From owner-svn-src-head@freebsd.org Fri Jan 13 03:58:24 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 60283CAD5A0; Fri, 13 Jan 2017 03:58:24 +0000 (UTC) (envelope-from yaneurabeya@gmail.com) Received: from mail-pf0-x243.google.com (mail-pf0-x243.google.com [IPv6:2607:f8b0:400e:c00::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 2CBBC105E; Fri, 13 Jan 2017 03:58:24 +0000 (UTC) (envelope-from yaneurabeya@gmail.com) Received: by mail-pf0-x243.google.com with SMTP id y143so6307117pfb.1; Thu, 12 Jan 2017 19:58:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=luHXc5ZrrJyeKxDZfu34BVI0elyDiFTKOT9liu/O+zA=; b=tEIkRW3uNXdjMRK3njr8z5ewhRTG2eLIChpAYGcYM28pjPP8qtx7NMWmHKj2vBypN0 9ZjtqpqecNNI/FFwQ85PzqRqHpLV3oCcrMlAr/QanKE3EHiAtaG0w1ZZDvpbrbsJBWmr kw310cQlqJBGVnkqBtkwW4GYCdPzvrFnmRsSNumd3BYLaAbVfTep6ksSGEGH4cs+aJvc qMZU9LVLG3eE9juN942ZBKhQJZyw/3fs250qE5kZAivifGq+6kvL3unMifBQkN5wQANl X/vS0hZH5vyiw+AnES0qiaibT+Z80wtIjiWZ98xxXVTcH5gP0C1VNDuRBikNupMwrppM u3jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=luHXc5ZrrJyeKxDZfu34BVI0elyDiFTKOT9liu/O+zA=; b=MikiejyFiE+2zeclyUNBh887jwPMSVc4Rd9iAjixSArdrXvE7b0cLlpMt8qm4zYy/w 2tBPLcszUBswvBRLeKmxBY9yC+Ga5YqbLqK9dvebTZYfbKKVB8DZLoJVNSm1HKynS0+S AorZTyLT0Q0GDmea/zyltvtuokzcxHc1WxeVJVJwWUBufM0jPGzmPe2G8Oow3Iuvp/Gk VQy4h2xTMHRdnjn/U42se1kc58zBv6CCCPrp7rOqOpQ4mNInq4ULVB7m2bJw1tNfCRR0 NbK4oun+LsgufZcYuJne75lmT+8h0cvFeXgezw8LRZpeB3ap6jL3wscyiCfgUGEV4VNr 4RgQ== X-Gm-Message-State: AIkVDXKwaBL/SU7DGCQs5LSJ6Za6EqZ36M96JsJxLBk/iDMeQvSbRsJ6TtFkngVZrB5FZQ== X-Received: by 10.84.142.70 with SMTP id 64mr26543117plw.177.1484279903581; Thu, 12 Jan 2017 19:58:23 -0800 (PST) Received: from pinklady.local (c-73-19-52-228.hsd1.wa.comcast.net. [73.19.52.228]) by smtp.gmail.com with ESMTPSA id t129sm24980253pgc.32.2017.01.12.19.58.22 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 12 Jan 2017 19:58:23 -0800 (PST) Subject: Re: svn commit: r312003 - head/usr.sbin/fstyp Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_DEEAEC0F-D73D-4634-9005-ADA91E7ABE26"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: "Ngie Cooper (yaneurabeya)" In-Reply-To: <5DFBA40B-3B06-448A-9AD3-A70D3EC8BB16@gmail.com> Date: Thu, 12 Jan 2017 19:58:22 -0800 Cc: svn-src-head@freebsd.org, src-committers , svn-src-all@freebsd.org Message-Id: <6F52AA68-EBD4-4FD1-B2BB-D5831D5B0777@gmail.com> References: <201701130212.v0D2Cw0j092852@repo.freebsd.org> <5DFBA40B-3B06-448A-9AD3-A70D3EC8BB16@gmail.com> To: cem@freebsd.org X-Mailer: Apple Mail (2.3124) X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jan 2017 03:58:24 -0000 --Apple-Mail=_DEEAEC0F-D73D-4634-9005-ADA91E7ABE26 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Jan 12, 2017, at 19:57, Ngie Cooper (yaneurabeya) = wrote: >=20 >=20 >> On Jan 12, 2017, at 18:14, Conrad Meyer wrote: >>=20 >> Forgot to mention: >>=20 >> Documentation: = https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineerin= g-microsoft-exfat-file-system-33274 >>=20 >> Images for testing: http://www.cfreds.nist.gov/dfr-test-images.html >> (raw disk images, include partition tables) >=20 > This commit doesn=E2=80=99t work as advertised: >=20 > $ fstyp dfr-01-xfat.img > fstyp: dfr-01-xfat.img: filesystem not recognized > $ grep exfat `which fstyp` > Binary file /usr/sbin/fstyp matches >=20 > -Ngie Also: $ file dfr-01-xfat.img dfr-01-xfat.img: DOS/MBR boot sector $ hexdump -C dfr-01-xfat.img | head -n 2 00000000 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT = .....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = |................| --Apple-Mail=_DEEAEC0F-D73D-4634-9005-ADA91E7ABE26 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYeFBeAAoJEPWDqSZpMIYVERgQAIsNLsk4eY7fUOhnyG1UNPmr Dw3gVpxvm/6W0VEzr+nqpyHC5D9As0PAuBKmiIhaw+ysF3OEG0UKNkBEkgcIzM5P dJJY5xH0W1HqIwWMXi4h+smc801sBggN7jRnLXTXm3cj8bi+R5W2wTVFL9SFzR9a maLObOo3jPDVVYXBIp5rasokcfkBDGN8+0HY63mR84tzK8ujs0NzNvC+LwuXxmu9 iyG/57i4CNnEQa22+Ht03IdmMSpSwd57S9Cl6DfJ0/QrTX6amlNWA+SOQEWeMD6C HLScGnL8KJPYQe7KHLrXor+DKdTLjbPe+sKjITk0n+Q7H719OegDdvQukw3iQb0A xI57giswATtkKPNqDp3iECj56VClHgZJsaP1lI2lYjxSx2q2SP67S/mqXVzd+J75 4aXJOybfDy2Rb7A//GRnDJR36aNvI8CfoPEy31jvmcfSVOzCYBt4X93JP2frroiB rSt4ptbM+f8T1uYNRgv8zj+Ljowpng+f6+A4hFhPZj+CG7O3Mm8BH+/t2pgaVz4q ZLwYBzwV0fE3LTO6CNTEIzBniVxEXBU6TXZKhdjU6Ylg/ArGcAeiEfKjsb8ohgoW KWk7EGmIIi2ymyusvUVjYCxhLpyUNXwkxLn83zo26ncPx4Fa/f+xgKtWTnQ0eBZu 9IHF2EYRmjIS5YX0R6LP =A/0V -----END PGP SIGNATURE----- --Apple-Mail=_DEEAEC0F-D73D-4634-9005-ADA91E7ABE26--