Filesystem marker.

[Dag-ErlingSmørgrav]

David Gilbert <dgilbert at dclg.ca> writes:
> Is there a set of bytes at some offset in a block that is common to
> any instance of a BSD ufs filesystem?

Yes, you should find copies of the superblock for each file system at
regular intervals.

On a little-endian machine, each superblock will contain, at offset
0x55c, the bytes

    0x54 0x19 0x01 0x00  (for UFS1)
    0x19 0x01 0x54 0x19  (for UFS2)

obviously on a big-endian machine they will be in the reverse order
(but at the same offset)

Note that you may get false positives from files containing data that
happens to match the UFS magic numbers (e.g. dumps).

The offset of the first superblock backup relative to the start of the
filesystem depends on the newfs parameters.  I believe that with
default values in 5.x the superblocks will be at sector offsets 160,
376512, 752864 and so on in increments of 376352 sectors.  For UFS1,
the sector offsets will be 32, 376224, 752416 and so on in increments
of 376192 sectors.  For older UFS1 filesystems created back when newfs
defaulted to 8192-byte blocks and 1024-byte fragments, the offsets
will be 32, 92448, 184864 and so on in 92416-sector increments.

The layout of the superblock is described in /sys/ufs/ffs/fs.h (see
the definition of struct fs)

DES
-- 
Dag-Erling Smørgrav - des at des.no