Agrippa Disk Image.”"> Grieu, François. “Analysis of Agrippa Disk Image.”
|
François Grieu, |
| The following is a letter of December 12, 2008, from François Grieu with the results of an independent analysis of the disk image of Agrippa he performed after the disk image was first made available on The Agrippa Files on December 9, 2008. Grieu is a French engineer, now working in the field of Smart Cards. His first job involved programming the Macintosh. He had a prototype of the Mac in late 1983 (before its public introduction), and for ten years developed and debugged 680×0 code for traditional MacOS (including telecom software with a floppy-based copy-protection scheme). One of his several Macintoshes has a pure MacOS 9 system , which he regularly uses to run MPW (a programming and scripting environment). He keeps a variety of developer utilities in working order on this machine, which he used to analyze the Agrippa disk image. He may be contacted at fgrieu [at] gmail [dot] com [Note: as elsewhere on this site, “Agrippa” refers to the William Gibson poem and its software, while Agrippa refers to the art book of which the poem is a part.] |
I have some comments on the disk image “fd0_agrippa.dmg”, which I scrutinized using the part of my brain still wired in traditional MacOS mode.
It is a disk image of a 1.4M Macintosh HFS floppy. The main content is the “Agrippa” file (apparently created on Oct 7, 1992, 22:35 and last modified 5 minutes later, unknown time zone), with type APPL (traditional MacOS application) and creator ???? (the standard for unspecified creator).
Preliminary analysis of the “Agrippa” application shows that the resource fork (151551 bytes) is typical of a standard traditional MacOS 680×0 application (mostly consisting of segments of 680×0 code, plus a few other resources, including 2 images and 2 sounds). The data fork (695528 bytes) contains more 680×0 code in the beginning (which is not typical), and as yet unidentified stuff in the end.
 |
 |
|
The two pictures included on the “Agrippa” disk. Other resources included two sound files: a camera click and a gunshot.
|
|
According both to copies of the volume information block and to the creation date of the hidden “Desktop” file, the floppy disk (or whatever master it was prepared from) was formatted on Sept 23, 1992, 13:12. The modification date of the Desktop file is Oct 7, 1992, 20:21, which could be when the “Agrippa” application was first added. If that is by the machine that compiled the application, it may mean that several builds have been made during a work session lasting a bit more than two hours.
Disk volume information |
“Desktop” info file |
There is overwhelming evidence that the floppy, or the disk image, has been mounted (without write protection) on a modern machine running OS X which date was set to Jul 28, 2008; that machine created two folders (“.Trashes” and “.fseventsd”) and two files (“0000000000b5be83” and “fseventsd-uuid”).{1}
There is evidence of a few kilobyte of vestigial data originally written on the diskette beside the “Agrippa” application, in particular in sectors 1708 to 1712, which contain meaningful data that does not belong to any file. This vestigial data has long sequences similar to that in the “Agrippa” file; and the last sector clearly is some executable code for 680×0 processor. These could be remains of former versions of the “Agrippa” file (or intermediary states if the file is self-modifying during its build).
A quick visual scan of the volume’s Catalog Btree (structure holding the description of files and folders) found no evidence of vestigial file names (name of deleted files), but these, as well as additional vestigial data, likely have been overwritten by the unfortunate mount under OS X.
I include various files:
- camera7.aiff and gunshot.aiff: unadulterated sounds extracted from the “Agrippa” application’s resource fork and losslessly converted to a modern format.
- pict1.png and pict2.png: unadulterated images extracted from the “Agrippa” application’s resource fork and losslessly converted to a modern format.
- resedit-view.png: exploration of the resource fork of the “Agrippa” with ResEdit.
- agrippa-info.png, desktop-info.png, sector2.png, sector2interpreted.png, sector2878.png: some screen captures of other tools I used.
- sectors1708-1712.dat: scavenged vestigial data on these sectors of the disk image.
- agrippa.bin: flat lossless archive of data fork, resource fork and file info of the “Agrippa” file, made using BinHex5.
camera7.aiff, gunshot.aiff, pict1.png, pict2.png, and agrippa.bin, belong to the Agrippa owners [from which The Agrippa Files has reproduction permissions]. The rest, and this email (including my address) is hereby placed in the public domain.
Many thanks for bringing this Agrippa artwork/puzzle back from the past.
—Regards, François Grieu
1. Doug Reside of the Maryland Institute for Technology in the Humanities, which assisted in producing the disk image from the original “Agrippa” diskette, notes that the original disk itself was not mounted on any Mac OSX file system during work at the University of Maryland’s Digital Forensics Lab in the summer of 2008, but that the disk image may have been.