summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2020-08-07 08:16:16 +0200
committerChristophe Grenier <grenier@cgsecurity.org>2020-08-07 08:16:16 +0200
commit9b0e8ff284301e4f9d07f5ccadb8c1756c6a9150 (patch)
tree93e7d41eb21ae9ef8cbaa57d2f2f67a729c47277
parent89a4fd6981c7e2acf9669a774a2ed7332d4bfcc6 (diff)
PhotoRec: search for a previous file when
- a file has been recovered and truncated - a file has been recovered and is not immediately followed by a new file
-rw-r--r--src/psearchn.c30
1 files changed, 25 insertions, 5 deletions
diff --git a/src/psearchn.c b/src/psearchn.c
index 70e50de..cabc385 100644
--- a/src/psearchn.c
+++ b/src/psearchn.c
@@ -87,6 +87,7 @@ pstatus_t photorec_aux(struct ph_param *params, const struct ph_options *options
const unsigned int read_size=(blocksize>65536?blocksize:65536);
uint64_t offset_before_back=0;
unsigned int back=0;
+ pfstatus_t file_recovered_old=PFSTATUS_BAD;
alloc_data_t *current_search_space;
file_recovery_t file_recovery;
memset(&file_recovery, 0, sizeof(file_recovery));
@@ -215,19 +216,37 @@ pstatus_t photorec_aux(struct ph_param *params, const struct ph_options *options
{
if(res==DC_SCAN)
{
- get_next_sector(list_search_space, &current_search_space,&offset,blocksize);
- if(offset > offset_before_back)
- back=0;
+ if(file_recovered_old==PFSTATUS_OK)
+ {
+ offset_before_back=offset;
+ if(back < 5 &&
+ get_prev_file_header(list_search_space, &current_search_space, &offset)==0)
+ {
+ back++;
+ }
+ else
+ {
+ back=0;
+ get_prev_location_smart(list_search_space, &current_search_space, &offset, file_recovery.location.start);
+ }
+ }
+ else
+ {
+ get_next_sector(list_search_space, &current_search_space,&offset,blocksize);
+ if(offset > offset_before_back)
+ back=0;
+ }
}
}
- else if(file_recovered==PFSTATUS_OK_TRUNCATED ||
- (file_recovered==PFSTATUS_OK && file_recovery.file_stat==NULL))
+ else if(file_recovered==PFSTATUS_OK_TRUNCATED)
{
/* try to recover the previous file, otherwise stay at the current location */
offset_before_back=offset;
if(back < 5 &&
get_prev_file_header(list_search_space, &current_search_space, &offset)==0)
+ {
back++;
+ }
else
{
back=0;
@@ -298,6 +317,7 @@ pstatus_t photorec_aux(struct ph_param *params, const struct ph_options *options
}
}
}
+ file_recovered_old=file_recovered;
} /* end while(current_search_space!=list_search_space) */
free(buffer_start);
#ifdef HAVE_NCURSES