luisgulo/testdisk
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NTFS: log more information when repairing MFT

Browse Source
This commit is contained in:
Christophe Grenier 2007-11-07 08:02:54 +01:00
parent 3fec683bcc
commit b2be4d2dc7
3 changed files with 51 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
configure.ac
View File

@ -31,7 +31,7 @@ fi
# Command-line options.
AC_ARG_WITH([ext2fs],
AS_HELP_STRING(--without-ext2fs,disabled use of the ext2fs library (default is NO)),
[ use_ext2fs="n" ])
[ use_ext2fs="n" ])
AC_ARG_WITH(ext2fs-lib,
AS_HELP_STRING(--with-ext2fs-lib=DIR,location of the ext2fs library),
@ -44,7 +44,7 @@ AC_ARG_WITH(ext2fs-includes,
AC_ARG_WITH([jpeg],
AS_HELP_STRING(--without-jpeg,disabled use of the jpeg library (default is NO)),
[ use_jpeg="n" ])
[ use_jpeg="n" ])
#AC_ARG_WITH(jpegmmx-lib,
# AS_HELP_STRING(--with-jpegmmx-lib=DIR,location of the jpeg library),
@ -53,16 +53,16 @@ AC_ARG_WITH([jpeg],
AC_ARG_WITH(jpeg-lib,
AS_HELP_STRING(--with-jpeg-lib=DIR,location of the jpeg library),
[ jpeg_lib_a="${withval}/libjpeg.a"
LDFLAGS="${LDFLAGS} -L${withval}" ])
[ jpeg_lib_a="${withval}/libjpeg.a"
LDFLAGS="${LDFLAGS} -L${withval}" ])
AC_ARG_WITH(jpeg-includes,
AS_HELP_STRING(--with-jpeg-includes=DIR,location of the jpeg includes files),
[CPPFLAGS="${CPPFLAGS} -I${withval}"])
[CPPFLAGS="${CPPFLAGS} -I${withval}"])
AC_ARG_WITH([ntfs],
AS_HELP_STRING(--without-ntfs,disabled use of the ntfs library (default is NO)),
[ use_ntfs="n" ])
[ use_ntfs="n" ])
AC_ARG_WITH(ntfs-lib,
AS_HELP_STRING(--with-ntfs-lib=DIR,location of the ntfs library),
@ -80,7 +80,7 @@ AC_ARG_WITH(dal-lib,
AC_ARG_WITH([reiserfs],
AS_HELP_STRING(--without-reiserfs,disabled use of the reiserfs library (default is NO)),
[ use_reiserfs="n" ])
[ use_reiserfs="n" ])
AC_ARG_WITH(reiserfs-lib,
AS_HELP_STRING(--with-reiserfs-lib=DIR,location of the reiserfs library),
@ -93,7 +93,7 @@ AC_ARG_WITH(reiserfs-includes,
AC_ARG_WITH([ewf],
AS_HELP_STRING(--without-ewf,disabled use of the ewf library (default is NO)),
[ use_ewf="n" ])
[ use_ewf="n" ])
AC_ARG_WITH(ewf-lib,
AS_HELP_STRING(--with-ewf-lib=DIR,location of the ewf library),

46
src/file_mov.c
View File

@ -192,28 +192,28 @@ static int data_check_mov(const unsigned char *buffer, const unsigned int buffer
atom_size=(buffer[i+0]<<24)+(buffer[i+1]<<16)+(buffer[i+2]<<8)+buffer[i+3];
#ifdef DEBUG_MOV
log_trace("file_mov.c: atom %c%c%c%c (0x%02x%02x%02x%02x) size %u, calculated_file_size %llu\n",
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
atom_size,
(long long unsigned)file_recovery->calculated_file_size);
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
atom_size,
(long long unsigned)file_recovery->calculated_file_size);
#endif
if(atom_size>=8 && atom_size<1024*1024*1024 &&
((buffer[i+4]=='f' && buffer[i+5]=='r' && buffer[i+6]=='e' && buffer[i+7]=='e') ||
(buffer[i+4]=='s' && buffer[i+5]=='k' && buffer[i+6]=='i' && buffer[i+7]=='p') ||
(buffer[i+4]=='w' && buffer[i+5]=='i' && buffer[i+6]=='d' && buffer[i+7]=='e') ||
(buffer[i+4]=='p' && buffer[i+5]=='n' && buffer[i+6]=='o' && buffer[i+7]=='t') ||
(buffer[i+4]=='m' && buffer[i+5]=='o' && buffer[i+6]=='o' && buffer[i+7]=='v') ||
(buffer[i+4]=='m' && buffer[i+5]=='d' && buffer[i+6]=='a' && buffer[i+7]=='t') ||
(buffer[i+4]=='f' && buffer[i+5]=='t' && buffer[i+6]=='y' && buffer[i+7]=='p') ||
(buffer[i+4]=='t' && buffer[i+5]=='r' && buffer[i+6]=='a' && buffer[i+7]=='k') ||
(buffer[i+4]=='m' && buffer[i+5]=='d' && buffer[i+6]=='i' && buffer[i+7]=='a') ||
(buffer[i+4]=='s' && buffer[i+5]=='t' && buffer[i+6]=='b' && buffer[i+7]=='l') ||
(buffer[i+4]=='c' && buffer[i+5]=='m' && buffer[i+6]=='o' && buffer[i+7]=='v') ||
(buffer[i+4]=='d' && buffer[i+5]=='c' && buffer[i+6]=='o' && buffer[i+7]=='m') ||
(buffer[i+4]=='c' && buffer[i+5]=='m' && buffer[i+6]=='v' && buffer[i+7]=='d') ||
(buffer[i+4]=='j' && buffer[i+5]=='p' && buffer[i+6]=='2' && buffer[i+7]=='h') ||
(buffer[i+4]=='P' && buffer[i+5]=='I' && buffer[i+6]=='C' && buffer[i+7]=='T')
)
((buffer[i+4]=='f' && buffer[i+5]=='r' && buffer[i+6]=='e' && buffer[i+7]=='e') ||
(buffer[i+4]=='s' && buffer[i+5]=='k' && buffer[i+6]=='i' && buffer[i+7]=='p') ||
(buffer[i+4]=='w' && buffer[i+5]=='i' && buffer[i+6]=='d' && buffer[i+7]=='e') ||
(buffer[i+4]=='p' && buffer[i+5]=='n' && buffer[i+6]=='o' && buffer[i+7]=='t') ||
(buffer[i+4]=='m' && buffer[i+5]=='o' && buffer[i+6]=='o' && buffer[i+7]=='v') ||
(buffer[i+4]=='m' && buffer[i+5]=='d' && buffer[i+6]=='a' && buffer[i+7]=='t') ||
(buffer[i+4]=='f' && buffer[i+5]=='t' && buffer[i+6]=='y' && buffer[i+7]=='p') ||
(buffer[i+4]=='t' && buffer[i+5]=='r' && buffer[i+6]=='a' && buffer[i+7]=='k') ||
(buffer[i+4]=='m' && buffer[i+5]=='d' && buffer[i+6]=='i' && buffer[i+7]=='a') ||
(buffer[i+4]=='s' && buffer[i+5]=='t' && buffer[i+6]=='b' && buffer[i+7]=='l') ||
(buffer[i+4]=='c' && buffer[i+5]=='m' && buffer[i+6]=='o' && buffer[i+7]=='v') ||
(buffer[i+4]=='d' && buffer[i+5]=='c' && buffer[i+6]=='o' && buffer[i+7]=='m') ||
(buffer[i+4]=='c' && buffer[i+5]=='m' && buffer[i+6]=='v' && buffer[i+7]=='d') ||
(buffer[i+4]=='j' && buffer[i+5]=='p' && buffer[i+6]=='2' && buffer[i+7]=='h') ||
(buffer[i+4]=='P' && buffer[i+5]=='I' && buffer[i+6]=='C' && buffer[i+7]=='T')
)
)
{
file_recovery->calculated_file_size+=(uint64_t)atom_size;
@ -221,9 +221,9 @@ static int data_check_mov(const unsigned char *buffer, const unsigned int buffer
else
{
if(!(buffer[i+4]==0 && buffer[i+5]==0 && buffer[i+6]==0 && buffer[i+7]==0))
log_warning("file_mov.c: unknown atom 0x%02x%02x%02x%02x at %llu\n",
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
(long long unsigned)file_recovery->calculated_file_size);
log_warning("file_mov.c: unknown atom 0x%02x%02x%02x%02x at %llu\n",
buffer[i+4],buffer[i+5],buffer[i+6],buffer[i+7],
(long long unsigned)file_recovery->calculated_file_size);
return 2;
}
}

25
src/ntfs_fix.c
View File

@ -44,11 +44,7 @@
#include "log.h"
//#define DEBUG_REPAIR_MFT 1
/*
dd if=/mnt/data/data_for_testdisk/ntfs.dd skip=127759 count=1 bs=512|hexdump -C
dd if=/dev/zero of=/mnt/data/data_for_testdisk/ntfs_bad_mft.dd seek=85184 count=1 bs=512 conv=notrunc
dd if=/dev/zero of=/mnt/data/data_for_testdisk/ntfs_bad_mftmirr.dd seek=127759 count=1 bs=512 conv=notrunc
*/
int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char **current_cmd)
{
struct ntfs_boot_sector *ntfs_header;
@ -60,6 +56,7 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
unsigned int mftmirr_size_bytes;
uint64_t mft_pos;
uint64_t mftmirr_pos;
log_trace("repair_MFT\n");
if(check_NTFS(disk_car, partition, verbose, 0)!=0)
{
display_message("Boot sector not valid, can't repair MFT.\n");
@ -100,6 +97,7 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
if(disk_car->read(disk_car, mftmirr_size_bytes, buffer_mft, mft_pos)!=0)
{
display_message("Can't read NTFS MFT.\n");
log_error("Can't read NTFS MFT.\n");
free(buffer_mft);
free(ntfs_header);
return -1;
@ -108,6 +106,7 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
if(disk_car->read(disk_car, mftmirr_size_bytes, buffer_mftmirr, mftmirr_pos)!=0)
{
display_message("Can't read NTFS MFT mirror.\n");
log_error("Can't read NTFS MFT mirror.\n");
free(buffer_mftmirr);
free(buffer_mft);
free(ntfs_header);
@ -115,6 +114,7 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
}
if(memcmp(buffer_mft, buffer_mftmirr, mftmirr_size_bytes)==0)
{
log_info("MFT and MFT mirror matches perfectly.\n");
display_message("MFT and MFT mirror matches perfectly.\n");
free(buffer_mftmirr);
free(buffer_mft);
@ -142,6 +142,7 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
if(res1==-2)
{
display_message("Can't determine which MFT is correct, ntfslib is missing.\n");
log_error("Can't determine which MFT is correct, ntfslib is missing.\n");
free(buffer_mftmirr);
free(buffer_mft);
free(ntfs_header);
@ -186,9 +187,15 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
if(ask_confirmation("Fix MFT mirror ? (Y/N)")!=0)
{
if(disk_car->write(disk_car, mftmirr_size_bytes, buffer_mft, mftmirr_pos)!=0)
{
log_error("Failed to fix MFT mirror: write error.\n");
display_message("Failed to fix MFT mirror: write error.\n");
}
else
{
log_info("MFT mirror fixed.\n");
display_message("MFT mirror fixed.\n");
}
}
else
{
@ -201,9 +208,15 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
if(ask_confirmation("Fix MFT ? (Y/N)")!=0)
{
if(disk_car->write(disk_car, mftmirr_size_bytes, buffer_mftmirr, mft_pos)!=0)
{
log_error("Failed to fix MFT: write error.\n");
display_message("Failed to fix MFT: write error.\n");
}
else
{
log_info("MFT fixed.\n");
display_message("MFT fixed.\n");
}
}
else
{
@ -213,11 +226,13 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, char
else if(res1<0)
{
/* Both are bad */
log_error("MFT and MFT mirror are bad. Failed to repair them.\n");
display_message("MFT and MFT mirror are bad. Failed to repair them.\n");
}
else
{
/* Use chkdsk */
log_error("Both MFT seems ok but they don't match, use chkdsk.\n");
display_message("Both MFT seems ok but they don't match, use chkdsk.\n");
}
}