diff options
author | Christophe Grenier <grenier@cgsecurity.org> | 2010-11-29 07:38:53 +0100 |
---|---|---|
committer | Christophe Grenier <grenier@cgsecurity.org> | 2010-11-29 07:38:53 +0100 |
commit | 4b6c36b87494901b942ce45af8f7d37f88b4202b (patch) | |
tree | 65ca92bd530896440902a6c596d1c5cfdfb2b148 /src/analyse.c | |
parent | 3487a5c6037e9b2eba333716db78007a9e309984 (diff) |
Try to locate truecrypt logical partition by using the logical partition entry.
Diffstat (limited to 'src/analyse.c')
-rw-r--r-- | src/analyse.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/analyse.c b/src/analyse.c index 3036f1d..bfe9fc8 100644 --- a/src/analyse.c +++ b/src/analyse.c @@ -55,6 +55,7 @@ #include "xfs.h" #include "zfs.h" #include "log.h" +#include "parti386.h" int search_NTFS_backup(unsigned char *buffer, disk_t *disk, partition_t *partition, const int verbose, const int dump_ind) { @@ -199,6 +200,11 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit partition->part_offset-=le64(sb1->super_offset)*512; return 1; } + /* Try to locate logical partition that may host truecrypt encrypted filesystem */ + if(buffer[0x1fe]==0x55 && buffer[0x1ff]==0xAA && + recover_i386_logical(disk, buffer, partition)==0 && + partition->upart_type==UP_UNK) + return 1; return 0; } |