Make --metadata work with the new $Logfile checking code.
Save at least the first 16 KiB of $Logfile (the two RSTR records should always be included if present). Save also records used for checking empty $Logfile. (Szaka) (Logical change 1.691)edge.strict_endians
parent
defa17062c
commit
c5f5dfb4c3
|
@ -422,8 +422,8 @@ static s64 is_critical_metadata(ntfs_walk_clusters_ctx *image, runlist *rl)
|
||||||
|
|
||||||
if (image->ctx->attr->type == AT_DATA) {
|
if (image->ctx->attr->type == AT_DATA) {
|
||||||
|
|
||||||
/* Save at least the first 8 KiB of FILE_LogFile */
|
/* Save at least the first 16 KiB of FILE_LogFile */
|
||||||
s64 s = (s64)8192 - rl->vcn * vol->cluster_size;
|
s64 s = (s64)16384 - rl->vcn * vol->cluster_size;
|
||||||
if (s > 0) {
|
if (s > 0) {
|
||||||
s = rounded_up_division(s, vol->cluster_size);
|
s = rounded_up_division(s, vol->cluster_size);
|
||||||
if (rl->length < s)
|
if (rl->length < s)
|
||||||
|
@ -699,6 +699,27 @@ static void wipe_resident_data(ntfs_walk_clusters_ctx *image)
|
||||||
wiped_resident_data += n;
|
wiped_resident_data += n;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void clone_logfile_parts(ntfs_walk_clusters_ctx *image, runlist *rl)
|
||||||
|
{
|
||||||
|
s64 offset = 0, lcn, vcn;
|
||||||
|
|
||||||
|
while (1) {
|
||||||
|
|
||||||
|
vcn = offset / image->ni->vol->cluster_size;
|
||||||
|
lcn = ntfs_rl_vcn_to_lcn(rl, vcn);
|
||||||
|
if (lcn < 0)
|
||||||
|
break;
|
||||||
|
|
||||||
|
lseek_to_cluster(lcn);
|
||||||
|
copy_cluster();
|
||||||
|
|
||||||
|
if (offset == 0)
|
||||||
|
offset = NTFS_BLOCK_SIZE >> 1;
|
||||||
|
else
|
||||||
|
offset <<= 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
static void walk_runs(struct ntfs_walk_cluster *walk)
|
static void walk_runs(struct ntfs_walk_cluster *walk)
|
||||||
{
|
{
|
||||||
int i, j;
|
int i, j;
|
||||||
|
@ -747,6 +768,10 @@ static void walk_runs(struct ntfs_walk_cluster *walk)
|
||||||
|
|
||||||
walk->image->inuse += lcn_length;
|
walk->image->inuse += lcn_length;
|
||||||
}
|
}
|
||||||
|
if (!wipe && !opt.std_out && opt.metadata_only &&
|
||||||
|
walk->image->ni->mft_no == FILE_LogFile &&
|
||||||
|
walk->image->ctx->attr->type == AT_DATA)
|
||||||
|
clone_logfile_parts(walk->image, rl);
|
||||||
|
|
||||||
free(rl);
|
free(rl);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue