A Python tool that parses raw disk images without mounting them — reads MBR partition tables, FAT32 boot sectors, and EXT superblocks directly from binary data.

Written as a learning project to understand how filesystems are structured at the byte level.

Reads the 512-byte Master Boot Record and extracts all 4 partition entries:

• Status (bootable / inactive / invalid)
• Partition type (FAT12, FAT16, FAT32, NTFS, Linux, etc. — 30+ types mapped)
• CHS start/end coordinates
• LBA start address
• Partition size (sectors + MB)
• Boot signature validation (55AA)

Reads the FAT32 BIOS Parameter Block (BPB) from the partition's boot sector and extracts all relevant fields:

• OEM name, bytes per sector, sectors per cluster
• Number of FAT copies, reserved sectors
• Total sectors, sectors per FAT
• Volume label, serial number
• Free cluster count, boot signature

Reads the EXT superblock (handles both cases: first block empty or not) and extracts:

• Inode count, block count, free blocks/inodes
• Block size, cluster size, blocks per group
• Mount time, write time, last check time
• Filesystem state, error handling behavior
• Creator OS, revision level, magic signature

python FSParser.py -i <disk_image> [-m] [-f] [-a]

Parse just the partition table:

python FSParser.py -i disk.img -m

Parse just the filesystem:

python FSParser.py -i disk.img -f

Parse everything:

python FSParser.py -i disk.img -a

On Linux:

# Create a blank image
dd if=/dev/zero of=test.img bs=1M count=100

# Or dump a real disk (careful)
dd if=/dev/sda of=disk.img bs=512

On Windows, tools like FTK Imager or dd for Windows can produce .img files.

The parser reads raw bytes from the image file using binascii.hexlify and interprets them based on fixed offsets defined in the filesystem specs:

• MBR partition entries start at offset 0x1BE (16 bytes each, 4 entries)
• FAT32 BPB fields are at well-known offsets from the partition's LBA start
• EXT superblock starts at offset 0x400 (1024 bytes) from the partition start — the tool handles the case where the first 512-byte block is empty

All multi-byte values are read in little-endian and converted accordingly.

The tool parses the first non-empty, supported filesystem it finds in the partition table. If the first partition is unsupported (e.g. NTFS), it reports it and stops — it does not fall through to the next partition.

• Python 3.x
• No external dependencies

FSParser/
├── FSParser.py    # Main parser
├── banner.py      # ASCII banner
└── LICENSE

• Only the first supported filesystem is parsed — multi-partition images with mixed filesystem types require running the tool separately on each partition offset
• numSectors is hardcoded to 10 when reading filesystem content; this is sufficient for headers (BPB/superblock) but the tool does not parse full filesystem content
• No support for GPT partition tables (MBR only)
• Volume labels with non-ASCII characters are displayed with replacement characters

MIT — see LICENSE.