I would say it's rather opposite: with physical devices file(1) showsfile() seems work on the physical device, not on their dd images
$ file /dev/mmcsd0s1
/dev/mmcsd0s1: character special (0/175)
$ file sdcard-p1.img
sdcard-p1.img: DOS/MBR boot sector, code offset 0x0+2, OEM-ID " ", sectors/cluster 64, reserved sectors 1170, Media descriptor 0xf8, sectors/track 63, heads 255, hidden sectors 8192, sectors 62325760 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 7607, reserved 0x1, serial number 0x64653762, unlabeled
$ file usbboot-rootfs-20170927.img
usbboot-rootfs-20170927.img: Linux rev 1.0 ext4 filesystem data, UUID=b5989013-c301-474c-bd26-723f20625472, volume name "rootfs" (extents) (large files) (huge files)
blkid
from sysutils/e2fsprogs:
$ blkid usbboot-rootfs-20170927.img
usbboot-rootfs-20170927.img: LABEL="rootfs" UUID="b5989013-c301-474c-bd26-723f20625472" TYPE="ext4"
# mdconfig sdcard-20171103.img
md0
# blkid /dev/md0s1
/dev/md1s1: LABEL="EXODUS_EXT" UUID="eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee" TYPE="ext4"
Correct.I would say it's rather opposite: with physical devices file(1) showsCode:$ file /dev/mmcsd0s1 /dev/mmcsd0s1: character special (0/175)
root@unicron:/home/peter # gpart show ada2
=> 40 976773088 ada2 GPT (466G)
40 976773088 1 freebsd-ufs (466G)
root@unicron:/home/peter # file -s /dev/ada2p1
/dev/ada2p1: Unix Fast File system [v2] (little-endian) last mounted on /opt/plmedia, volume name plmedia, last written at Mon Jan 22 20:55:46 2018, clean flag 0, readonly flag 0, number of blocks 122096636, number of data blocks 118262225, number of cylinder groups 762, block size 32768, fragment size 4096, average file size 16384, average number of files in dir 64, pending blocks to free 0, pending inodes to free 0, system-wide uuid 0, minimum percentage of free blocks 8, TIME optimization
It may be compressed or uncompressed. But that format is not open, right? Do you have its header description?EWF is a container: it contains the compressed image of the physical device and other informations in its header.
ewfmount
from devel/libewf, then file(1):
# ewfmount /tmp/HFS_ewf.E01 /mnt/tmp/
ewfmount 20140802
# ls -l /mnt/tmp/
-r--r--r-- 1 root wheel 7782531072 Jan 25 11:42 ewf1
# file /mnt/tmp/ewf1
/mnt/tmp/ewf1: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,254,63), startsector 1, 15200255 sectors, extended partition table (last)
# fdisk-linux -l /mnt/tmp/ewf1
Disk /mnt/tmp/ewf1: 264646951852.2 GB, 6392534820271584768 bytes
255 heads, 63 sectors/track, 1225870278 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/mnt/tmp/ewf1s1 1 947 7600127+ ee EFI GPT
Unable to open EWF file(s).
libewf_segment_file_read_file_header: unsupported segment file signature.
libewf_handle_open_file_io_pool: unable to read segment file header.
libewf_handle_open: unable to open handle using a file IO pool.
info_handle_open_input: unable to open file(s).
$ ewfinfo ~/HFS_ewf.E01
ewfinfo 20140802
Acquiry information
Notes: 5C07105A76EE3BF084
Acquisition date: Wed Jan 24 15:55:06 2018
System date: Wed Jan 24 15:55:06 2018
Operating system used: Linux caine 4.4.0-97-generic #120-Ubuntu SMP Tue Sep 19 17:28:18 UTC 2017 x86_64
Software version used: guymager 0.8.4-1
Password: N/A
Model: Sony Storage_Media
Serial number: 5C07105A76EE3BF084
EWF information
File format: EnCase 6
Sectors per chunk: 64
Error granularity: 1
Compression method: deflate
Compression level: good (fast) compression
Is corrupted: yes
Media information
Media type: removable disk
Is physical: yes
Bytes per sector: 512
Number of sectors: 15200256
Media size: 7.2 GiB (7782531072 bytes)
$ md5 /tmp/*E01
MD5 (/tmp/FAT32_EWF.E01) = 60d0f94361ad999e116df2ed5ae5a68f
MD5 (/tmp/HFS_ewf.E01) = 4ba61ab2b518aebe242aba606b0d773e
MD5 (/tmp/NTFS_ewf.E01) = bf48b078b036627e0d6f2cb473e4a75a
ewfmount
:
# ewfmount HFS_ewf.E01 /mnt/tmp/
# ls -l /mnt/tmp/
-r--r--r-- 1 root wheel 7782531072 Jan 29 15:29 ewf1
file
used with an entire disk image is useless: it shows that it's an MBR disk or so. So, you have to run file
on a partition. However, mdconfig() fails when used with that ewf1. I think, the easiest way is to use sysutils/gdisk:
$ sudo gdisk -l /mnt/tmp/ewf1
GPT fdisk (gdisk) version 1.0.3
....
Number Start (sector) End (sector) Size Code Name
1 2048 4196351 2.0 GiB AF00
2 4196352 8390655 2.0 GiB AF00
3 8390656 15198207 3.2 GiB 0700
gdisk
itself:
0700 Microsoft basic data 0c01 Microsoft reserved 2700 Windows RE
3000 ONIE boot 3001 ONIE config 3900 Plan 9
4100 PowerPC PReP boot 4200 Windows LDM data 4201 Windows LDM metadata
4202 Windows Storage Spac 7501 IBM GPFS 7f00 ChromeOS kernel
7f01 ChromeOS root 7f02 ChromeOS reserved 8200 Linux swap
8300 Linux filesystem 8301 Linux reserved 8302 Linux /home
8303 Linux x86 root (/) 8304 Linux x86-64 root (/ 8305 Linux ARM64 root (/)
8306 Linux /srv 8307 Linux ARM32 root (/) 8400 Intel Rapid Start
8e00 Linux LVM a000 Android bootloader a001 Android bootloader 2
a002 Android boot a003 Android recovery a004 Android misc
a005 Android metadata a006 Android system a007 Android cache
a008 Android data a009 Android persistent a00a Android factory
a00b Android fastboot/ter a00c Android OEM a500 FreeBSD disklabel
a501 FreeBSD boot a502 FreeBSD swap a503 FreeBSD UFS
a504 FreeBSD ZFS a505 FreeBSD Vinum/RAID a580 Midnight BSD data
a581 Midnight BSD boot a582 Midnight BSD swap a583 Midnight BSD UFS
a584 Midnight BSD ZFS a585 Midnight BSD Vinum a600 OpenBSD disklabel
a800 Apple UFS a901 NetBSD swap a902 NetBSD FFS
a903 NetBSD LFS a904 NetBSD concatenated a905 NetBSD encrypted
a906 NetBSD RAID ab00 Recovery HD af00 Apple HFS/HFS+
af01 Apple RAID af02 Apple RAID offline af03 Apple label