int log_fat2_info(const struct fat_boot_sector*fh1, const struct fat_boot_sector*fh2, const upart_type_t upart_type, const unsigned int sector_size) { switch(upart_type) { case UP_FAT12: log_info("\nFAT12\n"); break; case UP_FAT16: log_info("\nFAT16\n"); break; case UP_FAT32: log_info("\nFAT32\n"); break; default: return 1; } log_info("sector_size %u %u\n", fat_sector_size(fh1),fat_sector_size(fh2)); log_info("cluster_size %u %u\n", fh1->sectors_per_cluster,fh2->sectors_per_cluster); log_info("reserved %u %u\n", le16(fh1->reserved),le16(fh2->reserved)); log_info("fats %u %u\n", fh1->fats,fh2->fats); log_info("dir_entries %u %u\n", get_dir_entries(fh1),get_dir_entries(fh2)); log_info("sectors %u %u\n", fat_sectors(fh1),fat_sectors(fh2)); log_info("media %02X %02X\n", fh1->media,fh2->media); log_info("fat_length %u %u\n", le16(fh1->fat_length),le16(fh2->fat_length)); log_info("secs_track %u %u\n", le16(fh1->secs_track),le16(fh2->secs_track)); log_info("heads %u %u\n", le16(fh1->heads),le16(fh2->heads)); log_info("hidden %u %u\n", (unsigned int)le32(fh1->hidden),(unsigned int)le32(fh2->hidden)); log_info("total_sect %u %u\n", (unsigned int)le32(fh1->total_sect),(unsigned int)le32(fh2->total_sect)); if(upart_type==UP_FAT32) { log_info("fat32_length %u %u\n", (unsigned int)le32(fh1->fat32_length),(unsigned int)le32(fh2->fat32_length)); log_info("flags %04X %04X\n", le16(fh1->flags),le16(fh2->flags)); log_info("version %u.%u %u.%u\n", fh1->version[0], fh1->version[1],fh2->version[0], fh2->version[1]); log_info("root_cluster %u %u\n", (unsigned int)le32(fh1->root_cluster),(unsigned int)le32(fh2->root_cluster)); log_info("info_sector %u %u\n", le16(fh1->info_sector),le16(fh2->info_sector)); log_info("backup_boot %u %u\n", le16(fh1->backup_boot),le16(fh2->backup_boot)); log_info("free_count "); if(fat32_get_free_count((const unsigned char*)fh1,sector_size)==0xFFFFFFFF) log_info("uninitialised "); else log_info("%lu ",fat32_get_free_count((const unsigned char*)fh1,sector_size)); if(fat32_get_free_count((const unsigned char*)fh2,sector_size)==0xFFFFFFFF) log_info("uninitialised"); else log_info("%lu",fat32_get_free_count((const unsigned char*)fh2,sector_size)); log_info("\nnext_free "); if(fat32_get_next_free((const unsigned char*)fh1,sector_size)==0xFFFFFFFF) log_info("uninitialised "); else log_info("%lu ",fat32_get_next_free((const unsigned char*)fh1,sector_size)); if(fat32_get_next_free((const unsigned char*)fh2,sector_size)==0xFFFFFFFF) log_info("uninitialised\n"); else log_info("%lu\n",fat32_get_next_free((const unsigned char*)fh2,sector_size)); } return 0; }
static int test_HPFS(disk_t *disk_car,const struct fat_boot_sector *hpfs_header, partition_t *partition,const int verbose, const int dump_ind) { const char*buffer=(const char*)hpfs_header; if(le16(hpfs_header->marker)==0xAA55) { if(memcmp(buffer+OS2_NAME,"IBM",3)==0) { /* D'apres une analyse de OS2 sur systeme FAT... FAT_NAME1=FAT */ if(verbose||dump_ind) { log_info("\nHPFS maybe at %u/%u/%u\n", offset2cylinder(disk_car,partition->part_offset), offset2head(disk_car,partition->part_offset), offset2sector(disk_car,partition->part_offset)); } if(dump_ind!=0) dump_log(buffer, DEFAULT_SECTOR_SIZE); partition->part_size=(uint64_t)(fat_sectors(hpfs_header)>0?fat_sectors(hpfs_header):le32(hpfs_header->total_sect)) * fat_sector_size(hpfs_header); partition->upart_type=UP_HPFS; return 0; } } /* fin marqueur de fin :)) */ return 1; }
static int log_fat_info(const struct fat_boot_sector*fh1, const upart_type_t upart_type, const unsigned int sector_size) { log_info("sector_size %u\n", fat_sector_size(fh1)); log_info("cluster_size %u\n", fh1->sectors_per_cluster); log_info("reserved %u\n", le16(fh1->reserved)); log_info("fats %u\n", fh1->fats); log_info("dir_entries %u\n", get_dir_entries(fh1)); log_info("sectors %u\n", fat_sectors(fh1)); log_info("media %02X\n", fh1->media); log_info("fat_length %u\n", le16(fh1->fat_length)); log_info("secs_track %u\n", le16(fh1->secs_track)); log_info("heads %u\n", le16(fh1->heads)); log_info("hidden %u\n", (unsigned int)le32(fh1->hidden)); log_info("total_sect %u\n", (unsigned int)le32(fh1->total_sect)); if(upart_type==UP_FAT32) { log_info("fat32_length %u\n", (unsigned int)le32(fh1->fat32_length)); log_info("flags %04X\n", le16(fh1->flags)); log_info("version %u.%u\n", fh1->version[0], fh1->version[1]); log_info("root_cluster %u\n", (unsigned int)le32(fh1->root_cluster)); log_info("info_sector %u\n", le16(fh1->info_sector)); log_info("backup_boot %u\n", le16(fh1->backup_boot)); if(fat32_get_free_count((const unsigned char*)fh1,sector_size)==0xFFFFFFFF) log_info("free_count uninitialised\n"); else log_info("free_count %lu\n",fat32_get_free_count((const unsigned char*)fh1,sector_size)); if(fat32_get_next_free((const unsigned char*)fh1,sector_size)==0xFFFFFFFF) log_info("next_free uninitialised\n"); else log_info("next_free %lu\n",fat32_get_next_free((const unsigned char*)fh1,sector_size)); } return 0; }
static int get_geometry_from_nonembr(const unsigned char *buffer, const int verbose, CHSgeometry_t *geometry) { { /* Ugly hack to get geometry from FAT and NTFS */ const struct fat_boot_sector *fat_header=(const struct fat_boot_sector *)buffer; if(le16(fat_header->marker)==0xAA55) { if(le16(fat_header->secs_track)>0 && le16(fat_header->secs_track)<=63 && le16(fat_header->heads)>0 && le16(fat_header->heads)<=255 && fat_sector_size(fat_header)>0 && fat_sector_size(fat_header)%512==0) { geometry->sectors_per_head=le16(fat_header->secs_track); geometry->heads_per_cylinder=le16(fat_header->heads); geometry->bytes_per_sector=fat_sector_size(fat_header); } } } return 0; }
static int set_FAT_info(disk_t *disk_car, const struct fat_boot_sector *fat_header, partition_t *partition) { const char*buffer=(const char*)fat_header; partition->fsname[0]='\0'; partition->blocksize=fat_sector_size(fat_header)* fat_header->sectors_per_cluster; switch(partition->upart_type) { case UP_FAT12: snprintf(partition->info, sizeof(partition->info), "FAT12, blocksize=%u", partition->blocksize); if(buffer[38]==0x29) /* BS_BootSig */ { set_part_name_chomp(partition,((const unsigned char*)fat_header)+FAT1X_PART_NAME,11); if(check_VFAT_volume_name(partition->fsname, 11)) partition->fsname[0]='\0'; } break; case UP_FAT16: snprintf(partition->info, sizeof(partition->info), "FAT16, blocksize=%u", partition->blocksize); if(buffer[38]==0x29) /* BS_BootSig */ { set_part_name_chomp(partition,((const unsigned char*)fat_header)+FAT1X_PART_NAME,11); if(check_VFAT_volume_name(partition->fsname, 11)) partition->fsname[0]='\0'; } break; case UP_FAT32: if(partition->sb_offset==0) snprintf(partition->info, sizeof(partition->info), "FAT32, blocksize=%u", partition->blocksize); else snprintf(partition->info, sizeof(partition->info), "FAT32 found using backup sector, blocksize=%u", partition->blocksize); fat32_set_part_name(disk_car,partition,fat_header); break; default: log_critical("set_FAT_info unknown upart_type\n"); return 1; } return 0; }
static int header_check_fat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new) { const struct fat_boot_sector *fat_header=(const struct fat_boot_sector *)buffer; uint64_t start_fat1,start_data,part_size; unsigned long int no_of_cluster,fat_length,fat_length_calc; if(!(le16(fat_header->marker)==0xAA55 && (fat_header->ignored[0]==0xeb || fat_header->ignored[0]==0xe9) && (fat_header->fats==1 || fat_header->fats==2))) return 0; /* Obviously not a FAT */ if(!((fat_header->ignored[0]==0xeb && fat_header->ignored[2]==0x90)||fat_header->ignored[0]==0xe9)) return 0; if(fat_sector_size(fat_header)==0 || fat_sector_size(fat_header)%512!=0) return 0; switch(fat_header->sectors_per_cluster) { case 1: case 2: case 4: case 8: case 16: case 32: case 64: case 128: break; default: return 0; } if(fat_header->fats!=1 && fat_header->fats!=2) return 0; if(fat_header->media!=0xF0 && fat_header->media<0xF8) return 0; fat_length=le16(fat_header->fat_length)>0?le16(fat_header->fat_length):le32(fat_header->fat32_length); part_size=(sectors(fat_header)>0?sectors(fat_header):le32(fat_header->total_sect)); start_fat1=le16(fat_header->reserved); start_data=start_fat1+fat_header->fats*fat_length+(get_dir_entries(fat_header)*32+fat_sector_size(fat_header)-1)/fat_sector_size(fat_header); no_of_cluster=(part_size-start_data)/fat_header->sectors_per_cluster; if(no_of_cluster<4085) { /* FAT12 */ if((get_dir_entries(fat_header)==0)||(get_dir_entries(fat_header)%16!=0)) return 0; if((le16(fat_header->fat_length)>256)||(le16(fat_header->fat_length)==0)) return 0; fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)*2/3-1)*3/2/fat_sector_size(fat_header)); } else if(no_of_cluster<65525) { /* FAT16 */ if(le16(fat_header->fat_length)==0) return 0; if((get_dir_entries(fat_header)==0)||(get_dir_entries(fat_header)%16!=0)) return 0; fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)/2-1)*2/fat_sector_size(fat_header)); } else { /* FAT32 */ if(sectors(fat_header)!=0) return 0; if(get_dir_entries(fat_header)!=0) return 0; if((le32(fat_header->root_cluster)<2) ||(le32(fat_header->root_cluster)>=2+no_of_cluster)) return 0; fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)/4-1)*4/fat_sector_size(fat_header)); } if(fat_length<fat_length_calc) return 0; reset_file_recovery(file_recovery_new); file_recovery_new->extension=file_hint_fat.extension; file_recovery_new->calculated_file_size=(uint64_t) (sectors(fat_header)>0?sectors(fat_header):le32(fat_header->total_sect)) * fat_sector_size(fat_header); file_recovery_new->data_check=&data_check_size; file_recovery_new->file_check=&file_check_size; return 1; }