exfatprogs/exfatprogs

Setting of the InUse bit of EntryType of Volume Label Entry

jengbou opened this issue · 1 comments

jengbou commented

While using The Sleuth Kit (TSK) to analyze flash drives formatted without a label using mkfs.exfat, I encountered this error:

exfatfs_is_vol_label_dentry: incorrect volume label length

Which was caused by the label length check at L128 of exfatfs_meta.c because the default value (0x83) of the EntryType in mkfs.c indicates that the Volume Label Entry is in use even if there is really no label provided when formatting:

exfatprogs/mkfs/mkfs.c

Line 345 in 8593314

ed[0].type = EXFAT_VOLUME;

exfatprogs/include/exfat_ondisk.h

Line 54 in 8593314

#define EXFAT_VOLUME 0x83 /* volume label */

However, my understanding is that if the formatted volume does not have a label, the InUse bit of the EntryType should be set to 0 (i.e., EntryType should be 0x03) instead of 1 (0x83) according to Microsoft's exFAT specification12. Windows Disk Management does set this bit accordingly, so the TSK commands work fine with those formatted by Windows. Although TSK could improve their check for wider compatibility, I think it makes sense to also modify L345 in mkfs.c to something like:

ed[0].type = ui->volume_label_len > 0 ? EXFAT_VOLUME : 0x03;

Please let me know if this sounds a reasonable suggestion or if there is something obvious I missed. Thank you!

Footnotes

  1. https://learn.microsoft.com/en-us/windows/win32/fileio/exfat-specification#table-15-generic-entrytype-field-structure ↩

  2. https://learn.microsoft.com/en-us/windows/win32/fileio/exfat-specification#6214-inuse-field). ↩

namjaejeon commented

@jengbou Okay, Looks reasonable to me. Can you give us a PR(pull request included the patch) for this ?