(Logical change 1.80)
flatcap.org!flatcap
parent
fde565d504
commit
9227c23f73
|
|
@ -0,0 +1,583 @@
|
|||
/**
|
||||
* ntfscluster - Part of the Linux-NTFS project.
|
||||
*
|
||||
* Copyright (c) 2002 Richard Russon <ntfs@flatcap.org>
|
||||
*
|
||||
* This utility will locate the owner of any given sector or cluster.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program (in the main directory of the Linux-NTFS
|
||||
* distribution in the file COPYING); if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
#include <locale.h>
|
||||
#include <libintl.h>
|
||||
#include <stdarg.h>
|
||||
#include <getopt.h>
|
||||
#include <stdlib.h>
|
||||
#include <limits.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "ntfscluster.h"
|
||||
#include "types.h"
|
||||
#include "attrib.h"
|
||||
#include "utils.h"
|
||||
#include "volume.h"
|
||||
|
||||
static const char *AUTHOR = "Richard Russon (FlatCap)";
|
||||
static const char *EXEC_NAME = "ntfscluster";
|
||||
static struct options opts;
|
||||
|
||||
GEN_PRINTF (Eprintf, stderr, NULL, FALSE)
|
||||
GEN_PRINTF (Vprintf, stdout, &opts.verbose, TRUE)
|
||||
GEN_PRINTF (Iprintf, stdout, &opts.quiet, FALSE)
|
||||
|
||||
/**
|
||||
* Dprintf - Print debug messages
|
||||
*/
|
||||
#ifndef DEBUG
|
||||
#define Dprintf(...)
|
||||
#else
|
||||
void Dprintf (const char *format, ...)
|
||||
{
|
||||
va_list va;
|
||||
va_start (va, format);
|
||||
vfprintf (stdout, format, va);
|
||||
va_end (va);
|
||||
}
|
||||
#endif
|
||||
/**
|
||||
* version - Print version information about the program
|
||||
*
|
||||
* Print a copyright statement and a brief description of the program.
|
||||
*
|
||||
* Return: none
|
||||
*/
|
||||
void version (void)
|
||||
{
|
||||
Iprintf ("%s v%s Copyright (C) 2002 %s\n***XXX***on "
|
||||
"an NTFS Volume\n\n%s is free software, released under the GNU "
|
||||
"General Public License\nand you are welcome to redistribute "
|
||||
"it under certain conditions.\n%s comes with ABSOLUTELY NO "
|
||||
"WARRANTY; for details read the GNU\nGeneral Public License "
|
||||
"to be found in the file COPYING in the main\nLinux-NTFS "
|
||||
"distribution directory.\n\n",
|
||||
EXEC_NAME, VERSION, AUTHOR, EXEC_NAME, EXEC_NAME);
|
||||
}
|
||||
|
||||
/**
|
||||
* usage - Print a list of the parameters to the program
|
||||
*
|
||||
* Print a list of the parameters and options for the program.
|
||||
*
|
||||
* Return: none
|
||||
*/
|
||||
void usage (void)
|
||||
{
|
||||
Iprintf ("Usage: %s [options] device\n"
|
||||
" -i --info Print information about the volume\n"
|
||||
" -s range --sector range Look for objects in this range of sectors\n"
|
||||
" -c range --cluster range Look for objects in this range of clusters\n"
|
||||
"\n"
|
||||
" -f --force Use less caution\n"
|
||||
" -q --quiet Less output\n"
|
||||
" -v --verbose More output\n"
|
||||
" -V --version Version information\n"
|
||||
" -h --help Print this help\n\n",
|
||||
EXEC_NAME);
|
||||
Iprintf ("Please report bugs to: linux-ntfs-dev@lists.sf.net\n\n");
|
||||
}
|
||||
|
||||
/**
|
||||
* parse_size - Convert a string representing a size
|
||||
* @value: String to be parsed
|
||||
* @size: Parsed size
|
||||
*
|
||||
* Read a string and convert it to a number. Strings may be suffixed to scale
|
||||
* them. Any number without a suffix is assumed to be in bytes.
|
||||
*
|
||||
* Suffix Description Multiple
|
||||
* [tT] Terabytes 10^12
|
||||
* [gG] Gigabytes 10^9
|
||||
* [mM] Megabytes 10^6
|
||||
* [kK] Kilobytes 10^3
|
||||
*
|
||||
* Notes:
|
||||
* Only the first character of the suffix is read.
|
||||
* The multipliers are decimal thousands, not binary: 1000, not 1024.
|
||||
* If parse_size fails, @size will not be changed
|
||||
*
|
||||
* Return: 1 Success
|
||||
* 0 Error, the string was malformed
|
||||
*/
|
||||
int parse_size (const char *value, s64 *size)
|
||||
{
|
||||
long long result;
|
||||
char *suffix = NULL;
|
||||
|
||||
if (!value || !size)
|
||||
return 0;
|
||||
|
||||
Dprintf ("Parsing size '%s'.\n", value);
|
||||
|
||||
result = strtoll (value, &suffix, 10);
|
||||
if (result < 0 || errno == ERANGE) {
|
||||
Eprintf ("Invalid size '%s'.\n", value);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (!suffix) {
|
||||
Eprintf ("Internal error, strtoll didn't return a suffix.\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/*if (strlen (suffix) > 1) {
|
||||
Eprintf ("Invalid size suffix '%s'. Use T, G, M, or K.\n", suffix);
|
||||
return 0;
|
||||
} Can't do this because of ranges*/
|
||||
|
||||
switch (suffix[0]) {
|
||||
case 't': case 'T': result *= 1000;
|
||||
case 'g': case 'G': result *= 1000;
|
||||
case 'm': case 'M': result *= 1000;
|
||||
case 'k': case 'K': result *= 1000;
|
||||
case '-': case 0:
|
||||
break;
|
||||
default:
|
||||
Eprintf ("Invalid size suffix '%s'. Use T, G, M, or K.\n", suffix);
|
||||
return 0;
|
||||
}
|
||||
|
||||
Dprintf ("Parsed size = %lld.\n", result);
|
||||
*size = result;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* parse_range - Convert a string representing a range of numbers
|
||||
* @string: The string to be parsed
|
||||
* @start: The beginning of the range will be stored here
|
||||
* @finish: The end of the range will be stored here
|
||||
*
|
||||
* Read a string of the form n-m. If the lower end is missing, zero will be
|
||||
* substituted. If the upper end is missing LONG_MAX will be used. If the
|
||||
* string cannot be parsed correctly, @start and @finish will not be changed.
|
||||
*
|
||||
* Return: 1 Success, a valid string was found
|
||||
* 0 Error, the string was not a valid range
|
||||
*/
|
||||
int parse_range (const char *string, s64 *start, s64 *finish)
|
||||
{
|
||||
s64 a, b;
|
||||
char *middle;
|
||||
|
||||
if (!string || !start || !finish)
|
||||
return 0;
|
||||
|
||||
middle = strchr (string, '-');
|
||||
if (string == middle) {
|
||||
Dprintf ("Range has no beginning, defaulting to 0.\n");
|
||||
a = 0;
|
||||
} else {
|
||||
if (!parse_size (string, &a))
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (middle) {
|
||||
if (middle[1] == 0) {
|
||||
b = LONG_MAX; // XXX ULLONG_MAX
|
||||
Dprintf ("Range has no end, defaulting to %lld.\n", b);
|
||||
} else {
|
||||
if (!parse_size (middle+1, &b))
|
||||
return 0;
|
||||
}
|
||||
} else {
|
||||
b = a;
|
||||
}
|
||||
|
||||
Dprintf ("Range '%s' = %lld - %lld\n", string, a, b);
|
||||
|
||||
*start = a;
|
||||
*finish = b;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* parse_options - Read and validate the programs command line
|
||||
*
|
||||
* Read the command line, verify the syntax and parse the options.
|
||||
* This function is very long, but quite simple.
|
||||
*
|
||||
* Return: 1 Success
|
||||
* 0 Error, one or more problems
|
||||
*/
|
||||
int parse_options (int argc, char **argv)
|
||||
{
|
||||
static const char *sopt = "-c:fhiqs:vV";
|
||||
static const struct option lopt[] = {
|
||||
{ "cluster", required_argument, NULL, 'c' },
|
||||
{ "force", no_argument, NULL, 'f' },
|
||||
{ "help", no_argument, NULL, 'h' },
|
||||
{ "info", no_argument, NULL, 'i' },
|
||||
{ "quiet", no_argument, NULL, 'q' },
|
||||
{ "sector", required_argument, NULL, 's' },
|
||||
{ "verbose", no_argument, NULL, 'v' },
|
||||
{ "version", no_argument, NULL, 'V' },
|
||||
{ NULL, 0, NULL, 0 }
|
||||
};
|
||||
|
||||
char c = -1;
|
||||
int err = 0;
|
||||
int ver = 0;
|
||||
int help = 0;
|
||||
|
||||
opterr = 0; /* We'll handle the errors, thank you. */
|
||||
|
||||
while ((c = getopt_long (argc, argv, sopt, lopt, NULL)) != -1) {
|
||||
switch (c) {
|
||||
case 1: /* A non-option argument */
|
||||
if (!opts.device) {
|
||||
opts.device = argv[optind-1];
|
||||
} else {
|
||||
opts.device = NULL;
|
||||
err++;
|
||||
}
|
||||
break;
|
||||
|
||||
case 'c':
|
||||
if ((opts.cluster_begin > 0) || (opts.cluster_end > 0) ||
|
||||
!parse_range (optarg, &opts.cluster_begin, &opts.cluster_end)) {
|
||||
err++;
|
||||
}
|
||||
break;
|
||||
case 'f':
|
||||
opts.force++;
|
||||
break;
|
||||
case 'h':
|
||||
help++;
|
||||
break;
|
||||
case 'i':
|
||||
opts.info++;
|
||||
break;
|
||||
case 'q':
|
||||
opts.quiet++;
|
||||
break;
|
||||
case 's':
|
||||
if ((opts.sector_begin > 0) || (opts.sector_end > 0) ||
|
||||
!parse_range (optarg, &opts.sector_begin, &opts.sector_end)) {
|
||||
err++;
|
||||
}
|
||||
break;
|
||||
case 'v':
|
||||
opts.verbose++;
|
||||
break;
|
||||
case 'V':
|
||||
ver++;
|
||||
break;
|
||||
default:
|
||||
if ((optopt == 'c') || (optopt == 's')) {
|
||||
Eprintf ("Option '%s' requires an argument.\n", argv[optind-1]);
|
||||
} else {
|
||||
Eprintf ("Unknown option '%s'.\n", argv[optind-1]);
|
||||
}
|
||||
err++;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (help || ver) {
|
||||
opts.quiet = 0;
|
||||
} else {
|
||||
if (opts.device == NULL) {
|
||||
Eprintf ("You must specify exactly one device.\n");
|
||||
err++;
|
||||
}
|
||||
|
||||
if (opts.quiet && opts.verbose) {
|
||||
Eprintf ("You may not use --quiet and --verbose at the same time.\n");
|
||||
err++;
|
||||
}
|
||||
|
||||
if (opts.sector_end && opts.cluster_end) {
|
||||
Eprintf ("You must specify either a sector or a cluster.\n");
|
||||
err++;
|
||||
}
|
||||
if (opts.cluster_begin > opts.cluster_end) {
|
||||
Eprintf ("The cluster range must be in ascending order.\n");
|
||||
err++;
|
||||
}
|
||||
if (opts.sector_begin > opts.sector_end) {
|
||||
Eprintf ("The sector range must be in ascending order.\n");
|
||||
err++;
|
||||
}
|
||||
}
|
||||
|
||||
if (ver)
|
||||
version();
|
||||
if (help || err)
|
||||
usage();
|
||||
|
||||
return (!err && !help && !ver);
|
||||
}
|
||||
|
||||
/**
|
||||
* mftrec_in_use - Determine if a MFT Record is in use
|
||||
* @vol: An ntfs volume obtained from ntfs_mount
|
||||
* @mref: MFT Reference (inode number)
|
||||
*
|
||||
* The metadata file $BITMAP has one binary bit representing each record in the
|
||||
* MFT. The bit will be set for each record that is in use. The function
|
||||
* reads the relevant part of $BITMAP into a buffer and tests the bit.
|
||||
*
|
||||
* This function has a static buffer in which it caches a section of $BITMAP.
|
||||
* If the mref, being tested, lies outside the range, the buffer will be
|
||||
* refreshed.
|
||||
*
|
||||
* Return: 1 MFT Record is in use
|
||||
* 0 MFT Record is unused
|
||||
* -1 Error occurred
|
||||
*/
|
||||
int mftrec_in_use (ntfs_volume *vol, MFT_REF mref)
|
||||
{
|
||||
static u8 buffer[512];
|
||||
static s64 bmpmref = -sizeof (buffer) - 1; /* Which bit of $BITMAP is in the buffer */
|
||||
|
||||
int byte, bit;
|
||||
|
||||
if (!vol)
|
||||
return -1;
|
||||
|
||||
/* Does mref lie in the section of $Bitmap we already have cached? */
|
||||
if ((mref < bmpmref) || (mref >= (bmpmref + (sizeof (buffer) << 3)))) {
|
||||
Dprintf ("Bit lies outside cache.\n");
|
||||
|
||||
/* Mark the buffer as not in use, in case the read is shorter. */
|
||||
memset (buffer, 0, sizeof (buffer));
|
||||
bmpmref = mref & (~((sizeof (buffer) << 3) - 1));
|
||||
|
||||
if (ntfs_attr_pread (vol->mftbmp_na, (bmpmref>>3), sizeof (buffer), buffer) < 0) {
|
||||
Eprintf ("Couldn't read $MFT/$BITMAP: %s\n", strerror (errno));
|
||||
return -1;
|
||||
}
|
||||
|
||||
Dprintf ("Reloaded bitmap buffer.\n");
|
||||
}
|
||||
|
||||
bit = 1 << (mref & 7);
|
||||
byte = (mref >> 3) & (sizeof (buffer) - 1);
|
||||
Dprintf ("cluster = %lld, bmpmref = %lld, byte = %d, bit = %d, in use %d\n",
|
||||
mref, bmpmref, byte, bit, buffer[byte] & bit);
|
||||
|
||||
return (buffer[byte] & bit);
|
||||
}
|
||||
|
||||
/**
|
||||
* cluster_find
|
||||
*/
|
||||
int cluster_find (ntfs_volume *vol, LCN s_begin, LCN s_end)
|
||||
{
|
||||
int i;
|
||||
int result = 1;
|
||||
u8 *buffer;
|
||||
|
||||
if (!vol)
|
||||
return 1;
|
||||
|
||||
buffer = malloc (vol->mft_record_size);
|
||||
if (!buffer) {
|
||||
Eprintf ("Couldn't allocate memory.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
for (i = 0; i < vol->nr_mft_records; i++) {
|
||||
//for (i = 0; i < 30; i++) {
|
||||
//for (i = 162; i < 175; i++) {
|
||||
ntfs_inode *inode;
|
||||
ntfs_attr_search_ctx *ctx;
|
||||
|
||||
if (!mftrec_in_use (vol, i)) {
|
||||
//printf ("%d skipped\n", i);
|
||||
continue;
|
||||
}
|
||||
|
||||
inode = ntfs_inode_open (vol, i);
|
||||
if (!inode) {
|
||||
Eprintf ("Can't read inode %d\n", i);
|
||||
goto free;
|
||||
}
|
||||
|
||||
if (inode->nr_extents == -1) {
|
||||
printf ("inode %d is an extent record\n", i);
|
||||
goto close;
|
||||
}
|
||||
|
||||
Vprintf ("Inode: %d\n", i);
|
||||
ctx = ntfs_attr_get_search_ctx (inode, NULL);
|
||||
|
||||
if (ntfs_attr_lookup (AT_STANDARD_INFORMATION, NULL, 0, IGNORE_CASE, 0, NULL, 0, ctx) < 0) {
|
||||
//printf ("extent inode\n");
|
||||
continue;
|
||||
}
|
||||
ntfs_attr_reinit_search_ctx (ctx);
|
||||
|
||||
//printf ("Searching for cluster range %lld-%lld\n", s_begin, s_end);
|
||||
while (ntfs_attr_lookup (AT_UNUSED, NULL, 0, IGNORE_CASE, 0, NULL, 0, ctx) >= 0) {
|
||||
runlist_element *runs;
|
||||
int j;
|
||||
|
||||
if (!ctx->attr->non_resident) {
|
||||
//printf ("0x%02X ", ctx->attr->type);
|
||||
continue;
|
||||
}
|
||||
|
||||
runs = ntfs_mapping_pairs_decompress (vol, ctx->attr, NULL);
|
||||
if (!runs) {
|
||||
Eprintf ("Couldn't read the data runs.\n");
|
||||
ntfs_inode_close (inode);
|
||||
goto free;
|
||||
}
|
||||
|
||||
Vprintf ("\t[0x%02X]\n", ctx->attr->type);
|
||||
|
||||
Vprintf ("\t\tVCN\tLCN\tLength\n");
|
||||
for (j = 0; runs[j].length > 0; j++) {
|
||||
LCN a_begin = runs[j].lcn;
|
||||
LCN a_end = a_begin + runs[j].length - 1;
|
||||
|
||||
if (a_begin < 0)
|
||||
continue; // sparse, discontiguous, etc
|
||||
|
||||
Vprintf ("\t\t%lld\t%lld-%lld (%lld)\n", runs[j].vcn, runs[j].lcn, runs[j].lcn + runs[j].length - 1, runs[j].length);
|
||||
//Vprintf ("\t\t%lld\t%lld\t%lld\n", runs[j].vcn, runs[j].lcn, runs[j].length);
|
||||
//dprint list
|
||||
|
||||
if (a_begin > s_end) {
|
||||
continue; // after search range (5)
|
||||
}
|
||||
if (a_end < s_begin) {
|
||||
continue; // before search range (1)
|
||||
}
|
||||
printf ("inode %d matches\n", i);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
ntfs_attr_put_search_ctx (ctx);
|
||||
ctx = NULL;
|
||||
close:
|
||||
//printf ("\n");
|
||||
ntfs_inode_close (inode);
|
||||
}
|
||||
free:
|
||||
free (buffer);
|
||||
result = 0;
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* my_locale
|
||||
*/
|
||||
int my_locale (void)
|
||||
{
|
||||
const char *locale;
|
||||
|
||||
locale = setlocale (LC_ALL, "");
|
||||
if (!locale) {
|
||||
locale = setlocale (LC_ALL, NULL);
|
||||
Vprintf ("Failed to set locale, using default '%s'.\n", locale);
|
||||
return 1;
|
||||
} else {
|
||||
Vprintf ("Using locale '%s'.\n", locale);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* get_vol
|
||||
*/
|
||||
ntfs_volume * get_vol (const char *device, unsigned long flags, BOOL force)
|
||||
{
|
||||
ntfs_volume *vol;
|
||||
|
||||
if (!device)
|
||||
return NULL;
|
||||
|
||||
if (!valid_device (device, force))
|
||||
return NULL;
|
||||
|
||||
vol = ntfs_mount (device, MS_RDONLY);
|
||||
if (!vol) {
|
||||
Eprintf ("Couldn't mount device '%s': %s\n", device, strerror (errno));
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if (vol->flags & VOLUME_IS_DIRTY) {
|
||||
Iprintf ("Volume is dirty.\n");
|
||||
if (!force) {
|
||||
Eprintf ("Run chkdsk and try again, or use the --force option.\n");
|
||||
ntfs_umount (vol, FALSE);
|
||||
return NULL;
|
||||
}
|
||||
Iprintf ("Forced to continue.\n");
|
||||
}
|
||||
|
||||
return vol;
|
||||
}
|
||||
|
||||
/**
|
||||
* main - Begin here
|
||||
*
|
||||
* Start from here.
|
||||
*
|
||||
* Return: 0 Success, the program worked
|
||||
* 1 Error, something went wrong
|
||||
*/
|
||||
int main (int argc, char *argv[])
|
||||
{
|
||||
ntfs_volume *vol;
|
||||
int result;
|
||||
|
||||
if (!parse_options (argc, argv))
|
||||
return 1;
|
||||
|
||||
my_locale();
|
||||
|
||||
vol = get_vol (opts.device, MS_RDONLY, opts.force);
|
||||
if (!vol)
|
||||
return 1;
|
||||
|
||||
#if 0
|
||||
if (opts.info) {
|
||||
//result = get_info (vol);
|
||||
} else if (opts.cluster) {
|
||||
result = cluster_find (vol, opts.cluster);
|
||||
} else if (opts.sector) {
|
||||
//result =
|
||||
} else {
|
||||
//result =
|
||||
}
|
||||
#endif
|
||||
//opts.cluster_end = LONG_MAX;
|
||||
printf ("Searching for cluster range %lld-%lld\n", opts.cluster_begin, opts.cluster_end);
|
||||
result = cluster_find (vol, opts.cluster_begin, opts.cluster_end);
|
||||
|
||||
ntfs_umount (vol, FALSE);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
/*
|
||||
* ntfscluster - Part of the Linux-NTFS project.
|
||||
*
|
||||
* Copyright (c) 2002 Richard Russon <ntfs@flatcap.org>
|
||||
*
|
||||
* This utility will XXX
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program (in the main directory of the Linux-NTFS
|
||||
* distribution in the file COPYING); if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#ifndef _NTFSCLUSTER_H_
|
||||
#define _NTFSCLUSTER_H_
|
||||
|
||||
#include "types.h"
|
||||
|
||||
struct options {
|
||||
char *device; /* Device/File to work with */
|
||||
int info; /* Show volume info */
|
||||
int quiet; /* Less output */
|
||||
int verbose; /* Extra output */
|
||||
int force; /* Override common sense */
|
||||
u64 sector_begin; /* Look for objects in this range of sectors */
|
||||
u64 sector_end;
|
||||
u64 cluster_begin; /* Look for objects in this range of clusters */
|
||||
u64 cluster_end;
|
||||
};
|
||||
|
||||
#endif /* _NTFSCLUSTER_H_ */
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,257 @@
|
|||
/**
|
||||
* utils.c - Part of the Linux-NTFS project.
|
||||
*
|
||||
* Copyright (c) 2002 Richard Russon <ntfs@flatcap.org>
|
||||
*
|
||||
* This utility will recover deleted files from an NTFS volume.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program (in the main directory of the Linux-NTFS
|
||||
* distribution in the file COPYING); if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdarg.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "config.h"
|
||||
#include "types.h"
|
||||
#include "volume.h"
|
||||
#include "debug.h"
|
||||
|
||||
#define NTFS_TIME_OFFSET ((s64)(369 * 365 + 89) * 24 * 3600 * 10000000)
|
||||
|
||||
/**
|
||||
* ntfs2utc - Convert an NTFS time to Unix time
|
||||
* @time: An NTFS time in 100ns units since 1601
|
||||
*
|
||||
* NTFS stores times as the number of 100ns intervals since January 1st 1601 at
|
||||
* 00:00 UTC. This system will not suffer from Y2K problems until ~57000AD.
|
||||
*
|
||||
* Return: n A Unix time (number of seconds since 1970)
|
||||
*/
|
||||
time_t ntfs2utc (s64 time)
|
||||
{
|
||||
return (time - (NTFS_TIME_OFFSET)) / 10000000;
|
||||
}
|
||||
|
||||
/**
|
||||
* utc2ntfs - convert Linux time to NTFS time
|
||||
* @time: Linux time to convert to NTFS
|
||||
*
|
||||
* Convert the Linux time @time to its corresponding NTFS time.
|
||||
*
|
||||
* Linux stores time in a long at present and measures it as the number of
|
||||
* 1-second intervals since 1st January 1970, 00:00:00 UTC.
|
||||
*
|
||||
* NTFS uses Microsoft's standard time format which is stored in a s64 and is
|
||||
* measured as the number of 100 nano-second intervals since 1st January 1601,
|
||||
* 00:00:00 UTC.
|
||||
*
|
||||
* Return: n An NTFS time (100ns units since Jan 1601)
|
||||
*/
|
||||
s64 utc2ntfs (time_t time)
|
||||
{
|
||||
/* Convert to 100ns intervals and then add the NTFS time offset. */
|
||||
return (s64)time * 10000000 + NTFS_TIME_OFFSET;
|
||||
}
|
||||
|
||||
|
||||
/* valid_device requires the following */
|
||||
extern int Eprintf (const char *format, ...) __attribute__ ((format (printf, 1, 2)));
|
||||
extern int Vprintf (const char *format, ...) __attribute__ ((format (printf, 1, 2)));
|
||||
|
||||
/**
|
||||
* valid_device - Perform some safety checks on the device, before we start
|
||||
* @name: Full pathname of the device/file to work with
|
||||
* @force: Continue regardless of problems
|
||||
*
|
||||
* Check that the name refers to a device and that is isn't already mounted.
|
||||
* These checks can be overridden by using the force option.
|
||||
*
|
||||
* Return: 1 Success, we can continue
|
||||
* 0 Error, we cannot use this device
|
||||
*/
|
||||
int valid_device (const char *name, int force)
|
||||
{
|
||||
unsigned long mnt_flags = 0;
|
||||
struct stat st;
|
||||
|
||||
if (stat (name, &st) == -1) {
|
||||
if (errno == ENOENT) {
|
||||
Eprintf ("The device %s doesn't exist\n", name);
|
||||
} else {
|
||||
Eprintf ("Error getting information about %s: %s\n", name, strerror (errno));
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (!S_ISBLK (st.st_mode)) {
|
||||
Vprintf ("%s is not a block device.\n", name);
|
||||
if (!force) {
|
||||
Eprintf ("Use the force option to work with files.\n");
|
||||
return 0;
|
||||
}
|
||||
Vprintf ("Forced to continue.\n");
|
||||
}
|
||||
|
||||
/* Make sure the file system is not mounted. */
|
||||
if (ntfs_check_if_mounted (name, &mnt_flags)) {
|
||||
Vprintf ("Failed to determine whether %s is mounted: %s\n", name, strerror (errno));
|
||||
if (!force) {
|
||||
Eprintf ("Use the force option to ignore this error.\n");
|
||||
return 0;
|
||||
}
|
||||
Vprintf ("Forced to continue.\n");
|
||||
} else if (mnt_flags & NTFS_MF_MOUNTED) {
|
||||
Vprintf ("The device %s, is mounted.\n", name);
|
||||
if (!force) {
|
||||
Eprintf ("Use the force option to work a mounted filesystem.\n");
|
||||
return 0;
|
||||
}
|
||||
Vprintf ("Forced to continue.\n");
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* find_attribute - Find an attribute of the given type
|
||||
* @type: An attribute type, e.g. AT_FILE_NAME
|
||||
* @ctx: A search context, created using ntfs_get_attr_search_ctx
|
||||
*
|
||||
* Using the search context to keep track, find the first/next occurrence of a
|
||||
* given attribute type.
|
||||
*
|
||||
* N.B. This will return a pointer into @mft. As long as the search context
|
||||
* has been created without an inode, it won't overflow the buffer.
|
||||
*
|
||||
* Return: Pointer Success, an attribute was found
|
||||
* NULL Error, no matching attributes were found
|
||||
*/
|
||||
ATTR_RECORD * find_attribute (const ATTR_TYPES type, ntfs_attr_search_ctx *ctx)
|
||||
{
|
||||
if (!ctx)
|
||||
return NULL;
|
||||
|
||||
if (ntfs_attr_lookup(type, NULL, 0, 0, 0, NULL, 0, ctx) != 0) {
|
||||
Dprintf ("find_attribute didn't find an attribute of type: 0x%02x.\n", type);
|
||||
return NULL; /* None / no more of that type */
|
||||
}
|
||||
|
||||
Dprintf ("find_attribute found an attribute of type: 0x%02x.\n", type);
|
||||
return ctx->attr;
|
||||
}
|
||||
|
||||
/**
|
||||
* find_first_attribute - Find the first attribute of a given type
|
||||
* @type: An attribute type, e.g. AT_FILE_NAME
|
||||
* @mft: A buffer containing a raw MFT record
|
||||
*
|
||||
* Search through a raw MFT record for an attribute of a given type.
|
||||
* The return value is a pointer into the MFT record that was supplied.
|
||||
*
|
||||
* N.B. This will return a pointer into @mft. The pointer won't stray outside
|
||||
* the buffer, since we created the search context without an inode.
|
||||
*
|
||||
* Return: Pointer Success, an attribute was found
|
||||
* NULL Error, no matching attributes were found
|
||||
*/
|
||||
ATTR_RECORD * find_first_attribute (const ATTR_TYPES type, MFT_RECORD *mft)
|
||||
{
|
||||
ntfs_attr_search_ctx *ctx;
|
||||
ATTR_RECORD *rec;
|
||||
|
||||
if (!mft)
|
||||
return NULL;
|
||||
|
||||
ctx = ntfs_attr_get_search_ctx(NULL, mft);
|
||||
if (!ctx) {
|
||||
Eprintf ("Couldn't create a search context.\n");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
rec = find_attribute (type, ctx);
|
||||
ntfs_attr_put_search_ctx(ctx);
|
||||
if (rec)
|
||||
Dprintf ("find_first_attribute: found attr of type 0x%02x.\n", type);
|
||||
else
|
||||
Dprintf ("find_first_attribute: didn't find attr of type 0x%02x.\n", type);
|
||||
return rec;
|
||||
}
|
||||
|
||||
|
||||
#if 0
|
||||
hamming weight
|
||||
inline unsigned int hweight32(unsigned int w)
|
||||
{
|
||||
unsigned int res = (w & 0x55555555) + ((w >> 1) & 0x55555555);
|
||||
res = (res & 0x33333333) + ((res >> 2) & 0x33333333);
|
||||
res = (res & 0x0F0F0F0F) + ((res >> 4) & 0x0F0F0F0F);
|
||||
res = (res & 0x00FF00FF) + ((res >> 8) & 0x00FF00FF);
|
||||
return (res & 0x0000FFFF) + ((res >> 16) & 0x0000FFFF);
|
||||
}
|
||||
|
||||
inline unsigned int hweight16(unsigned int w)
|
||||
{
|
||||
unsigned int res = (w & 0x5555) + ((w >> 1) & 0x5555);
|
||||
res = (res & 0x3333) + ((res >> 2) & 0x3333);
|
||||
res = (res & 0x0F0F) + ((res >> 4) & 0x0F0F);
|
||||
return (res & 0x00FF) + ((res >> 8) & 0x00FF);
|
||||
}
|
||||
|
||||
inline unsigned int hweight8(unsigned int w)
|
||||
{
|
||||
unsigned int res = (w & 0x55) + ((w >> 1) & 0x55);
|
||||
res = (res & 0x33) + ((res >> 2) & 0x33);
|
||||
return (res & 0x0F) + ((res >> 4) & 0x0F);
|
||||
}
|
||||
|
||||
inline int set_bit(int nr,long * addr)
|
||||
{
|
||||
int mask, retval;
|
||||
|
||||
addr += nr >> 5;
|
||||
mask = 1 << (nr & 0x1f);
|
||||
retval = (mask & *addr) != 0;
|
||||
*addr |= mask;
|
||||
return retval;
|
||||
}
|
||||
|
||||
inline int clear_bit(int nr, long * addr)
|
||||
{
|
||||
int mask, retval;
|
||||
|
||||
addr += nr >> 5;
|
||||
mask = 1 << (nr & 0x1f);
|
||||
retval = (mask & *addr) != 0;
|
||||
*addr &= ~mask;
|
||||
return retval;
|
||||
}
|
||||
|
||||
inline int test_bit(int nr, long * addr)
|
||||
{
|
||||
int mask;
|
||||
|
||||
addr += nr >> 5;
|
||||
mask = 1 << (nr & 0x1f);
|
||||
return ((mask & *addr) != 0);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
/*
|
||||
* utils.c - Part of the Linux-NTFS project.
|
||||
*
|
||||
* Copyright (c) 2002 Richard Russon <ntfs@flatcap.org>
|
||||
*
|
||||
* This utility will recover deleted files from an NTFS volume.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program (in the main directory of the Linux-NTFS
|
||||
* distribution in the file COPYING); if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#ifndef _NTFS_UTILS_H_
|
||||
#define _NTFS_UTILS_H_
|
||||
|
||||
#include "types.h"
|
||||
#include "layout.h"
|
||||
|
||||
#define GEN_PRINTF(NAME, STREAM, CONTROL, TRIGGER) \
|
||||
__attribute__ ((format (printf, 1, 2))) \
|
||||
int NAME (const char *format, ...) \
|
||||
{ \
|
||||
int ret, olderr = errno, *control = (CONTROL); \
|
||||
va_list args; \
|
||||
\
|
||||
if (!(STREAM)) \
|
||||
return -1; \
|
||||
if (control && \
|
||||
((*control && !(TRIGGER)) || (!*control && (TRIGGER)))) \
|
||||
return -1; \
|
||||
\
|
||||
va_start (args, format); \
|
||||
ret = vfprintf ((STREAM), format, args); \
|
||||
va_end (args); \
|
||||
errno = olderr; \
|
||||
return ret; \
|
||||
}
|
||||
|
||||
struct _IO_FILE;
|
||||
|
||||
int ntfs_printf (struct _IO_FILE *stream, int *control, BOOL trigger,
|
||||
const char *format, ...) __attribute__ ((format (printf, 4, 5)));
|
||||
|
||||
int valid_device (const char *name, int force);
|
||||
|
||||
time_t ntfs2utc (s64 time);
|
||||
s64 utc2ntfs (time_t time);
|
||||
|
||||
ATTR_RECORD * find_attribute (const ATTR_TYPES type, ntfs_attr_search_ctx *ctx);
|
||||
ATTR_RECORD * find_first_attribute (const ATTR_TYPES type, MFT_RECORD *mft);
|
||||
|
||||
#endif /* _NTFS_UTILS_H_ */
|
||||
Loading…
Reference in New Issue