Skip to contentSkip to conversation

ReFS

DISCUSSION Richard W.M. Jones 2 participants 6 messages May 14, 2013 Util-Linux package

lore
Share & tools
lore

Richard W.M. Jones

author
#0 lore raw

ReFS is Microsoft's new filesystem used in Windows 2012 Server and above. There's no support for this in Linux (although I'm hoping to change that) but it'd be nice if blkid could at least recognize it.

So I thought you might be interested in the filesystem signature for ReFS, which appears to be in the first 8 bytes:

00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|
00000010  46 53 52 53 00 02 c8 6b  00 00 4e 01 00 00 00 00  |FSRS...k..N.....|
00000020  00 02 00 00 80 00 00 00  01 01 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  95 0a d9 2c 1b d9 2c 02  |...........,..,.|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

There is nothing else that looks even vaguely like a superblock within the first few megabytes, so I'd go with those first 8 bytes for now.

Rich.

Signature · 3 lines
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)
author
#1 lore raw

Here's a blank, freshly created ReFS disk image (no partition table - just the contents of the partition) if you want to look into this further.

http://oirase.annexia.org/tmp/refs-blank.img.xz
8c72f6ef6541ad752a106604541055c7 refs-blank.img.xz

Rich.

Signature · 3 lines
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org
author
#2 lore raw
In reply to Richard W.M. Jones
Quoted 8 lines · Richard W.M. Jones

ReFS is Microsoft's new filesystem used in Windows 2012 Server and above. There's no support for this in Linux (although I'm hoping to change that) but it'd be nice if blkid could at least recognize it.

So I thought you might be interested in the filesystem signature for ReFS, which appears to be in the first 8 bytes:

00000000 00 00 00 52 65 46 53 00 00 00 00 00 00 00 00 00 |...ReFS.........|

After further research, I found some preliminary analysis:

http://libfslibs.googlecode.com/files/Resilient%20File%20System%20(ReFS).pdf

which is the best we have to go on so far. There is no superblock as such, but there is a level 0 metadata block. In any case that analysis agrees with me that you should just check the first 8 bytes of the filesystem / partition.

Rich.

Signature · 4 lines
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top
maintainer
#5 lore raw
In reply to Richard W.M. Jones
Quoted 6 lines · Richard W.M. Jones

ReFS is Microsoft's new filesystem used in Windows 2012 Server and above. There's no support for this in Linux (although I'm hoping to change that) but it'd be nice if blkid could at least recognize it.

So I thought you might be interested in the filesystem signature for ReFS, which appears to be in the first 8 bytes:

It seems like NTFS where is

        struct ntfs_super_block {
            uint8_t		jump[3];
            uint8_t		oem_id[8];	    /* magic string */

and the magic string is "NTFS ".

Quoted 8 lines
00000000  00 00 00 52 65 46 53 00  00 00 00 00 00 00 00 00  |...ReFS.........|
00000010  46 53 52 53 00 02 c8 6b  00 00 4e 01 00 00 00 00  |FSRS...k..N.....|
00000020  00 02 00 00 80 00 00 00  01 01 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  95 0a d9 2c 1b d9 2c 02  |...........,..,.|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

There is nothing else that looks even vaguely like a superblock within the first few megabytes, so I'd go with those first 8 bytes for now.

The question is where is UUID and LABEL :-)

BTW, I found:
http://www.williballenthin.com/forensics/refs/

Karel

Signature · 2 lines
 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com
maintainer
#3 lore raw
In reply to Richard W.M. Jones
Quoted 9 lines · Richard W.M. Jones
Quoted 8 lines · Richard W.M. Jones

ReFS is Microsoft's new filesystem used in Windows 2012 Server and above. There's no support for this in Linux (although I'm hoping to change that) but it'd be nice if blkid could at least recognize it.

So I thought you might be interested in the filesystem signature for ReFS, which appears to be in the first 8 bytes:

00000000 00 00 00 52 65 46 53 00 00 00 00 00 00 00 00 00 |...ReFS.........|

I have added this magic string to libblkid.

Quoted 3 lines

After further research, I found some preliminary analysis:

http://libfslibs.googlecode.com/files/Resilient%20File%20System%20(ReFS).pdf

Thanks.

Quoted 2 lines

which is the best we have to go on so far. There is no superblock as such, but there is a level 0 metadata block. In any case that

Yes, expected, I guess all is stored in some key-value DB (b-trees or so).

Karel

Signature · 2 lines
 Karel Zak  <[email protected]>
 http://karelzak.blogspot.com
author
#4 lore raw
Quoted 2 lines · Karel Zak

Yes, expected, I guess all is stored in some key-value DB (b-trees or so).

Yeah, it seems very similar to btrfs. I'm trying to write a program that will dump out the B-/+tree, which will be a good start for anyone who wants to have a go at writing a r/o filesystem driver (which ISN'T going to be me -- no time).

Rich.

Signature · 4 lines
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v