luisgulo/testdisk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Try to locate truecrypt logical partition by using the logical partition entry.

Browse source
This commit is contained in:
Christophe Grenier 2010-11-29 07:38:53 +01:00
parent 3487a5c603
commit 4b6c36b874
3 changed files with 34 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/analyse.c
View file

@ -55,6 +55,7 @@
#include "xfs.h"
#include "zfs.h"
#include "log.h"
#include "parti386.h"
int search_NTFS_backup(unsigned char *buffer, disk_t *disk, partition_t *partition, const int verbose, const int dump_ind)
{
@ -199,6 +200,11 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit
partition->part_offset-=le64(sb1->super_offset)*512;
return 1;
}
/* Try to locate logical partition that may host truecrypt encrypted filesystem */
if(buffer[0x1fe]==0x55 && buffer[0x1ff]==0xAA &&
recover_i386_logical(disk, buffer, partition)==0 &&
partition->upart_type==UP_UNK)
return 1;
return 0;
}

27
src/parti386.c
View file

@ -612,6 +612,33 @@ static list_part_t *get_ext_data_i386(disk_t *disk_car, list_part_t *list_part,
return list_part;
}
int recover_i386_logical(disk_t *disk, const unsigned char *buffer, partition_t *partition)
{
const struct partition_dos *p=pt_offset_const(buffer,0);
if(partition->arch!=&arch_i386)
return 1;
if(is_extended(p->sys_ind))
p=pt_offset_const(buffer,1);
switch(p->sys_ind)
{
case P_12FAT:
case P_16FAT:
case P_16FATBD:
case P_16FATBD_LBA:
case P_NTFS:
case P_32FAT:
case P_32FAT_LBA:
break;
default:
return 1;
}
if(partition->part_offset==0)
return 1;
i386_entry2partition(disk, partition->part_offset, partition, p, STATUS_DELETED, 0, 0, 0);
partition->order=NO_ORDER;
return 0;
}
static int test_MBR_over(disk_t *disk_car,list_part_t *list_part)
{/* Test if partitions overlap */
int res=0;

1
src/parti386.h
View file

@ -25,6 +25,7 @@ extern "C" {
int parti386_can_be_ext(const disk_t *disk_car, const partition_t *partition);
list_part_t *add_partition_i386_cli(disk_t *disk_car, list_part_t *list_part, char **current_cmd);
int recover_i386_logical(disk_t *disk, const unsigned char *buffer, partition_t *partition);
#ifdef __cplusplus
} /* closing brace for extern "C" */