luisgulo/testdisk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

PhotoRec: add another signature for NFPKDDAT .dat history

Browse source
This commit is contained in:
Christophe Grenier 2012-12-23 17:05:21 +01:00
parent f4f3973bb5
commit 07505440f7
1 changed files with 25 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
src/file_dat.c
View file

@ -2,7 +2,7 @@
File: file_dat.c File: file_dat.c
Copyright (C) 2007 Christophe GRENIER <grenier@cgsecurity.org> Copyright (C) 2007,2012 Christophe GRENIER <grenier@cgsecurity.org>
This software is free software; you can redistribute it and/or modify This software is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by it under the terms of the GNU General Public License as published by
@ -31,9 +31,6 @@
#include "filegen.h" #include "filegen.h"
static void register_header_check_dat(file_stat_t *file_stat); static void register_header_check_dat(file_stat_t *file_stat);
static int header_check_dat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
static int header_check_datIE(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
static int header_check_dat_history(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
const file_hint_t file_hint_dat= { const file_hint_t file_hint_dat= {
.extension="dat", .extension="dat",
@ -45,56 +42,38 @@ const file_hint_t file_hint_dat= {
.register_header_check=&register_header_check_dat .register_header_check=&register_header_check_dat
}; };
static const unsigned char dat_header[8]= {0x30, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
static const unsigned char datIE_header[0x1c]= {
'C', 'l', 'i', 'e', 'n', 't', ' ', 'U',
'r', 'l', 'C', 'a', 'c', 'h', 'e', ' ',
'M', 'M', 'F', ' ', 'V', 'e', 'r', ' ',
'5', '.', '2', 0x00};
/* Found on Sony Ericson phone */
static const unsigned char dat_history[8]={ 'N', 'F', 'P', 'K', 'D', 'D', 'A', 'T'};
static void register_header_check_dat(file_stat_t *file_stat)
{
register_header_check(0, dat_header,sizeof(dat_header), &header_check_dat, file_stat);
register_header_check(0, datIE_header,sizeof(datIE_header), &header_check_datIE, file_stat);
register_header_check(4, dat_history, sizeof(dat_history), &header_check_dat_history, file_stat);
}
static int header_check_dat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new) static int header_check_dat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{ {
if(memcmp(buffer,dat_header,sizeof(dat_header))==0) reset_file_recovery(file_recovery_new);
{ file_recovery_new->extension=file_hint_dat.extension;
reset_file_recovery(file_recovery_new); return 1;
file_recovery_new->extension=file_hint_dat.extension;
return 1;
}
return 0;
} }
static int header_check_datIE(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new) static int header_check_datIE(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{ {
if(memcmp(buffer,datIE_header,sizeof(datIE_header))==0) reset_file_recovery(file_recovery_new);
{ file_recovery_new->extension=file_hint_dat.extension;
reset_file_recovery(file_recovery_new); file_recovery_new->min_filesize=0x20;
file_recovery_new->extension=file_hint_dat.extension; file_recovery_new->calculated_file_size=(uint64_t)buffer[0x1C]+(((uint64_t)buffer[0x1D])<<8)+(((uint64_t)buffer[0x1E])<<16)+(((uint64_t)buffer[0x1F])<<24);
file_recovery_new->min_filesize=0x20; file_recovery_new->data_check=&data_check_size;
file_recovery_new->calculated_file_size=(uint64_t)buffer[0x1C]+(((uint64_t)buffer[0x1D])<<8)+(((uint64_t)buffer[0x1E])<<16)+(((uint64_t)buffer[0x1F])<<24); file_recovery_new->file_check=&file_check_size;
file_recovery_new->data_check=&data_check_size; return 1;
file_recovery_new->file_check=&file_check_size;
return 1;
}
return 0;
} }
static int header_check_dat_history(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new) static int header_check_dat_history(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{ {
if(memcmp(&buffer[4], dat_history, sizeof(dat_history))==0) reset_file_recovery(file_recovery_new);
{ file_recovery_new->extension=file_hint_dat.extension;
reset_file_recovery(file_recovery_new); return 1;
file_recovery_new->extension=file_hint_dat.extension; }
return 1;
} static void register_header_check_dat(file_stat_t *file_stat)
return 0; {
static const unsigned char dat_header[8]= {0x30, 0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
/* Found on Sony Ericson phone */
static const unsigned char dat_history[8]={ 'N', 'F', 'P', 'K', 'D', 'D', 'A', 'T'};
register_header_check(0, dat_header,sizeof(dat_header), &header_check_dat, file_stat);
register_header_check(0, "Client UrlCache MMF Ver 5.2", 0x1c, &header_check_datIE, file_stat);
register_header_check(4, dat_history, sizeof(dat_history), &header_check_dat_history, file_stat);
register_header_check(10, dat_history, sizeof(dat_history), &header_check_dat_history, file_stat);
} }