From 0e2c129854ac0e57cb8970c9145ae689bc4c7714 Mon Sep 17 00:00:00 2001
From: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date: Sat, 27 May 2017 20:15:23 +0200
Subject: Windows Driver: enhance detection of FAT volumes.

---
 src/Driver/Ntdriver.c |  8 +++++---
 src/Driver/Ntvol.c    | 16 +++++++++++++---
 2 files changed, 18 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/Driver/Ntdriver.c b/src/Driver/Ntdriver.c
index f8db446f..3505826b 100644
--- a/src/Driver/Ntdriver.c
+++ b/src/Driver/Ntdriver.c
@@ -1353,12 +1353,14 @@ NTSTATUS ProcessMainDeviceControlIrp (PDEVICE_OBJECT DeviceObject, PEXTENSION Ex
 									switch (BE64 (*(uint64 *) readBuffer))
 									{
 									case 0xEB52904E54465320: // NTFS
-									case 0xEB3C904D53444F53: // FAT16
+									case 0xEB3C904D53444F53: // FAT16/FAT32
 									case 0xEB58904D53444F53: // FAT32
 									case 0xEB76904558464154: // exFAT
 									case 0x0000005265465300: // ReFS
-									case 0xEB58906D6B66732E: // FAT by mkfs.fat
-									case 0xEB58906D6B646F73: // FAT by mkfs.vfat/mkdosfs
+									case 0xEB58906D6B66732E: // FAT32 mkfs.fat
+									case 0xEB58906D6B646F73: // FAT32 mkfs.vfat/mkdosfs
+									case 0xEB3C906D6B66732E: // FAT16/FAT12 mkfs.fat
+									case 0xEB3C906D6B646F73: // FAT16/FAT12 mkfs.vfat/mkdosfs
 										opentest->FilesystemDetected = TRUE;
 										break;
 									}
diff --git a/src/Driver/Ntvol.c b/src/Driver/Ntvol.c
index 15e6e610..0413708f 100644
--- a/src/Driver/Ntvol.c
+++ b/src/Driver/Ntvol.c
@@ -739,7 +739,9 @@ NTSTATUS TCOpenVolume (PDEVICE_OBJECT DeviceObject,
 
 					switch (fsId)
 					{
-					case 0xEB3C904D53444F53: // FAT16						
+					case 0xEB3C904D53444F53: // FAT16/FAT12
+					case 0xEB3C906D6B66732E: // mkfs.fat
+					case 0xEB3C906D6B646F73: // mkfs.vfat/mkdosfs
 						// workaround for FAT32 formatting by TrueCrypt/VeraCrypt
 						if (memcmp (readBuffer + 0x52, "FAT32   ", 8) == 0)
 						{
@@ -748,8 +750,16 @@ NTSTATUS TCOpenVolume (PDEVICE_OBJECT DeviceObject,
 						}
 						else
 						{
-							Extension->PartitionType = PARTITION_FAT_16;
-							Dump ("FAT16 detected\n");
+							if (memcmp (readBuffer + 0x36, "FAT12   ", 8) == 0)
+							{
+								Extension->PartitionType = PARTITION_FAT_12;
+								Dump ("FAT12 detected\n");
+							}
+							else
+							{
+								Extension->PartitionType = PARTITION_FAT_16;
+								Dump ("FAT16 detected\n");
+							}
 						}
 						break;
 					case 0xEB58906D6B66732E: // mkfs.fat
-- 
cgit v1.2.3