A Python tool that parses raw disk images without mounting them — reads MBR partition tables, FAT32 boot sectors, and EXT superblocks directly from binary data.
Written as a learning project to understand how filesystems are structured at the byte level.
Reads the 512-byte Master Boot Record and extracts all 4 partition entries:
- Status (bootable / inactive / invalid)
- Partition type (FAT12, FAT16, FAT32, NTFS, Linux, etc. — 30+ types mapped)
- CHS start/end coordinates
- LBA start address
- Partition size (sectors + MB)
- Boot signature validation (55AA)
Reads the FAT32 BIOS Parameter Block (BPB) from the partition's boot sector and extracts all relevant fields:
- OEM name, bytes per sector, sectors per cluster
- Number of FAT copies, reserved sectors
- Total sectors, sectors per FAT
- Volume label, serial number
- Free cluster count, boot signature
Reads the EXT superblock (handles both cases: first block empty or not) and extracts:
- Inode count, block count, free blocks/inodes
- Block size, cluster size, blocks per group
- Mount time, write time, last check time
- Filesystem state, error handling behavior
- Creator OS, revision level, magic signature
python FSParser.py -i <disk_image> [-m] [-f] [-a]| Flag | Description |
|---|---|
-i <image> |
Path to disk image (required) |
-m |
Parse MBR partition table only |
-f |
Parse filesystem only |
-a |
Parse both MBR and filesystem |
-h |
Show help |
Parse just the partition table:
python FSParser.py -i disk.img -mParse just the filesystem:
python FSParser.py -i disk.img -fParse everything:
python FSParser.py -i disk.img -aOn Linux:
# Create a blank image
dd if=/dev/zero of=test.img bs=1M count=100
# Or dump a real disk (careful)
dd if=/dev/sda of=disk.img bs=512On Windows, tools like FTK Imager or dd for Windows can produce .img files.
| Type | Support |
|---|---|
| FAT32 (CHS) | ✅ |
| FAT32 (LBA) | ✅ |
| Hidden FAT32 (CHS/LBA) | ✅ |
| EXT (Linux) | ✅ |
| FAT12, FAT16, NTFS, others | ❌ detected but not parsed |
The parser reads raw bytes from the image file using binascii.hexlify and interprets them based on fixed offsets defined in the filesystem specs:
- MBR partition entries start at offset
0x1BE(16 bytes each, 4 entries) - FAT32 BPB fields are at well-known offsets from the partition's LBA start
- EXT superblock starts at offset
0x400(1024 bytes) from the partition start — the tool handles the case where the first 512-byte block is empty
All multi-byte values are read in little-endian and converted accordingly.
The tool parses the first non-empty, supported filesystem it finds in the partition table. If the first partition is unsupported (e.g. NTFS), it reports it and stops — it does not fall through to the next partition.
- Python 3.x
- No external dependencies
FSParser/
├── FSParser.py # Main parser
├── banner.py # ASCII banner
└── LICENSE
- Only the first supported filesystem is parsed — multi-partition images with mixed filesystem types require running the tool separately on each partition offset
numSectorsis hardcoded to 10 when reading filesystem content; this is sufficient for headers (BPB/superblock) but the tool does not parse full filesystem content- No support for GPT partition tables (MBR only)
- Volume labels with non-ASCII characters are displayed with replacement characters
MIT — see LICENSE.