ntfsundelete.c revision 7e7bd3dccbfe8f79e25e5c1554b5bc3a9aaca321
/**
* ntfsundelete - Part of the Linux-NTFS project.
*
* Copyright (c) 2002-2005 Richard Russon
* Copyright (c) 2004-2005 Holger Ohmacht
* Copyright (c) 2005 Anton Altaparmakov
* Copyright (c) 2007 Yura Pakhuchiy
*
* This utility will recover deleted files from an NTFS volume.
*
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS
* distribution in the file COPYING); if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include "config.h"
#ifdef HAVE_FEATURES_H
#include <features.h>
#endif
#ifdef HAVE_STDIO_H
#include <stdio.h>
#endif
#ifdef HAVE_STDLIB_H
#include <stdlib.h>
#endif
#ifdef HAVE_STRING_H
#include <string.h>
#endif
#ifdef HAVE_ERRNO_H
#include <errno.h>
#endif
#ifdef HAVE_SYS_TYPES_H
#endif
#ifdef HAVE_SYS_STAT_H
#endif
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef HAVE_FCNTL_H
#include <fcntl.h>
#endif
#ifdef HAVE_GETOPT_H
#include <getopt.h>
#endif
#ifdef HAVE_TIME_H
#include <time.h>
#endif
#ifdef HAVE_LIMITS_H
#include <limits.h>
#endif
#ifdef HAVE_STDARG_H
#include <stdarg.h>
#endif
#ifdef HAVE_UTIME_H
#include <utime.h>
#endif
#include <regex.h>
#if !defined(REG_NOERROR) || (REG_NOERROR != 0)
#define REG_NOERROR 0
#endif
#include "ntfsundelete.h"
#include "bootsect.h"
#include "mft.h"
#include "attrib.h"
#include "layout.h"
#include "inode.h"
#include "device.h"
#include "utils.h"
#include "debug.h"
#include "ntfstime.h"
#include "version.h"
#include "logging.h"
static const char *EXEC_NAME = "ntfsundelete";
static const char *MFTFILE = "mft";
static const char *UNNAMED = "<unnamed>";
static const char *NONE = "<none>";
static const char *UNKNOWN = "unknown";
typedef struct
{
} range;
static short with_regex; /* Flag Regular expression available */
static short avoid_duplicate_printing; /* Flag No duplicate printing of file infos */
static long nr_entries; /* Number of range entries */
/**
* parse_inode_arg - parses the inode expression
*
* Parses the optarg after parameter -u for valid ranges
*
* Return: Number of correct inode specifications or -1 for error
*/
static int parse_inode_arg(void)
{
int p;
char *opt_arg_ptr;
char *opt_arg_temp;
char *opt_arg_end1;
char *opt_arg_end2;
/* Check whether optarg is available or not */
nr_entries = 0;
return (0); /* bailout if no optarg */
/* init variables */
imax = p;
opt_arg_end2 = &(optarg[p]);
/* alloc mem for range table */
ntfs_log_error("ERROR: Couldn't alloc mem for parsing inodes!\n");
return (-1);
}
/* loop */
while ((opt_arg_end1 != opt_arg_end2) && (p > 0)) {
/* Try to get inode */
p--;
/* invalid char at begin */
return (-1);
}
/* RANGE - Check for range */
if (opt_arg_end1[0] == '-') {
/* get range end */
if (opt_arg_temp >= opt_arg_end2) {
ntfs_log_error("ERROR: Missing range end!\n");
return (-1);
}
range_begin = inode;
/* get count */
if (opt_arg_temp == opt_arg_end1) {
return (-1);
}
/* check for correct values */
if (range_begin > range_end) {
}
/* put into struct */
nr_entries++;
/* Last check */
if (opt_arg_ptr >= opt_arg_end2)
break;
} else if (opt_arg_end1[0] == ',') {
/* SINGLE VALUE, BUT CONTINUING */
/* put inode into range list */
nr_entries++;
/* Next inode */
if (opt_arg_ptr >= opt_arg_end2) {
ntfs_log_error("ERROR: Missing new value at end of input!\n");
return (-1);
}
continue;
} else { /* SINGLE VALUE, END */
nr_entries++;
}
}
return (nr_entries);
}
/**
* version - Print version information about the program
*
* Print a copyright statement and a brief description of the program.
*
* Return: none
*/
static void version(void)
{
ntfs_log_info("\n%s v%s (libntfs %s) - Recover deleted files from an "
ntfs_log_info("Copyright (c) 2002-2005 Richard Russon\n"
"Copyright (c) 2004-2005 Holger Ohmacht\n"
"Copyright (c) 2005 Anton Altaparmakov\n"
"Copyright (c) 2007 Yura Pakhuchiy\n");
}
/**
* usage - Print a list of the parameters to the program
*
* Print a list of the parameters and options for the program.
*
* Return: none
*/
static void usage(void)
{
ntfs_log_info("\nUsage: %s [options] device\n"
" -s, --scan Scan for files (default)\n"
" -p, --percentage NUM Minimum percentage recoverable\n"
" -m, --match PATTERN Only work on files with matching names\n"
" -C, --case Case sensitive matching\n"
" -S, --size RANGE Match files of this size\n"
" -t, --time SINCE Last referenced since this time\n"
"\n"
" -u, --undelete Undelete mode\n"
" -i, --inodes RANGE Recover these inodes\n"
//" -I, --interactive Interactive mode\n"
" -o, --output FILE Save with this filename\n"
" -O, --optimistic Undelete in-use clusters as well\n"
" -d, --destination DIR Destination directory\n"
" -b, --byte NUM Fill missing parts with this byte\n"
" -T, --truncate Truncate 100%% recoverable file to exact size.\n"
" -P, --parent Show parent directory\n"
"\n"
" -c, --copy RANGE Write a range of MFT records to a file\n"
"\n"
" -f, --force Use less caution\n"
" -q, --quiet Less output\n"
" -v, --verbose More output\n"
" -V, --version Display version information\n"
" -h, --help Display this help\n\n",
}
/**
* transform - Convert a shell style pattern to a regex
* @pattern: String to be converted
* @regex: Resulting regular expression is put here
*
* This will transform patterns, such as "*.doc" to true regular expressions.
* The function will also place '^' and '$' around the expression to make it
* behave as the user would expect
*
* Before After
* . \.
* * .*
* ? .
*
* Notes:
* The returned string must be freed by the caller.
* If transform fails, @regex will not be changed.
*
* Return: 1, Success, the string was transformed
* 0, An error occurred
*/
{
char *result;
int length, i, j;
return 0;
if (length < 1) {
ntfs_log_error("Pattern to transform is empty\n");
return 0;
}
for (i = 0; pattern[i]; i++) {
length++;
}
if (!result) {
ntfs_log_error("Couldn't allocate memory in transform()\n");
return 0;
}
result[0] = '^';
for (i = 0, j = 1; pattern[i]; i++, j++) {
if (pattern[i] == '*') {
result[j] = '.';
j++;
result[j] = '*';
} else if (pattern[i] == '.') {
result[j] = '\\';
j++;
result[j] = '.';
} else if (pattern[i] == '?') {
result[j] = '.';
} else {
}
}
result[j] = '$';
result[j+1] = 0;
result);
return 1;
}
/**
* parse_time - Convert a time abbreviation to seconds
* @string: The string to be converted
* @since: The absolute time referred to
*
* Strings representing times will be converted into a time_t. The numbers will
* be regarded as seconds unless suffixed.
*
* Suffix Description
* [yY] Year
* [mM] Month
* [wW] Week
* [dD] Day
* [sS] Second
*
* Therefore, passing "1W" will return the time_t representing 1 week ago.
*
* Notes:
* Only the first character of the suffix is read.
* If parse_time fails, @since will not be changed
*
* Return: 1 Success
* 0 Error, the string was malformed
*/
{
long long result;
return -1;
return 0;
}
if (!suffix) {
ntfs_log_error("Internal error, strtoll didn't return a suffix.\n");
return 0;
}
return 0;
}
switch (suffix[0]) {
case 0:
break;
default:
return 0;
}
(long long) result);
return 1;
}
/**
* parse_options - Read and validate the programs command line
*
* Read the command line, verify the syntax and parse the options.
* This function is very long, but quite simple.
*
* Return: 1 Success
* 0 Error, one or more problems
*/
{
static const char *sopt = "-b:Cc:d:fh?i:m:o:OPp:sS:t:TuqvV";
//{ "interactive", no_argument, NULL, 'I' },
};
int c = -1;
int err = 0;
int ver = 0;
int help = 0;
int levels = 0;
opterr = 0; /* We'll handle the errors, thank you. */
switch (c) {
case 1: /* A non-option argument */
} else {
err++;
}
break;
case 'b':
err++;
} else {
err++;
}
break;
case 'C':
opts.match_case++;
break;
case 'c':
if (!utils_parse_range(optarg,
err++;
} else {
}
break;
case 'd':
else
err++;
break;
case 'f':
break;
case 'h':
case '?':
break;
help++;
break;
case 'i':
/* parse inodes */
if (parse_inode_arg() == -1)
err++;
err++;
break;
case 'm':
err++;
} else {
/* set regex-flag on true ;) */
with_regex= 1;
}
} else {
err++;
}
break;
case 'o':
} else {
err++;
}
break;
case 'O':
if (!opts.optimistic) {
opts.optimistic++;
} else {
err++;
}
break;
case 'P':
} else {
err++;
}
break;
case 'p':
err++;
} else {
err++;
}
break;
case 'q':
break;
case 's':
else
break;
case 'S':
err++;
}
break;
case 't':
err++;
} else {
err++;
}
break;
case 'T':
break;
case 'u':
} else {
}
break;
case 'v':
break;
case 'V':
ver++;
break;
default:
} else {
}
err++;
break;
}
}
/* Make sure we're in sync with the log levels */
if (levels & NTFS_LOG_LEVEL_VERBOSE)
if (!(levels & NTFS_LOG_LEVEL_QUIET))
} else {
if (argc > 1)
ntfs_log_error("You must specify exactly one device.\n");
err++;
}
}
case MODE_SCAN:
ntfs_log_error("Scan can only be used with --percent, "
"--match, --ignore-case, --size and --time.\n");
err++;
}
ntfs_log_error("The --case option doesn't make sense without the --match option\n");
err++;
}
break;
case MODE_UNDELETE:
ntfs_log_error("Undelete can only be used with "
"--output, --destination, --byte and --truncate.\n");
err++;
}*/
break;
case MODE_COPY:
(opts.size_begin > 0) ||
ntfs_log_error("Copy can only be used with --output and --destination.\n");
err++;
}
break;
default:
ntfs_log_error("You can only select one of Scan, Undelete or Copy.\n");
err++;
}
ntfs_log_error("Percentage value must be in the range 0 - 100.\n");
err++;
}
ntfs_log_error("You may not use --quiet and --verbose at the same time.\n");
err++;
ntfs_log_error("You may not use --quiet when scanning a volume.\n");
err++;
}
}
ntfs_log_error("To use --parent, you must also use --verbose.\n");
err++;
}
}
if (ver)
version();
usage();
}
/**
* free_file - Release the resources used by a file object
* @file: The unwanted file object
*
* This will free up the memory used by a file object and iterate through the
* object's children, freeing their resources too.
*
* Return: none
*/
{
if (!file)
return;
NONE);
if (f->name)
if (f->parent_name) {
ntfs_log_debug(" and parent filename '%s'",
f->parent_name);
free(f->parent_name);
}
ntfs_log_debug(".\n");
free(f);
}
if (d->name)
if (d->runlist)
free(d);
}
}
/**
* verify_parent - confirm a record is parent of a file
* @name: a filename of the file
* @rec: the mft record of the possible parent
*
* Check that @rec is the parent of the file represented by @name.
* If @rec is a directory, but it is created after @name, then we
* can't determine whether @rec is really @name's parent.
*
* Return: @rec's filename, either same name space as @name or lowest space.
* NULL if can't determine parenthood or on error.
*/
{
int found_same_space = 1;
return NULL;
return NULL;
}
if (!ctx) {
ntfs_log_error("ERROR: Couldn't create a search context.\n");
return NULL;
}
if (!attr30) {
return NULL;
}
/* if name is older than this dir -> can't determine */
return NULL;
}
found_same_space = 0;
found_same_space = 1;
} else {
}
}
}
}
}
/**
* get_parent_name - Find the name of a file's parent.
* @name: the filename whose parent's name to find
*/
{
long long inode_num;
return;
if (!rec) {
ntfs_log_error("ERROR: Couldn't allocate memory in "
"get_parent_name()\n");
return;
}
if (!mft_data) {
ntfs_log_perror("ERROR: Couldn't open $MFT/$DATA");
} else {
ntfs_log_error("ERROR: Couldn't read MFT Record %lld"
".\n", inode_num);
&name->parent_name, 0) < 0) {
ntfs_log_debug("ERROR: Couldn't translate "
"filename to current "
"locale.\n");
}
}
}
if (mft_data) {
}
if (rec) {
}
return;
}
/**
* get_filenames - Read an MFT Record's $FILENAME attributes
* @file: The file object to work with
*
* A single file may have more than one filename. This is quite common.
* Windows creates a short DOS name for each long name, e.g. LONGFI~1.XYZ,
* LongFiLeName.xyZ.
*
* The filenames that are found are put in filename objects and added to a
* linked list of filenames in the file object. For convenience, the unicode
* filename is converted into the current locale and stored in the filename
* object.
*
* One of the filenames is picked (the one with the lowest numbered namespace)
* and its locale friendly name is put in pref_name.
*
* Return: n The number of $FILENAME attributes found
* -1 Error
*/
{
int count = 0;
int space = 4;
if (!file)
return -1;
if (!ctx)
return -1;
/* We know this will always be resident. */
if (!name) {
ntfs_log_error("ERROR: Couldn't allocate memory in "
"get_filenames().\n");
count = -1;
break;
}
0) < 0) {
ntfs_log_debug("ERROR: Couldn't translate filename to "
"current locale.\n");
}
}
}
count++;
}
return count;
}
/**
* get_data - Read an MFT Record's $DATA attributes
* @file: The file object to work with
* @vol: An ntfs volume obtained from ntfs_mount
*
* A file may have more than one data stream. All files will have an unnamed
* data stream which contains the file's data. Some Windows applications store
* extra information in a separate stream.
*
* The streams that are found are put in data objects and added to a linked
* list of data streams in the file object.
*
* Return: n The number of $FILENAME attributes found
* -1 Error
*/
{
int count = 0;
if (!file)
return -1;
if (!ctx)
return -1;
if (!data) {
ntfs_log_error("ERROR: Couldn't allocate memory in "
"get_data().\n");
count = -1;
break;
}
if (rec->name_length) {
ntfs_log_error("ERROR: Cannot translate name "
"into current locale.\n");
}
}
} else {
}
ntfs_log_debug("Couldn't decompress the data runs.\n");
}
count++;
}
return count;
}
/**
* read_record - Read an MFT record into memory
* @vol: An ntfs volume obtained from ntfs_mount
* @record: The record number to read
*
* Read the specified MFT record and gather as much information about it as
* possible.
*
* Return: Pointer A ufile object containing the results
* NULL Error
*/
{
if (!vol)
return NULL;
if (!file) {
ntfs_log_error("ERROR: Couldn't allocate memory in read_record()\n");
return NULL;
}
ntfs_log_error("ERROR: Couldn't allocate memory in read_record()\n");
return NULL;
}
if (!mft) {
ntfs_log_perror("ERROR: Couldn't open $MFT/$DATA");
return NULL;
}
if (ntfs_attr_mst_pread(mft, vol->mft_record_size * record, 1, vol->mft_record_size, file->mft) < 1) {
return NULL;
}
if (attr10) {
}
if (attr90)
ntfs_log_error("ERROR: Couldn't get filenames.\n");
}
ntfs_log_error("ERROR: Couldn't get data streams.\n");
}
return file;
}
/**
* calc_percentage - Calculate how much of the file is recoverable
* @file: The file object to work with
* @vol: An ntfs volume obtained from ntfs_mount
*
* Read through all the $DATA streams and determine if each cluster in each
* stream is still free disk space. This is just measuring the potential for
* recovery. The data may have still been overwritten by a another file which
* was then deleted.
*
* Files with a resident $DATA stream will have a 100% potential.
*
* N.B. If $DATA attribute spans more than one MFT record (i.e. badly
* fragmented) then only the data in this segment will be used for the
* calculation.
*
* N.B. Currently, compressed and encrypted files cannot be recovered, so they
* will return 0%.
*
* Return: n The percentage of the file that _could_ be recovered
* -1 Error
*/
{
long long i, j;
int clusters_inuse, clusters_free;
int percent = 0;
return -1;
ntfs_log_debug("Found a directory: not recoverable.\n");
return 0;
}
ntfs_log_verbose("File has no data streams.\n");
return 0;
}
clusters_inuse = 0;
clusters_free = 0;
ntfs_log_verbose("File is encrypted, recovery is "
"impossible.\n");
continue;
}
if (data->compressed) {
ntfs_log_verbose("File is compressed, recovery not yet "
"implemented.\n");
continue;
}
ntfs_log_verbose("File is resident, therefore "
"recoverable.\n");
percent = 100;
continue;
}
if (!rl) {
ntfs_log_verbose("File has no runlist, hence no data."
"\n");
continue;
}
ntfs_log_verbose("File has an empty runlist, hence no "
"data.\n");
continue;
}
ntfs_log_verbose("Missing segment at beginning, %lld "
rl++;
}
ntfs_log_verbose("Missing segment at end, %lld "
"clusters\n",
continue;
}
continue;
}
if (utils_cluster_in_use(vol, j))
else
}
}
if ((clusters_inuse + clusters_free) == 0) {
ntfs_log_error("ERROR: Unexpected error whilst "
"calculating percentage for inode %lld\n",
continue;
}
}
return percent;
}
/**
* dump_record - Print everything we know about an MFT record
* @file: The file to work with
*
* Output the contents of the file object. This will print everything that has
* been read from the MFT record, or implied by various means.
*
* Because of the redundant nature of NTFS, there will be some duplication of
* information, though it will have been read from different sources.
*
* N.B. If the filename is missing, or couldn't be converted to the current
* locale, "<none>" will be displayed.
*
* Return: none
*/
{
char buffer[20];
const char *name;
int i;
if (!file)
return;
ntfs_log_quiet("Metadata may span more than one MFT record\n");
if (f->name)
else
ntfs_log_quiet("File Flags: ");
if (f->flags & FILE_ATTR_SYSTEM)
ntfs_log_quiet("System ");
if (f->flags & FILE_ATTR_DIRECTORY)
ntfs_log_quiet("Directory ");
if (f->flags & FILE_ATTR_SPARSE_FILE)
ntfs_log_quiet("Sparse ");
if (f->flags & FILE_ATTR_REPARSE_POINT)
ntfs_log_quiet("Reparse ");
if (f->flags & FILE_ATTR_COMPRESSED)
ntfs_log_quiet("Compressed ");
if (f->flags & FILE_ATTR_ENCRYPTED)
ntfs_log_quiet("Encrypted ");
}
ntfs_log_quiet("\n");
f->parent_name : "<non-determined>");
}
}
ntfs_log_quiet("Data Streams:\n");
ntfs_log_quiet("Flags: ");
ntfs_log_quiet("None\n");
else
ntfs_log_quiet("\n");
ntfs_log_quiet("Data runs:\n");
ntfs_log_quiet(" None\n");
} else {
ntfs_log_quiet(" %lld @ %lld\n",
}
}
ntfs_log_quiet("Amount potentially recoverable %d%%\n",
d->percent);
}
ntfs_log_quiet("________________________________________\n\n");
}
/**
* list_record - Print a one line summary of the file
* @file: The file to work with
*
* Print a one line description of a file.
*
* Inode Flags %age Date Size Filename
*
* The output will contain the file's inode number (MFT Record), some flags,
* the percentage of the file that is recoverable, the last modification date,
* the size and the filename.
*
* C = Compressed, E = Encrypted, ! = Metadata may span multiple records.
*
* N.B. The file size is stored in many forms in several attributes. This
* display the largest it finds.
*
* N.B. If the filename is missing, or couldn't be converted to the current
* locale, "<none>" will be displayed.
*
* Return: none
*/
{
char buffer[20];
long long size = 0;
int percent = 0;
flagx = '!';
flagd = 'D';
else
flagd = 'F';
if (!d->name) {
if (d->resident)
flagr = 'R';
else
flagr = 'N';
if (d->compressed)
flagc = 'C';
if (d->encrypted)
flagc = 'E';
}
}
else
ntfs_log_quiet("%-8lld %c%c%c%c %3d%% %s %9lld %s\n",
}
/**
* name_match - Does a file have a name matching a regex
* @re: The regular expression object
* @file: The file to be tested
*
* Iterate through the file's $FILENAME attributes and compare them against the
* regular expression, created with regcomp.
*
* Return: 1 There is a matching filename.
* 0 There is no match.
*/
{
int result;
return 0;
if (!f->name)
continue;
if (result < 0) {
ntfs_log_perror("Couldn't compare filename with regex");
return 0;
} else if (result == REG_NOERROR) {
ntfs_log_debug("Found a matching filename.\n");
return 1;
}
}
return 0;
}
/**
* write_data - Write out a block of data
* @fd: File descriptor to write to
* @buffer: Data to write
* @bufsize: Amount of data to write
*
* Write a block of data to a file descriptor.
*
* Return: -1 Error, something went wrong
* 0 Success, all the data was written
*/
unsigned int bufsize)
{
if (!buffer) {
return -1;
}
return result1;
/* Try again with the rest of the buffer */
if (result2 < 0)
return result1;
}
/**
* @dir: Directory in which to create the file (optional)
* @name: Filename to give the file (optional)
* @stream: Name of the stream (optional)
* @buffer: Store the result here
* @bufsize: Size of buffer
*
* Create a filename from various pieces. The output will be of the form:
* file
* file:stream
*
* All the components are optional. If the name is missing, "unknown" will be
* used. If the directory is missing the file will be created in the current
* directory. If the stream name is present it will be appended to the
* filename, delimited by a colon.
*
* N.B. If the buffer isn't large enough the name will be truncated.
*
* Return: n Length of the allocated name
*/
{
if (!name)
if (dir)
if (stream)
else
else
if (stream)
else
}
/**
* open_file - Open a file to write to
* @pathname: Path, name and stream of the file to open
*
* Create a file and return the file descriptor.
*
* N.B. If option force is given and existing file will be overwritten.
*
* Return: -1 Error, failed to create the file
* n Success, this is the file descriptor
*/
{
int flags;
else
}
/**
* set_date - Set the file's date and time
* @pathname: Path and name of the file to alter
* @date: Date and time to set
*
* Give a file a particular date and time.
*
* Return: 1 Success, set the file's date and time
* 0 Error, failed to change the file's date and time
*/
{
if (!pathname)
return 0;
ntfs_log_error("ERROR: Couldn't set the file's date and time\n");
return 0;
}
return 1;
}
/**
* undelete_file - Recover a deleted file from an NTFS volume
* @vol: An ntfs volume obtained from ntfs_mount
* @inode: MFT Record number to be recovered
*
* Read an MFT Record and try an recover any data associated with it. Some of
* the clusters may be in use; these will be filled with zeros or the fill byte
* supplied in the options.
*
* Each data stream will be recovered and saved to a file. The file's name will
* be the original filename and it will be written to the current directory.
* Any named data stream will be saved as filename:streamname.
*
* The output file's name and location can be altered by using the command line
* options.
*
* N.B. We cannot tell if someone has overwritten some of the data since the
* file was deleted.
*
* Return: 0 Error, something went wrong
* 1 Success, the data was recovered
*/
{
char pathname[256];
unsigned int bufsize;
int i, j;
int fd = -1;
long long k;
int result = 0;
char *name;
long long cluster_count; /* I'll need this variable (see below). +mabs */
if (!vol)
return 0;
/* try to get record */
return 0;
}
/* if flag was not set, print file informations */
if (avoid_duplicate_printing == 0) {
} else {
//ntfs_log_quiet("\n");
}
}
if (!buffer)
goto free;
/* calc_percentage() must be called before dump_record() or
* list_record(). Otherwise, when undeleting, a file will always be
* listed as 0% recoverable even if successfully undeleted. +mabs
*/
ntfs_log_error("Record is in use by the mft\n");
return 0;
}
ntfs_log_verbose("Forced to continue.\n");
}
ntfs_log_quiet("File has no recoverable data.\n");
goto free;
}
ntfs_log_quiet("File has no data. There is nothing to recover.\n");
goto free;
}
else
if (d->resident) {
if (fd < 0) {
ntfs_log_perror("Couldn't create file");
goto free;
}
ntfs_log_verbose("File has resident data.\n");
ntfs_log_perror("Write failed");
goto free;
}
ntfs_log_perror("Close failed");
}
fd = -1;
} else {
if (!rl) {
ntfs_log_verbose("File has no runlist, hence no data.\n");
continue;
}
ntfs_log_verbose("File has an empty runlist, hence no data.\n");
continue;
}
if (fd < 0) {
ntfs_log_perror("Couldn't create output file");
goto free;
}
ntfs_log_verbose("Missing segment at beginning, %lld "
"clusters.\n",
ntfs_log_perror("Write failed");
goto free;
}
}
}
cluster_count = 0LL;
ntfs_log_verbose("Missing segment at end, "
"%lld clusters.\n",
ntfs_log_perror("Write failed");
goto free;
}
}
continue;
}
ntfs_log_verbose("File has a sparse section.\n");
ntfs_log_perror("Write failed");
goto free;
}
}
continue;
}
ntfs_log_perror("Write failed");
goto free;
}
} else {
ntfs_log_perror("Read failed");
goto free;
}
ntfs_log_perror("Write failed");
goto free;
}
}
}
}
ntfs_log_quiet("\n");
/*
* The following block of code implements the --truncate option.
* Its semantics are as follows:
* IF opts.truncate is set AND data stream currently being recovered is
* non-resident AND data stream has no holes (100% recoverability) AND
* 0 <= (data->size_alloc - data->size_data) <= vol->cluster_size AND
* cluster_count * vol->cluster_size == data->size_alloc THEN file
* currently being written is truncated to data->size_data bytes before
* it's closed.
* This multiple checks try to ensure that only files with consistent
* that resident streams need not be truncated, since the original code
* already recovers their exact length. +mabs
*/
ntfs_log_perror("Truncation failed");
} else ntfs_log_quiet("Truncation not performed because file has an "
"inconsistent $MFT record.\n");
}
ntfs_log_perror("Close failed");
}
fd = -1;
}
if (d->name)
else
}
result = 1;
free:
if (buffer)
return result;
}
/**
* scan_disk - Search an NTFS volume for files that could be undeleted
* @vol: An ntfs volume obtained from ntfs_mount
*
* Read through all the MFT entries looking for deleted files. For each one
* determine how much of the data lies in unused disk space.
*
* The list can be filtered by name, size and date, using command line options.
*
* Return: -1 Error, something went wrong
* n Success, the number of recoverable files
*/
{
const int BUFSIZE = 8192;
int results = 0;
long long size;
long long bmpsize;
int i, j, k, b;
int percent;
if (!vol)
return -1;
if (!attr) {
ntfs_log_perror("ERROR: Couldn't open $MFT/$BITMAP");
return -1;
}
if (!buffer) {
ntfs_log_error("ERROR: Couldn't allocate memory in scan_disk()\n");
results = -1;
goto out;
}
if (!opts.match_case)
ntfs_log_error("ERROR: Couldn't create a regex.\n");
goto out;
}
}
ntfs_log_quiet("Inode Flags %%age Date Size Filename\n");
ntfs_log_quiet("---------------------------------------------------------------\n");
if (size < 0)
break;
for (j = 0; j < size; j++) {
b = buffer[j];
for (k = 0; k < 8; k++, b>>=1) {
if (((i+j)*8+k) >= nr_mft_records)
goto done;
if (b & 1)
continue;
if (!file) {
continue;
}
goto skip;
goto skip;
goto skip;
goto skip;
else
/* Was -u specified with no inode
so undelete file by regex */
ntfs_log_verbose("ERROR: Failed to undelete "
"inode %lli\n!",
ntfs_log_info("\n");
}
}
results++;
}
skip:
}
}
}
done:
ntfs_log_quiet("\nFiles with potentially recoverable content: %d\n",
results);
out:
if (attr)
return results;
}
/**
* copy_mft - Write a range of MFT Records to a file
* @vol: An ntfs volume obtained from ntfs_mount
* @mft_begin: First MFT Record to save
* @mft_end: Last MFT Record to save
*
* Read a number of MFT Records and write them to a file.
*
* Return: 0 Success, all the records were written
* 1 Error, something went wrong
*/
{
char pathname[256];
char *buffer;
const char *name;
long long i;
int result = 1;
int fd;
if (!vol)
return 1;
ntfs_log_error("Range to copy is backwards.\n");
return 1;
}
if (!buffer) {
ntfs_log_error("Couldn't allocate memory in copy_mft()\n");
return 1;
}
if (!mft) {
ntfs_log_perror("Couldn't open $MFT/$DATA");
goto free;
}
if (!name) {
ntfs_log_debug("No output filename, defaulting to '%s'.\n",
name);
}
if (fd < 0) {
goto attr;
}
ntfs_log_debug("MFT records:\n");
ntfs_log_perror("Couldn't read MFT Record %lld", i);
goto close;
}
ntfs_log_perror("Write failed");
goto close;
}
}
result = 0;
attr:
free:
return result;
}
/**
* handle_undelete
*
* Handles the undelete
*/
{
int result = 1;
int i;
unsigned long long inode;
/* Check whether (an) inode(s) was specified or at least a regex! */
if (nr_entries == 0) {
if (with_regex == 0) {
ntfs_log_error("ERROR: NO inode(s) AND NO match-regex "
"specified!\n");
} else {
if (result)
ntfs_log_verbose("ERROR: Failed to scan device "
}
} else {
/* Normal undelete by specifying inode(s) */
ntfs_log_quiet("Inode Flags %%age Date Size Filename\n");
ntfs_log_quiet("---------------------------------------------------------------\n");
/* loop all given inodes */
for (i = 0; i < nr_entries; i++) {
/* Now undelete file */
if (result)
ntfs_log_verbose("ERROR: Failed to "
"undelete inode %lli\n!", inode);
}
}
}
return (result);
}
/**
* main - Begin here
*
* Start from here.
*
* Return: 0 Success, the program worked
* 1 Error, something went wrong
*/
{
int result = 1;
with_regex = 0;
goto free;
if (!vol)
return 1;
/* handling of the different modes */
/* Scanning */
case MODE_SCAN:
if (result)
ntfs_log_verbose("ERROR: Failed to scan device '%s'.\n",
break;
/* Undelete-handling */
case MODE_UNDELETE:
break;
/* Handling of copy mft */
case MODE_COPY:
if (result)
ntfs_log_verbose("ERROR: Failed to read MFT blocks "
break;
default:
; /* Cannot happen */
}
free:
return result;
}