summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2016-07-10 09:14:34 +0200
committerChristophe Grenier <grenier@cgsecurity.org>2016-07-10 09:14:34 +0200
commit3932c37783d5e943c9fafe71b3e7126408f8ac7e (patch)
tree8434bbaa07458fa585a0474dd9c34af24090a506
parentd01e793ca4019f06480484a9d89942df6e6ddd8b (diff)
Fix mft_record_size - "Fix MFT" wasn't working
-rw-r--r--src/ntfs.c22
-rw-r--r--src/ntfs_adv.c2
-rw-r--r--src/ntfs_fix.c27
3 files changed, 25 insertions, 26 deletions
diff --git a/src/ntfs.c b/src/ntfs.c
index 5c0a14f..c624ee2 100644
--- a/src/ntfs.c
+++ b/src/ntfs.c
@@ -303,35 +303,33 @@ static void ntfs_get_volume_name(disk_t *disk_car, partition_t *partition, const
unsigned char *buffer;
uint64_t mft_pos;
unsigned int mft_record_size;
- unsigned int mft_size;
if(ntfs_header->clusters_per_mft_record>0)
- mft_record_size=ntfs_header->sectors_per_cluster*ntfs_header->clusters_per_mft_record;
+ mft_record_size=ntfs_header->clusters_per_mft_record * ntfs_header->sectors_per_cluster * ntfs_sector_size(ntfs_header);
else
mft_record_size=1<<(-ntfs_header->clusters_per_mft_record);
- mft_size=mft_record_size*ntfs_sector_size(ntfs_header);
mft_pos=partition->part_offset+(uint64_t)(le16(ntfs_header->reserved)+le64(ntfs_header->mft_lcn)*ntfs_header->sectors_per_cluster)*ntfs_sector_size(ntfs_header);
/* Record 3 = $Volume */
- mft_pos+=3*mft_size;
+ mft_pos+=3*mft_record_size;
#ifdef NTFS_DEBUG
- log_debug("NTFS cluster size = %u\n",ntfs_header->sectors_per_cluster);
log_debug("NTFS MFT cluster = %lu\n",le64(ntfs_header->mft_lcn));
- log_debug("NTFS MFT_record_size = %u\n",mft_record_size);
- log_debug("NTFS sector size= %u\n", ntfs_sector_size(ntfs_header));
+ log_debug("NTFS cluster size = %5u sectors\n",ntfs_header->sectors_per_cluster);
+ log_debug("NTFS MFT_record_size = %5u bytes\n",mft_record_size);
+ log_debug("NTFS sector size = %5u bytes\n", ntfs_sector_size(ntfs_header));
#endif
- if(mft_size==0)
+ if(mft_record_size==0)
{
log_error("Invalid MFT record size or NTFS sector size\n");
return;
}
- buffer=(unsigned char *)MALLOC(mft_size);
- if((unsigned)disk_car->pread(disk_car, buffer, mft_size, mft_pos) != mft_size)
+ buffer=(unsigned char *)MALLOC(mft_record_size);
+ if((unsigned)disk_car->pread(disk_car, buffer, mft_record_size, mft_pos) != mft_record_size)
{
log_error("NTFS: Can't read MFT\n");
free(buffer);
return;
}
{
- const ntfs_attribresident *attrib=(const ntfs_attribresident *)ntfs_findattribute((const ntfs_recordheader*)buffer, 0x60, (char*)buffer+mft_size);
+ const ntfs_attribresident *attrib=(const ntfs_attribresident *)ntfs_findattribute((const ntfs_recordheader*)buffer, 0x60, (char*)buffer+mft_record_size);
if(attrib && attrib->header.bNonResident==0) /* attribute is resident */
{
char *dest=partition->fsname;
@@ -340,7 +338,7 @@ static void ntfs_get_volume_name(disk_t *disk_car, partition_t *partition, const
volume_name_length/=2; /* Unicode */
if(volume_name_length>sizeof(partition->fsname)-1)
volume_name_length=sizeof(partition->fsname)-1;
- for(name_it=ntfs_getattributedata(attrib, (char*)(buffer+mft_size));
+ for(name_it=ntfs_getattributedata(attrib, (char*)(buffer+mft_record_size));
volume_name_length>0 && *name_it!='\0' && name_it[1]=='\0';
name_it+=2,volume_name_length--)
*dest++=*name_it;
diff --git a/src/ntfs_adv.c b/src/ntfs_adv.c
index 86c67c4..346ee8f 100644
--- a/src/ntfs_adv.c
+++ b/src/ntfs_adv.c
@@ -661,7 +661,7 @@ int rebuild_NTFS_BS(disk_t *disk_car, partition_t *partition, const int verbose,
log_info("ntfs_find_mft: sectors_per_cluster %u\n",sectors_per_cluster);
log_info("ntfs_find_mft: mft_lcn %lu\n",(long unsigned int)mft_lcn);
log_info("ntfs_find_mft: mftmirr_lcn %lu\n",(long unsigned int)mftmirr_lcn);
- log_info("ntfs_find_mft: mft_record_size %u\n",mft_record_size);
+ log_info("ntfs_find_mft: mft_record_size %u bytes\n",mft_record_size);
/* Read "root directory" in MFT */
if((unsigned)disk_car->pread(disk_car, &buffer, mft_record_size, partition->part_offset + (uint64_t)mft_lcn * sectors_per_cluster * disk_car->sector_size + 5 * (uint64_t)mft_record_size) != mft_record_size)
{
diff --git a/src/ntfs_fix.c b/src/ntfs_fix.c
index 2b493d0..0549139 100644
--- a/src/ntfs_fix.c
+++ b/src/ntfs_fix.c
@@ -80,20 +80,20 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, cons
mft_pos=partition->part_offset+(uint64_t)(le16(ntfs_header->reserved)+le64(ntfs_header->mft_lcn)*ntfs_header->sectors_per_cluster)*ntfs_sector_size(ntfs_header);
mftmirr_pos=partition->part_offset+(uint64_t)(le16(ntfs_header->reserved)+le64(ntfs_header->mftmirr_lcn)*ntfs_header->sectors_per_cluster)*ntfs_sector_size(ntfs_header);
if(ntfs_header->clusters_per_mft_record>0)
- mft_record_size=ntfs_header->sectors_per_cluster*ntfs_header->clusters_per_mft_record;
+ mft_record_size=ntfs_header->clusters_per_mft_record * ntfs_header->sectors_per_cluster * ntfs_sector_size(ntfs_header);
else
mft_record_size=1<<(-ntfs_header->clusters_per_mft_record);
- cluster_size=ntfs_header->sectors_per_cluster;
+ cluster_size=ntfs_header->sectors_per_cluster * ntfs_sector_size(ntfs_header);
- mftmirr_size_bytes = (cluster_size <= 4 * mft_record_size ? 4 * mft_record_size : cluster_size) * ntfs_sector_size(ntfs_header);
+ mftmirr_size_bytes = td_max(cluster_size , 4 * mft_record_size);
#ifdef DEBUG_REPAIR_MFT
- log_debug("mft_pos %lu\n",(unsigned long)(mft_pos/disk_car->sector_size));
- log_debug("mftmirr_pos %lu\n",(unsigned long)(mftmirr_pos/disk_car->sector_size));
- log_debug("cluster_size %u\n", cluster_size);
- log_debug("mft_record_size %u\n", mft_record_size);
- log_debug("ntfs_sector_size %u\n", ntfs_sector_size(ntfs_header));
- log_debug("mftmirr_size_bytes %u\n", mftmirr_size_bytes);
+ log_info("mft_pos %lu\n",(unsigned long)(mft_pos/disk_car->sector_size));
+ log_info("mftmirr_pos %lu\n",(unsigned long)(mftmirr_pos/disk_car->sector_size));
+ log_info("cluster_size %5u bytes\n", cluster_size);
+ log_info("mft_record_size %5u bytes\n", mft_record_size);
+ log_info("ntfs_sector_size %5u bytes\n", ntfs_sector_size(ntfs_header));
+ log_info("mftmirr_size %5u bytes\n", mftmirr_size_bytes);
#endif
if(mftmirr_size_bytes==0)
{
@@ -141,12 +141,13 @@ int repair_MFT(disk_t *disk_car, partition_t *partition, const int verbose, cons
free(ntfs_header);
return -1;
}
-/*
- log_debug("MFT\n");
+#ifdef DEBUG_REPAIR_MFT
+ log_info("MFT\n");
dump_log(buffer_mft, mftmirr_size_bytes);
- log_debug("MFT mirror\n");
+ log_info("MFT mirror\n");
dump_log(buffer_mftmirr, mftmirr_size_bytes);
- */
+ log_flush();
+#endif
/*
The idea is to use the internal IO redirector built-in TestDisk
to redirect read access to the MFT to the MFT backup instead (or