Libguestfs - Dec 2014 - Re: does guestfs_list_partitions() work with Windows 95 images?

>
> The appliance kernel couldn't find any partitions at all on the disk.
>
> Is it a raw format disk image, or some other format that qemu can
> reasonably be expected to read?

I used the "Advanced Options" of Macrium Reflect (on Windows 7) to do
a raw
byte copy.

If it is, then yes I'd say the image is corrupted.  However
you'd
> probably want to hexdump it to see what's really going on.
>
I looked at the first sector wondering if Macrium prepended its own stuff
but it looks like the start of a boot sector to me.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  EB 3E 90 4D 53 57 49 4E 34 2E 30 00 02 40 01 00  ë>.MSWIN4.0..@..
00000010  02 00 02 00 00 F8 FC 00 3F 00 40 00 3F 00 00 00  .....øü.?.@.?...
00000020  41 E0 3E 00 80 00 29 91 2C 95 24 20 20 20 20 20  Aà>.€.)‘,•$
00000030  20 20 20 20 20 20 46 41 54 31 36 20 20 20 F1 7D        FAT16   ñ}

As for examining the rest of the image at the hex level and making an
assessment - that is beyond my scope of expertise.
But certainly it could have been corrupted.
I'll see if I can get access to the drive and use Linux (and dd) to make a
new image.

On Tue, Dec 16, 2014 at 10:29:25AM -0500, Skippy VonDrake
wrote:
> >
> > The appliance kernel couldn't find any partitions at all on the
disk.
> >
> > Is it a raw format disk image, or some other format that qemu can
> > reasonably be expected to read?
> 
> 
> I used the "Advanced Options" of Macrium Reflect (on Windows 7)
to do a raw
> byte copy.
> 
> If it is, then yes I'd say the image is corrupted.  However you'd
> > probably want to hexdump it to see what's really going on.
> >
> 
> I looked at the first sector wondering if Macrium prepended its own stuff
> but it looks like the start of a boot sector to me.
> 
> Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
> 00000000  EB 3E 90 4D 53 57 49 4E 34 2E 30 00 02 40 01 00 
ë>.MSWIN4.0..@..
> 00000010  02 00 02 00 00 F8 FC 00 3F 00 40 00 3F 00 00 00  .....øü.?.@.?...
> 00000020  41 E0 3E 00 80 00 29 91 2C 95 24 20 20 20 20 20  Aà>.€.)‘,•$
> 00000030  20 20 20 20 20 20 46 41 54 31 36 20 20 20 F1 7D        FAT16   ñ}
Looks like a disk sector to me too.  However the partition table
is further on.  See:

https://en.wikipedia.org/wiki/Master_boot_record#Sector_layout

Rich.
> As for examining the rest of the image at the hex level and making an
> assessment - that is beyond my scope of expertise.
> But certainly it could have been corrupted.
> I'll see if I can get access to the drive and use Linux (and dd) to
make a
> new image.
> _______________________________________________
> Libguestfs mailing list
> Libguestfs@redhat.com
> https://www.redhat.com/mailman/listinfo/libguestfs

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v

>
> Looks like a disk sector to me too.  However the partition table
> is further on.  See:
>
> https://en.wikipedia.org/wiki/Master_boot_record#Sector_layout

So that reference says the "classical generic MBR" partition entry # 1
is
offset 0x1BE.
Which in this image is right in the error strings (?) section.

00000170  13 59 5A 58 72 09 40 75 01 42 03 5E 0B E2 CC C3  .YZXr.@u.B.^.âÌÃ
00000180  03 18 01 27 0D 0A 49 6E 76 61 6C 69 64 20 73 79  ...'..Invalid sy
00000190  73 74 65 6D 20 64 69 73 6B FF 0D 0A 44 69 73 6B  stem diskÿ..Disk
000001A0  20 49 2F 4F 20 65 72 72 6F 72 FF 0D 0A 52 65 70   I/O errorÿ..Rep
000001B0  6C 61 63 65 20 74 68 65 20 64 69 73 6B 2C 20 61  lace the disk, a
000001C0  6E 64 20 74 68 65 6E 20 70 72 65 73 73 20 61 6E  nd then press an
000001D0  79 20 6B 65 79 0D 0A 00 49 4F 20 20 20 20 20 20  y key...IO
000001E0  53 59 53 4D 53 44 4F 53 20 20 20 53 59 53 80 01  SYSMSDOS   SYS€.
000001F0  00 57 49 4E 42 4F 4F 54 20 53 59 53 00 00 55 AA  .WINBOOT SYS..Uª
00000200  F8 FF FF FF FF FF 04 00 FF FF 06 00 FF FF 08 00  øÿÿÿÿÿ..ÿÿ..ÿÿ..

So if that is where guestfish is looking for the partition table...

I searched for other references. Found this one and it agreed with this
0x1BE value.
http://www.win.tue.nl/~aeb/partitions/partition_types-2.html

Any other locations that you know of?