[sleuthkit-users] mmls and FAT12 partition question

[js <fo...@em...>]

Hi list,

I have a dd image of a floppy.

when examining this floppy with the disktype command I get:

> disktype floppy1.001
>
> --- floppy1.001
> Regular file, size 1.406 MiB (1474560 bytes)
> FAT12 file system (hints score 5 of 5)
>   Volume size 1.390 MiB (1457664 bytes, 2847 clusters of 512 bytes)

When I want to list the partitions on this image i do:

> mmls floppy1.001
> DOS Partition Table
> Sector: 0
> Units are in 512-byte sectors
>
>      Slot    Start        End          Length       Description
> 00:  -----   0000000000   0000000000   0000000001   Primary Table (#0)
> 01:  -----   0000000001   1112359496   1112359496   Unallocated
> 02:  00:01   1112359497   1651347857   0538988361   Novell Netware (0x65)
> 03:  00:02   1126178899   1126198689   0000019791   Win LVM / Secure 
> FS (0x42)
> 04:  -----   1126198690   1869562399   0743363710   Unallocated
> 05:  00:00   1869562400   3503645331   1634082932   GoBack (0x44)

When I want some extra info about this FAT12 disk I do:
This also confirms its a FAT12.
> dosfsck -v floppy1.001
> dosfsck 2.11 (12 Mar 2005)
> dosfsck 2.11, 12 Mar 2005, FAT32, LFN
> Checking we can access the last sector of the filesystem
> Boot sector contents:
> System ID "IBM  3.3"
> Media byte 0xf0 (5.25" or 3.5" HD floppy)
>        512 bytes per logical sector
>        512 bytes per cluster
>          1 reserved sector
> First FAT starts at byte 512 (sector 1)
>          2 FATs, 12 bit entries
>       4608 bytes per FAT (= 9 sectors)
> Root directory starts at byte 9728 (sector 19)
>        224 root directory entries
> Data area starts at byte 16896 (sector 33)
>       2847 data clusters (1457664 bytes)
> 18 sectors/track, 2 heads
>          0 hidden sectors
>       2880 sectors total
> Checking for unused clusters.
> floppy1.001: 1 files, 0/2847 clusters


When I check how many space there is left on the disk I get :

> df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/floppy/0         1.4M   51K  1.4M   4% /mnt/floppy

I can list the contents of this disk, no problem.


Where does the information that mmls produces come from?
Why can I read the disk without any problems on my linux box and windows 
box?
How can the OS handle this disk since the partition layout is completely 
wrong?


Thanks in advance list,

Js.