Exemplo n.º 1
0
Arquivo: jfs.c Projeto: Tom9X/TestDisk
/*
Primary superblock is at 0x8000
*/
int recover_JFS(disk_t *disk_car, const struct jfs_superblock *sb,partition_t *partition,const int verbose, const int dump_ind)
{
  if(test_JFS(disk_car, sb, partition, dump_ind)!=0)
    return 1;
  set_JFS_info(sb, partition);
  partition->part_type_i386=P_LINUX;
  partition->part_type_sun=PSUN_LINUX;
  partition->part_type_mac=PMAC_LINUX;
  partition->part_type_gpt=GPT_ENT_TYPE_LINUX_DATA;
  partition->part_size=(uint64_t)le32(sb->s_pbsize) * le64(sb->s_size) +
    le32(sb->s_bsize) * (le24(sb->s_fsckpxd.len)+le24(sb->s_logpxd.len));
  partition->sborg_offset=64*512;
  partition->sb_size=JFS_SUPERBLOCK_SIZE;
  partition->sb_offset=0;
  guid_cpy(&partition->part_uuid, (const efi_guid_t *)&sb->s_uuid);
  if(verbose>0)
  {
    log_info("\n");
    log_info("recover_JFS: s_blocksize=%u\n",partition->blocksize);
    log_info("recover_JFS: s_size %lu\n",(long unsigned int)le64(sb->s_size));
    log_info("recover_JFS: s_fsckpxd.len:%d\n", (int)le24(sb->s_fsckpxd.len));
    log_info("recover_JFS: s_logpxd.len:%d\n", (int)le24(sb->s_logpxd.len));
    log_info("recover_JFS: part_size %lu\n",(long unsigned)(partition->part_size/disk_car->sector_size));
  }
  return 0;
}
Exemplo n.º 2
0
int recover_EXFAT(const disk_t *disk, const struct exfat_super_block *exfat_header, partition_t *partition)
{
  if(test_EXFAT(exfat_header)!=0)
    return 1;
  partition->sborg_offset=0;
  partition->sb_size=12 << exfat_header->blocksize_bits;
  partition->part_type_i386=P_EXFAT;
  partition->part_type_gpt=GPT_ENT_TYPE_MS_BASIC_DATA;
  partition->part_size=(uint64_t)le64(exfat_header->nr_sectors) * disk->sector_size;
#ifdef DEBUG_EXFAT
  log_info("recover_EXFAT:\n");
  log_info("start_sector=%llu\n", (long long unsigned)le64(exfat_header->start_sector));
  log_info("blocksize=%u\n", (12<<exfat_header->blocksize_bits));
  log_info("part_offset=%llu\n", partition->part_offset);
#endif
  if((le64(exfat_header->start_sector) * disk ->sector_size +
      (12 << exfat_header->blocksize_bits) == partition->part_offset) ||
    (disk->arch==&arch_none && (12 << exfat_header->blocksize_bits) == partition->part_offset))
  {
    partition->sb_offset=12 << exfat_header->blocksize_bits;
    partition->part_offset-=partition->sb_offset;
  }
  set_EXFAT_info(partition, exfat_header);
  return 0;
}
Exemplo n.º 3
0
static int header_check_indd(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
  const struct InDesignMasterPage *hdr;
  const struct InDesignMasterPage *hdr0 = (const struct InDesignMasterPage *)buffer;
  const struct InDesignMasterPage *hdr1 = (const struct InDesignMasterPage *)&buffer[4096];
  hdr=(le64(hdr0->fSequenceNumber) > le64(hdr1->fSequenceNumber) ? hdr0 : hdr1);
  if(hdr->fObjectStreamEndian!=1 && hdr->fObjectStreamEndian!=2)
    return 0;
  if(le32(hdr->fFilePages)==0)
    return 0;
  if(file_recovery->file_stat!=NULL &&
      file_recovery->file_stat->file_hint==&file_hint_indd)
  {
    if(header_ignored_adv(file_recovery, file_recovery_new)==0)
      return 0;
  }
  reset_file_recovery(file_recovery_new);
#ifdef DJGPP
  file_recovery_new->extension="ind";
#else
  file_recovery_new->extension=file_hint_indd.extension;
#endif
  /* Contiguous object pages may follow, file_check_indd will search for them */
  file_recovery_new->calculated_file_size=(uint64_t)(le32(hdr->fFilePages))*4096;
  file_recovery_new->file_check=&file_check_indd;
#ifdef DEBUG_INDD
  log_info("header_check_indd: Guessed length: %llu.\n", (long long unsigned)file_recovery_new->calculated_file_size);
#endif
  return 1;
}
Exemplo n.º 4
0
static int header_check_elf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
  const Elf32_Ehdr *hdr32=(const Elf32_Ehdr *)buffer;
  if(hdr32->e_ident[EI_DATA]!=ELFDATA2LSB && hdr32->e_ident[EI_DATA]!=ELFDATA2MSB)
    return 0;
  if((hdr32->e_ident[EI_DATA]==ELFDATA2LSB ? le32(hdr32->e_version) : be32(hdr32->e_version)) != 1)
    return 0;
  /* http://en.wikipedia.org/wiki/Executable_and_Linkable_Format */
  reset_file_recovery(file_recovery_new);
  file_recovery_new->extension=file_hint_elf.extension;
  if(hdr32->e_ident[EI_CLASS]==ELFCLASS32)
  {
    const uint32_t tmp=(hdr32->e_ident[EI_DATA]==ELFDATA2LSB ? le32(hdr32->e_shoff) : be32(hdr32->e_shoff));
    file_recovery_new->min_filesize=(hdr32->e_ident[EI_DATA]==ELFDATA2LSB ? le32(hdr32->e_phoff) : be32(hdr32->e_phoff));
    if(file_recovery_new->min_filesize < tmp)
      file_recovery_new->min_filesize=tmp;
  }
  else
  {
    const Elf64_Ehdr *hdr64=(const Elf64_Ehdr *)buffer;
    const uint64_t tmp=(hdr64->e_ident[EI_DATA]==ELFDATA2LSB ? le64(hdr64->e_shoff) : be64(hdr64->e_shoff));
    file_recovery_new->min_filesize=(hdr64->e_ident[EI_DATA]==ELFDATA2LSB ? le64(hdr64->e_phoff) : be64(hdr64->e_phoff));
    if(file_recovery_new->min_filesize < tmp)
      file_recovery_new->min_filesize=tmp;
  }
  return 1;
}
int PartitionHandle::CheckGPT(int PartNum)
{
	GPT_HEADER *gpt_header = (GPT_HEADER *) malloc(MAX_SECTOR_SIZE);
	if(!gpt_header)
		return -1;

	// Read and validate the extended boot record
	if (!interface->readSectors(1, 1, gpt_header)) {
		free(gpt_header);
		return -1;
	}

	if(strncmp(gpt_header->magic, "EFI PART", 8) != 0) {
		free(gpt_header);
		return -1;
	}

	gpt_header->part_table_lba = le64(gpt_header->part_table_lba);
	gpt_header->part_entries = le32(gpt_header->part_entries);
	gpt_header->part_entry_size = le32(gpt_header->part_entry_size);
	gpt_header->part_entry_checksum = le32(gpt_header->part_entry_checksum);

	u8 * sector_buf = (u8 *) malloc(MAX_SECTOR_SIZE);
	if(!sector_buf) {
		free(gpt_header);
		return -1;
	}

	u64 next_lba = gpt_header->part_table_lba;

	for(u32 i = 0; i < gpt_header->part_entries; ++i)
	{
		if (!interface->readSectors(next_lba, 1, sector_buf))
			break;

		for(u32 n = 0; n < sectorSize/gpt_header->part_entry_size; ++n, ++i)
		{
			GUID_PART_ENTRY * part_entry = (GUID_PART_ENTRY *) (sector_buf+gpt_header->part_entry_size*n);

			if(memcmp(part_entry->part_type_guid, TYPE_UNUSED, 16) == 0)
				continue;

			bool bootable = (memcmp(part_entry->part_type_guid, TYPE_BIOS, 16) == 0);

			AddPartition("GUID-Entry", le64(part_entry->part_first_lba), le64(part_entry->part_last_lba),
						 bootable, PARTITION_TYPE_GPT, PartNum);
		}

		next_lba++;
	}

	free(sector_buf);
	free(gpt_header);

	return 0;
}
Exemplo n.º 6
0
dir_partition_t dir_partition_exfat_init(disk_t *disk, const partition_t *partition, dir_data_t *dir_data, const int verbose)
{
  static struct exfat_dir_struct *ls;
  struct exfat_super_block *exfat_header;
  set_secwest();
  /* Load boot sector */
  exfat_header=(struct exfat_super_block *)MALLOC(0x200);
  if(disk->pread(disk, exfat_header, 0x200, partition->part_offset) != 0x200)
  {
    log_error("Can't read exFAT boot sector.\n");
    free(exfat_header);
    return DIR_PART_EIO;
  }
  if(le16(exfat_header->signature)!=0xAA55 ||
      memcmp(exfat_header->oem_id, "EXFAT   ", sizeof(exfat_header->oem_id))!=0)
  {
    log_error("Not an exFAT boot sector.\n");
    free(exfat_header);
    return DIR_PART_EIO;
  }
  ls=(struct exfat_dir_struct *)MALLOC(sizeof(*ls));
  ls->boot_sector=exfat_header;
#ifdef HAVE_ICONV
  if ((ls->cd = iconv_open("UTF-8", "UTF-16LE")) == (iconv_t)(-1))
  {
    log_error("dir_partition_exfat_init: iconv_open failed\n");
  }
#endif
#ifdef DEBUG_EXFAT
  log_info("start_sector=%llu\n", (long long unsigned)le64(exfat_header->start_sector));
  log_info("nr_sectors  =%llu\n", (long long unsigned)le64(exfat_header->nr_sectors));
  log_info("fat_blocknr =%u\n",le32(exfat_header->fat_blocknr));
  log_info("fat_block_counts=%u\n", le32(exfat_header->fat_block_counts));
  log_info("clus_blocknr=%u\n",	le32(exfat_header->clus_blocknr));
  log_info("total_clusters=%u\n",	le32(exfat_header->total_clusters));
  log_info("rootdir_clusnr=%u\n",	le32(exfat_header->rootdir_clusnr));
  log_info("serial_number=0x%08x\n", le32(exfat_header->serial_number));
  log_info("state=0x%x\n",	le16(exfat_header->state));
  log_info("blocksize_bits=%u\n",	exfat_header->blocksize_bits);
  log_info("block_per_clus_bits=%u\n",	exfat_header->block_per_clus_bits);
  log_info("number_of_fats=%u\n",		exfat_header->number_of_fats);
  log_info("drive_select=0x%x\n",		exfat_header->drive_select);
  log_info("allocated_percent=%u\n",	exfat_header->allocated_percent);
#endif
  strncpy(dir_data->current_directory,"/",sizeof(dir_data->current_directory));
  dir_data->current_inode=0;
  dir_data->param=FLAG_LIST_DELETED;
  dir_data->verbose=verbose;
  dir_data->capabilities=CAPA_LIST_DELETED;
  dir_data->copy_file=exfat_copy;
  dir_data->close=dir_partition_exfat_close;
  dir_data->local_dir=NULL;
  dir_data->private_dir_data=ls;
  dir_data->get_dir=exfat_dir;
  return DIR_PART_OK;
}
Exemplo n.º 7
0
static void partition_generate_gpt_entry(struct gpt_ent* gpt_entry, const partition_t *partition, const disk_t *disk_car)
{
  guid_cpy(&gpt_entry->ent_type, &partition->part_type_gpt);
  gpt_entry->ent_lba_start=le64(partition->part_offset / disk_car->sector_size);
  gpt_entry->ent_lba_end=le64((partition->part_offset + partition->part_size - 1) / disk_car->sector_size);
  str2UCSle((uint16_t *)&gpt_entry->ent_name, partition->partname, sizeof(gpt_entry->ent_name)/2);
  if(guid_cmp(partition->part_uuid, GPT_ENT_TYPE_UNUSED)!=0)
    guid_cpy(&gpt_entry->ent_uuid, &partition->part_uuid);
  else
    efi_generate_uuid(&gpt_entry->ent_uuid);
  gpt_entry->ent_attr=le64(0);  /* May need fixing */
}
Exemplo n.º 8
0
int recover_rfs(disk_t *disk_car, const struct reiserfs_super_block *sb,partition_t *partition,const int verbose, const int dump_ind)
{
  const struct reiser4_master_sb *sb4=(const struct reiser4_master_sb *)sb;
  if(test_rfs(disk_car, sb, partition, verbose)==0)
  {
    if(verbose>0 || dump_ind!=0)
    {
      log_info("\nrecover_rfs\n");
      log_info("block_count=%u\n",(unsigned int)le32(sb->s_block_count));
      log_info("block_size=%u\n",le16(sb->s_blocksize));
      if(dump_ind!=0)
      {
	dump_log(sb,DEFAULT_SECTOR_SIZE);
      }
    }
    partition->part_size = (uint64_t)le32(sb->s_block_count) * le16(sb->s_blocksize);
    partition->part_type_i386 = P_LINUX;
    partition->part_type_mac= PMAC_LINUX;
    partition->part_type_sun= PSUN_LINUX;
    partition->part_type_gpt=GPT_ENT_TYPE_LINUX_DATA;
    guid_cpy(&partition->part_uuid, (const efi_guid_t *)&sb->s_uuid);
    set_rfs_info(sb, partition);
    return 0;
  }
  if(test_rfs4(disk_car, sb4, partition, verbose)==0)
  {
    const struct format40_super *fmt40_super=(const struct format40_super *)((const char*)sb4+le16(sb4->blocksize));
    if(verbose>0 || dump_ind!=0)
    {
      log_info("\nrecover_rfs\n");
      log_info("block_count=%lu\n",(unsigned long int)le64(fmt40_super->sb_block_count));
      log_info("block_size=%u\n",le16(sb4->blocksize));
      if(dump_ind!=0)
      {
	dump_log(sb,DEFAULT_SECTOR_SIZE);
      }
    }
    partition->part_size = (uint64_t)le64(fmt40_super->sb_block_count) * le16(sb4->blocksize);
    partition->part_type_i386 = P_LINUX;
    partition->part_type_mac= PMAC_LINUX;
    partition->part_type_sun= PSUN_LINUX;
    partition->part_type_gpt=GPT_ENT_TYPE_LINUX_DATA;
    guid_cpy(&partition->part_uuid, (const efi_guid_t *)&sb4->uuid);
    set_rfs4_info(sb4, partition);
    return 0;
  }
  return 1;
}
Exemplo n.º 9
0
int recover_MD_from_partition(disk_t *disk_car, partition_t *partition, const int verbose)
{
  unsigned char *buffer=(unsigned char*)MALLOC(MD_SB_BYTES);
  /* MD version 0.90 */
  {
    uint64_t offset=MD_NEW_SIZE_SECTORS(partition->part_size/512)*512;
    if(disk_car->pread(disk_car, buffer, MD_SB_BYTES, partition->part_offset + offset) == MD_SB_BYTES)
    {
      if(recover_MD(disk_car,(struct mdp_superblock_s*)buffer,partition,verbose,0)==0)
      {
        free(buffer);
        return 0;
      }
    }
  }
  /* MD version 1.0 */
  if(partition->part_size > 8*2*512)
  {
    uint64_t offset=(((partition->part_size/512)-8*2) & ~(4*2-1))*512;
    if(disk_car->pread(disk_car, buffer, MD_SB_BYTES, partition->part_offset + offset) == MD_SB_BYTES)
    {
      const struct mdp_superblock_1 *sb1=(const struct mdp_superblock_1 *)buffer;
      if(le32(sb1->major_version)==1 &&
          recover_MD(disk_car,(struct mdp_superblock_s*)buffer,partition,verbose,0)==0)
      {
        partition->part_offset-=le64(sb1->super_offset)*512-offset;
        free(buffer);
        return 0;
      }
    }
  }
  /* md 1.1 & 1.2 don't need special operation to be recovered */
  free(buffer);
  return 1;
}
Exemplo n.º 10
0
static void file_check_axx(file_recovery_t *fr)
{
  uint64_t	offset=0x10;
  while(1)
  {
    struct SHeader header;
    unsigned int len;
    if(my_fseek(fr->handle, offset, SEEK_SET) < 0)
      return ;
    if (fread(&header, sizeof(header), 1, fr->handle)!=1)
      return ;
    len=le32(header.aoLength);
#ifdef DEBUG_AAX
    log_info("axx 0x%llx 0x%x 0x%x/%d\n", (long long int)offset, len, header.oType, header.oType);
#endif
    if(len<5)
      return ;
    offset+=len;
    if(header.oType==63) // eData
    {
      uint64_t fsize;
      if(len!=13)
	return ;
      if (fread(&fsize, sizeof(fsize), 1, fr->handle)!=1)
	return ;
      fsize=le64(fsize);
      offset+=fsize;
      fr->file_size=(fr->file_size < offset ? 0 : offset);
      return ;
    }
  }
}
Exemplo n.º 11
0
static int header_check_7z(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery,  file_recovery_t *file_recovery_new)
{
  if(memcmp(buffer, header_7z, sizeof(header_7z))==0)
  {
    const struct header_7z *buffer_7z=(const struct header_7z *)buffer;
    reset_file_recovery(file_recovery_new);
    file_recovery_new->extension=file_hint_7z.extension;
    file_recovery_new->min_filesize=31;
    /* Signature size 12 + Start header size 20 */
    file_recovery_new->calculated_file_size=(uint64_t)le64(buffer_7z->nextHeaderOffset)+
      le64(buffer_7z->nextHeaderSize) + 12 + 20;
    file_recovery_new->data_check=&data_check_size;
    file_recovery_new->file_check=&file_check_size;
    return 1;
  }
  return 0;
}
Exemplo n.º 12
0
static void search_add_hints(const disk_t *disk, uint64_t *try_offset, unsigned int *try_offset_nbr)
{
  if(disk->arch==&arch_i386)
  {
    /* sometimes users choose Intel instead of GPT */
    hint_insert(try_offset, 2*disk->sector_size+16384, try_offset_nbr);
    /* sometimes users don't choose Vista by mistake */
    hint_insert(try_offset, 2048*512, try_offset_nbr);
    /* try to deal with incorrect geometry */
    /* 0/1/1 */
    hint_insert(try_offset, 32 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 63 * disk->sector_size, try_offset_nbr);
    /* 1/[01]/1 CHS x  16 63 */
    hint_insert(try_offset, 16 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 17 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 16 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 17 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    /* 1/[01]/1 CHS x 240 63 */
    hint_insert(try_offset, 240 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 241 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 240 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 241 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    /* 1/[01]/1 CHS x 255 63 */
    hint_insert(try_offset, 255 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 256 * 63 * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 255 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    hint_insert(try_offset, 256 * disk->geom.sectors_per_head * disk->sector_size, try_offset_nbr);
    /* Hints for NTFS backup */
    if(disk->geom.cylinders>1)
    {
      CHS_t start;
      start.cylinder=disk->geom.cylinders-1;
      start.head=disk->geom.heads_per_cylinder-1;
      start.sector=disk->geom.sectors_per_head;
      hint_insert(try_offset, CHS2offset_inline(disk, &start), try_offset_nbr);
      if(disk->geom.cylinders>2)
      {
	start.cylinder--;
	hint_insert(try_offset, CHS2offset_inline(disk, &start), try_offset_nbr);
      }
    }
    hint_insert(try_offset, (disk->disk_size-disk->sector_size)/(2048*512)*(2048*512)-disk->sector_size, try_offset_nbr);
  }
  else if(disk->arch==&arch_gpt)
  {
    /* Hint for NTFS backup */
    const unsigned int gpt_entries_size=128*sizeof(struct gpt_ent);
    const uint64_t hdr_lba_end=le64((disk->disk_size-1 - gpt_entries_size)/disk->sector_size - 1);
    const uint64_t ntfs_backup_offset=(hdr_lba_end-1)*disk->sector_size/(2048*512)*(2048*512)-disk->sector_size;
    hint_insert(try_offset, ntfs_backup_offset, try_offset_nbr);
  }
  else if(disk->arch==&arch_mac)
  {
    /* sometime users choose Mac instead of GPT for i386 Mac */
    hint_insert(try_offset, 2*disk->sector_size+16384, try_offset_nbr);
  }
}
Exemplo n.º 13
0
int recover_BeFS(disk_t *disk_car, const struct disk_super_block *beos_block, partition_t *partition, const int dump_ind)
{
  if(test_BeFS(disk_car,beos_block,partition,dump_ind)!=0)
    return 1;
  set_BeFS_info(beos_block, partition);
  partition->part_size=le64(beos_block->num_blocks) << le32(beos_block->block_shift);
  partition->part_type_i386=(unsigned char)P_BEOS;
  return 0;
}
Exemplo n.º 14
0
static int header_check_reg_nt(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
  const struct regf_file_header *header=(const struct regf_file_header*)buffer;
  if(le32(header->file_type) > 1)
    return 0;
  reset_file_recovery(file_recovery_new);
  file_recovery_new->min_filesize=0x1000;
  file_recovery_new->extension=file_hint_reg.extension;
  file_recovery_new->time=td_ntfs2utc(le64(header->modification_time));
  return 1;
}
Exemplo n.º 15
0
void app_info64(u64 offset){
	u64 authid    = le64(self+offset);   /* auth id     */
	offset += sizeof(u64);
	u32 vendor_id = le32(self+offset);   /* vendor id   */
	offset += sizeof(u32);
	u32 self_type = le32(self+offset);   /* app type    */
	offset += sizeof(u32);
	u64 version   = le64(self+offset);   /* app version */
	offset += sizeof(u64);
	u64 padding   = le64(self+offset);   /* UNKNOWN     */
	offset += sizeof(u64);

	printf("--- APP INFO64 ---\n");	
	printf("Authotiry ID            0x%08x%08x\n",(u32)authid,(u32)(authid>>32));
	printf("Vendor ID               0x%08x\n",vendor_id);
	printf("SELF Type               0x%08x\n",self_type);
	printf("Version                 0x%08x%08x\n",(u32)version,(u32)(version>>32));
	printf("Padding                 0x%08x%08x\n",(u32)padding,(u32)(padding>>32));
	

}
Exemplo n.º 16
0
void app_info(u64 offset){
	u64 authid    = le64(self+offset);   /* auth id     */
	offset += sizeof(u64);
	u32 vendor_id = le32(self+offset);   /* vendor id   */
	offset += sizeof(u32);
	u32 self_type = le32(self+offset);   /* app type    */
	offset += sizeof(u32);
	u64 version   = le64(self+offset);   /* app version */
	offset += sizeof(u64);
	u64 padding   = le64(self+offset);   /* UNKNOWN     */
	offset += sizeof(u64);

	printf("--- APP INFO ---\n");	
	printf("Authotiry ID            0x%016lx\n",authid);
	printf("Vendor ID               0x%08x\n",vendor_id);
	printf("SELF Type               0x%08x\n",self_type);
	printf("Version                 0x%016lx\n",version);
	printf("Padding                 0x%016lx\n",padding);
	

}
Exemplo n.º 17
0
static void set_btrfs_info(const struct btrfs_super_block *sb, partition_t *partition)
{
    partition->upart_type=UP_BTRFS;
    partition->blocksize=le32(sb->dev_item.sector_size);
    set_part_name(partition, sb->label, sizeof(sb->label));
    snprintf(partition->info, sizeof(partition->info), "btrfs blocksize=%u", partition->blocksize);
    if(le64(sb->bytenr)!=partition->part_offset + BTRFS_SUPER_INFO_OFFSET)
    {
        strcat(partition->info," Backup superblock");
    }
    /* last mounted => date */
}
Exemplo n.º 18
0
void control_information64(u64 offset){
	uint32_t type    = le32(self+offset);    // 4== ; 6==;7==
	offset+=sizeof(uint32_t);
	uint32_t size    = le32(self+offset);
	offset+=sizeof(uint32_t);
	uint64_t unknown = le64(self+offset); // 0;1
	offset+=sizeof(uint64_t);

	printf("--- CONTROL INFORMATION64 ---\n");
	printf("Type                    0x%08x\n",type);
	printf("Size                    0x%08x\n",size);
	printf("Unknown                 0x%08x%08x\n",(u32)unknown,(u32)(unknown>>32));

}
Exemplo n.º 19
0
static int test_ZFS(disk_t *disk, const struct vdev_boot_header *sb, const partition_t *partition, const int dump_ind)
{
  if(le64(sb->vb_magic)!=VDEV_BOOT_MAGIC)
    return 1;
  if(dump_ind!=0)
  {
    if(partition!=NULL && disk!=NULL)
      log_info("\nZFS magic value at %u/%u/%u\n",
          offset2cylinder(disk,partition->part_offset),
          offset2head(disk,partition->part_offset),
          offset2sector(disk,partition->part_offset));
    dump_log(sb,DEFAULT_SECTOR_SIZE);
  }
  return 0;
}
Exemplo n.º 20
0
static int header_check_vmdk4(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
  const VMDK4Header *hdr=(const VMDK4Header *)buffer;
  const unsigned int cluster_sectors = le64(hdr->granularity);
  const unsigned int l2_size = le32(hdr->num_gtes_per_gte);
  const uint32_t l1_entry_sectors = l2_size * cluster_sectors;
  if (l1_entry_sectors <= 0)
    return 0;
  reset_file_recovery(file_recovery_new);
#ifdef DJGPP
  file_recovery_new->extension="vmd";
#else
  file_recovery_new->extension=file_hint_vmdk.extension;
#endif
  file_recovery_new->min_filesize=512;
  return 1;
}
Exemplo n.º 21
0
static int zip64_parse_end_central_dir(file_recovery_t *fr)
{
  struct {
    uint64_t end_size;                /** Size of zip64 end of central directory record */
    uint16_t version_made;            /** Version made by */
    uint16_t version_needed;          /** Version needed to extract */
    uint32_t number_disk;             /** Number of this disk */
    uint32_t number_disk2;            /** Number of the disk with the start of the central directory */
    uint64_t number_entries;          /** Total number of entries in the central directory on this disk */
    uint64_t number_entries2;         /** Total number of entries in the central directory */
    uint64_t size;                    /** Size of the central directory */
    uint64_t offset;                  /** Offset of start of central directory */
  } __attribute__ ((__packed__)) dir;

  if (fread(&dir, sizeof(dir), 1, fr->handle) != 1)
  {
#ifdef DEBUG_ZIP
    log_trace("zip: Unexpected EOF reading end_central_dir_64\n");
#endif
    return -1;
  }
  fr->file_size += sizeof(dir);

  if (dir.end_size > 0)
  {
    const uint64_t len = le64(dir.end_size);
#ifdef HAVE_FSEEKO
    if (fseeko(fr->handle, len, SEEK_CUR) == -1)
#else
    if (fseek(fr->handle, len, SEEK_CUR) == -1)
#endif
    {
#ifdef DEBUG_ZIP
      log_trace("zip: Unexpected EOF in end_central_dir_64: expected %llu bytes\n", (long long unsigned)len);
#endif
      return -1;
    }
    fr->file_size += len;
#ifdef DEBUG_ZIP
    log_trace("zip: End of 64b central dir of length %llu\n", (long long unsigned)len);
#endif
  }

  return 0;
}
Exemplo n.º 22
0
int recover_MD(disk_t *disk_car, const struct mdp_superblock_s *sb, partition_t *partition, const int verbose, const int dump_ind)
{
  if(test_MD(disk_car, sb, partition, dump_ind)==0)
  {
    set_MD_info(sb, partition, verbose);
    partition->part_type_i386=P_RAID;
    partition->part_type_sun=PSUN_RAID;
    partition->part_type_gpt=GPT_ENT_TYPE_LINUX_RAID;
    if(le32(sb->major_version)==0)
    {
      partition->part_size=(uint64_t)(le32(sb->size)<<1)*disk_car->sector_size+MD_RESERVED_BYTES;
      memcpy(&partition->part_uuid, &sb->set_uuid0, 4);
      memcpy((char*)(&partition->part_uuid)+4, &sb->set_uuid1, 3*4);
    }
    else
    {
      const struct mdp_superblock_1 *sb1=(const struct mdp_superblock_1 *)sb;
      partition->part_size=(uint64_t)le64(sb1->size) * (uint64_t)disk_car->sector_size+4096;
      memcpy(&partition->part_uuid, &sb1->set_uuid, 16);
    }
    return 0;
  }
  if(test_MD_be(disk_car, sb, partition, dump_ind)==0)
  {
    set_MD_info_be(sb, partition, verbose);
    partition->part_type_i386=P_RAID;
    partition->part_type_sun=PSUN_RAID;
    partition->part_type_gpt=GPT_ENT_TYPE_LINUX_RAID;
    if(be32(sb->major_version)==0)
    {
      partition->part_size=(uint64_t)(be32(sb->size)<<1)*disk_car->sector_size+MD_RESERVED_BYTES;
      memcpy(&partition->part_uuid, &sb->set_uuid0, 4);
      memcpy((char*)(&partition->part_uuid)+4, &sb->set_uuid1, 3*4);
    }
    else
    {
      const struct mdp_superblock_1 *sb1=(const struct mdp_superblock_1 *)sb;
      partition->part_size=(uint64_t)be64(sb1->size) * (uint64_t)disk_car->sector_size+4096;
      memcpy(&partition->part_uuid, &sb1->set_uuid, 16);
    }
    return 0;
  }
  return 1;
}
Exemplo n.º 23
0
int recover_VMFS(disk_t *disk, const struct vmfs_volume *sb, partition_t *partition, const int verbose, const int dump_ind)
{
  const struct vmfs_lvm* lvm=(const struct vmfs_lvm*)(((const char *)sb)+0x200);
  if(test_VMFS(disk, sb, partition, dump_ind)!=0)
    return 1;
  if(partition==NULL)
    return 0;
  set_VMFS_info(sb, partition);
  partition->part_type_i386=P_VMFS;
  partition->part_size=(uint64_t)le64(lvm->size);
  partition->blocksize=0;
  partition->sborg_offset=0;
  partition->sb_offset=0;
  if(verbose>0)
  {
    log_info("\n");
  }
  return 0;
}
Exemplo n.º 24
0
int recover_LVM2(disk_t *disk_car, const unsigned char *buf,partition_t *partition,const int verbose, const int dump_ind)
{
  const struct lvm2_label_header *lh=(const struct lvm2_label_header *)buf;
  if(test_LVM2(disk_car,lh,partition,verbose,dump_ind)!=0)
    return 1;
  set_LVM2_info(partition);
  partition->part_type_i386=P_LVM;
  partition->part_type_sun=PSUN_LVM;
  partition->part_type_gpt=GPT_ENT_TYPE_LINUX_LVM;
  {
    const struct lvm2_pv_header *pvhdr;
    pvhdr=(const struct lvm2_pv_header *) (buf + le32(lh->offset_xl));
    partition->part_size=le64(pvhdr->device_size_xl);
  }
  if(verbose>0)
  {
    log_info("part_size %lu\n",(long unsigned)(partition->part_size/disk_car->sector_size));
  }
  return 0;
}
Exemplo n.º 25
0
static int header_check_bkf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
  const struct mtf_db_hdr *hdr=(const struct mtf_db_hdr *)buffer;
  /* Microsoft Tape Format
   * The DBLK Type field is set to ‘TAPE’.
   * The Format Logical Address field is set to zero.
   * The Control Block ID field is set to zero.
   */
  if(le64(hdr->fla)!=0 || le32(hdr->cbId)!=0 || hdr->strType>2 ||
      le16(hdr->off)<sizeof(struct mtf_db_hdr))
    return 0;
#ifdef DEBUG_BKF
  log_info("off=%u\n", le16(hdr->off));
#endif
  reset_file_recovery(file_recovery_new);
  file_recovery_new->min_filesize=52;
  file_recovery_new->extension=file_hint_bkf.extension;
  file_recovery_new->file_check=&file_check_bkf;
  return 1;
}
Exemplo n.º 26
0
int recover_ZFS(disk_t *disk, const struct vdev_boot_header *sb,partition_t *partition,const int verbose, const int dump_ind)
{
  if(test_ZFS(disk, sb, partition, dump_ind)!=0)
    return 1;
  if(partition==NULL)
    return 0;
  set_ZFS_info(sb, partition);
  partition->part_type_i386=P_LINUX;
  partition->part_type_mac=PMAC_LINUX;
  partition->part_type_sun=PSUN_LINUX;
  partition->part_type_gpt=GPT_ENT_TYPE_SOLARIS_USR;
  partition->part_size=(uint64_t)le64(sb->vb_offset);
  partition->blocksize=0;
  partition->sborg_offset=0;
  partition->sb_offset=0;
  if(verbose>0)
  {
    log_info("\n");
  }
  return 0;
}
Exemplo n.º 27
0
/*
Primary superblock is at 1024 (SUPERBLOCK_OFFSET)
Group 0 begin at s_first_data_block
*/
int recover_btrfs(disk_t *disk, const struct btrfs_super_block *sb, partition_t *partition, const int verbose, const int dump_ind)
{
    if(test_btrfs(sb)!=0)
        return 1;
    if(dump_ind!=0)
    {
        if(partition!=NULL && disk!=NULL)
            log_info("\nbtrfs magic value at %u/%u/%u\n",
                     offset2cylinder(disk,partition->part_offset),
                     offset2head(disk,partition->part_offset),
                     offset2sector(disk,partition->part_offset));
        dump_log(sb, BTRFS_SUPER_INFO_SIZE);
    }
    if(partition==NULL)
        return 0;
    set_btrfs_info(sb, partition);
    partition->part_type_i386=P_LINUX;
    partition->part_type_mac=PMAC_LINUX;
    partition->part_type_sun=PSUN_LINUX;
    partition->part_type_gpt=GPT_ENT_TYPE_LINUX_DATA;
    partition->part_size=(uint64_t)le64(sb->dev_item.total_bytes);
    guid_cpy(&partition->part_uuid, (const efi_guid_t *)&sb->fsid);
    if(verbose>0)
    {
        log_info("\n");
    }
    partition->sborg_offset=BTRFS_SUPER_INFO_OFFSET;
    partition->sb_size=BTRFS_SUPER_INFO_SIZE;
    if(verbose>0)
    {
        if(disk==NULL)
            log_info("recover_btrfs: part_size %lu\n", (long unsigned)(partition->part_size / le32(sb->dev_item.sector_size)));
        else
            log_info("recover_btrfs: part_size %lu\n", (long unsigned)(partition->part_size / disk->sector_size));
    }
    return 0;
}
Exemplo n.º 28
0
static int test_ufs(const disk_t *disk_car, const struct ufs_super_block *sb, partition_t *partition, const int verbose)
{
  if(le32(sb->fs_magic)==UFS_MAGIC && le32(sb->fs_size) > 0 &&
    (le32(sb->fs_fsize)==512 || le32(sb->fs_fsize)==1024 || le32(sb->fs_fsize)==2048 || le32(sb->fs_fsize)==4096))
  {
    partition->upart_type = UP_UFS2_LE;
    if(verbose>1)
      log_info("\nUFS Marker at %u/%u/%u\n", offset2cylinder(disk_car,partition->part_offset),offset2head(disk_car,partition->part_offset),offset2sector(disk_car,partition->part_offset));
    return 0;
  }
  if(be32(sb->fs_magic)==UFS_MAGIC && be32(sb->fs_size) > 0 &&
    (be32(sb->fs_fsize)==512 || be32(sb->fs_fsize)==1024 || be32(sb->fs_fsize)==2048 || be32(sb->fs_fsize)==4096))
  {
    partition->upart_type = UP_UFS;
    if(verbose>1)
      log_info("\nUFS Marker at %u/%u/%u\n", offset2cylinder(disk_car,partition->part_offset),offset2head(disk_car,partition->part_offset),offset2sector(disk_car,partition->part_offset));
    return 0;
  }
  if(le32(sb->fs_magic)==UFS2_MAGIC && le64(sb->fs_u11.fs_u2.fs_size) > 0 &&
    (le32(sb->fs_fsize)==512 || le32(sb->fs_fsize)==1024 || le32(sb->fs_fsize)==2048 || le32(sb->fs_fsize)==4096))
  {
    partition->upart_type = UP_UFS2_LE;
    if(verbose>1)
      log_info("\nUFS2 Marker at %u/%u/%u\n", offset2cylinder(disk_car,partition->part_offset),offset2head(disk_car,partition->part_offset),offset2sector(disk_car,partition->part_offset));
    return 0;
  }
  if(be32(sb->fs_magic)==UFS2_MAGIC && be64(sb->fs_u11.fs_u2.fs_size) > 0 &&
    (be32(sb->fs_fsize)==512 || be32(sb->fs_fsize)==1024 || be32(sb->fs_fsize)==2048 || be32(sb->fs_fsize)==4096))
  {
    partition->upart_type = UP_UFS2;
    if(verbose>1)
      log_info("\nUFS2 Marker at %u/%u/%u\n", offset2cylinder(disk_car,partition->part_offset),offset2head(disk_car,partition->part_offset),offset2sector(disk_car,partition->part_offset));
    return 0;
  }
  return 1;
}
Exemplo n.º 29
0
Sint64 File::read64le()
{
	return le64(read<Sint64>());
}
Exemplo n.º 30
0
static uint64_t get64u(const void *buffer, const unsigned int offset)
{
  const uint64_t *val=(const uint64_t *)((const unsigned char *)buffer+offset);
  return le64(*val);
}