From 0e2c129854ac0e57cb8970c9145ae689bc4c7714 Mon Sep 17 00:00:00 2001
From: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date: Sat, 27 May 2017 20:15:23 +0200
Subject: Windows Driver: enhance detection of FAT volumes.

---
 src/Driver/Ntvol.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

(limited to 'src/Driver/Ntvol.c')

diff --git a/src/Driver/Ntvol.c b/src/Driver/Ntvol.c
index 15e6e610..0413708f 100644
--- a/src/Driver/Ntvol.c
+++ b/src/Driver/Ntvol.c
@@ -739,7 +739,9 @@ NTSTATUS TCOpenVolume (PDEVICE_OBJECT DeviceObject,
 
 					switch (fsId)
 					{
-					case 0xEB3C904D53444F53: // FAT16						
+					case 0xEB3C904D53444F53: // FAT16/FAT12
+					case 0xEB3C906D6B66732E: // mkfs.fat
+					case 0xEB3C906D6B646F73: // mkfs.vfat/mkdosfs
 						// workaround for FAT32 formatting by TrueCrypt/VeraCrypt
 						if (memcmp (readBuffer + 0x52, "FAT32   ", 8) == 0)
 						{
@@ -748,8 +750,16 @@ NTSTATUS TCOpenVolume (PDEVICE_OBJECT DeviceObject,
 						}
 						else
 						{
-							Extension->PartitionType = PARTITION_FAT_16;
-							Dump ("FAT16 detected\n");
+							if (memcmp (readBuffer + 0x36, "FAT12   ", 8) == 0)
+							{
+								Extension->PartitionType = PARTITION_FAT_12;
+								Dump ("FAT12 detected\n");
+							}
+							else
+							{
+								Extension->PartitionType = PARTITION_FAT_16;
+								Dump ("FAT16 detected\n");
+							}
 						}
 						break;
 					case 0xEB58906D6B66732E: // mkfs.fat
-- 
cgit v1.2.3