     lelong  x               (%d/
>36     lelong  x               \b%d/
>40     lelong  x               \b%d)

0       string  COWD\x02    VMWare3 undoable disk image,
>32     byte    !0
>32     string  x           "%s"

# TODO: Add header validation
0       string        VMDK             VMware4 disk image
0       string        KDMV             VMware4 disk image

#--------------------------------------------------------------------
# Qemu Emulator Image
# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
# Made by reading sources, reading documentation, and doing trial and error
# on existing QCOW files
0       string        QFI\xFB       QEMU QCOW Image

# BSD 2.x file system image; used in RetroBSD for PIC32.
0        string        FS\x3C\x3C       BSD 2.x filesystem,
>1020    string        !\x3E\x3EFS      {invalid}(missing FSMAGIC2),
>8       lelong*1024   x                size: %d bytes,
>8       lelong*1024   x                {size:%d}
>8       lelong*1024   x                {jump:%d}
>8       lelong        x                total blocks: %d,
>972     lelong        x                free blocks: %d,
>968     uledate        x                last modified: %s
>980     byte          !0
>>980    string        x                \b, last mounted on: "%s"

# Simple file system found in Foscam camera firmware
0       beshort  0xbd9a  Foscam WebUI filesystem,
>2      uleshort x       checksum: 0x%X,
>16     lelong   <3      {invalid}invalid first file name length,
>16     lelong   >127    {invalid}invalid first file name length,
>20     byte     0       {invalid}invalid first file name,
>20     byte     !0x2E
>>20    byte     !0x2F
>>>20   byte     <65     {invalid}invalid first file name,
>>>20   byte     >122    {invalid}invalid first file name,
>16     lelong   x       {strlen:%d}
>20     string   x       first file name: "{string}"

# QNX4 Filesystem
0       string   \xEB\x10\x90\x00    QNX4 Boot Block

# QNX6 Filesystem
# https://www.forensicfocus.com/Forums/viewtopic/t=16846/
# Also known as the QNX6_SUPER_MAGIC (in linux sources)
0       string   \x68\x19\x11\x22    QNX6 Super Block

# QNX IFS
0       string    \xEB\x7E\xFF\x00                                  QNX IFS,
>7      byte      !0                                                {invalid}
>50     leshort   !0                                                {invalid}
>52     string    !\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 {invalid}
>36     lelong    x                                                 size: %d bytes,
>36     lelong    x                                                 {size:%d}
>10     leshort   x                                                 machine-type: 0x%x,
>6      byte&0x02 0                                                 little endian,
>6      byte&0x02 !0                                                big endian,
>6      byte&0x1c 0                                                 plain text,
>6      byte&0x1c !0
>>36    lelong    x                                                 {jump:%d}
>6      byte&0x1c 0x02                                              SHIFT-compressed,
>6      byte&0x1c 0x04                                              ZLIB-compressed,
>6      byte&0x1c 0x08                                              LZO-compressed,
>6      byte&0x1c 0x0c                                              UCL-compressed,
>4      uleshort   x                                                version: %d
