Partition map is not detected
Brought to you by:
carrier
I have a drive image which initially had mac partitioning, then it was formatted to have plain MBR. For this drive image partition type is not detected by mmls:
Cannot determine partition type (Mac or DOS at 0)
I've debugged mmls code and I can see, that tsk_vs_open() calls tsk_vs_dos_open() and makes set = "DOS". Then it calls tsk_vs_mac_open() also gets valid result, and due to it has detected "DOS" previously it doesn't report any of those results because it's ambigous.
Verbose output from mmls:
tsk_img_open: Type: 0 NumImg: 1 Img1: D:\H0.E01 ewf_open: found 218 segment files via libewf_glob dos_load_prim: Table Sector: 0 ewf_image_read: byte offset: 0 len: 65536 dos_load_prim_table: Testing FAT/NTFS conditions load_pri:0:0 Start: 2048 Size: 976766976 Type: 7 load_pri:0:1 Start: 0 Size: 0 Type: 0 load_pri:0:2 Start: 0 Size: 0 Type: 0 load_pri:0:3 Start: 0 Size: 0 Type: 0 bsd_load_table: Table Sector: 1 gpt_load_table: Sector: 0 gpt_open: Trying other sector sizes gpt_open: Trying sector size: 512 gpt_load_table: Sector: 0 gpt_open: Trying sector size: 1024 gpt_load_table: Sector: 0 gpt_open: Trying sector size: 2048 gpt_load_table: Sector: 0 gpt_open: Trying sector size: 4096 gpt_load_table: Sector: 0 gpt_open: Trying sector size: 8192 gpt_load_table: Sector: 0 sun_load_table: Trying sector: 0 sun_load_table: Trying sector: 1 mac_load_table: Sector: 1 mac_load: 0 Starting Sector: 1 Size: 63 Type: Apple_partition_map Status: 3 mac_load: 1 Starting Sector: 64 Size: 262144 Type: Apple_Free Status: 0 mac_load: 2 Starting Sector: 262208 Size: 976510952 Type: Apple_HFS Status: 1073741875 mac_load: 3 Starting Sector: 976773160 Size: 7 Type: Apple_Free Status: 0 Cannot determine partition type (Mac or DOS at 0)
TSK 4.1.2 (built from source code) Platform: Windows 7 x64.
Attached the 5 first sectors of this drive