summaryrefslogtreecommitdiffstats
path: root/src/analyse.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2010-11-29 07:38:53 +0100
committerChristophe Grenier <grenier@cgsecurity.org>2010-11-29 07:38:53 +0100
commit4b6c36b87494901b942ce45af8f7d37f88b4202b (patch)
tree65ca92bd530896440902a6c596d1c5cfdfb2b148 /src/analyse.c
parent3487a5c6037e9b2eba333716db78007a9e309984 (diff)
Try to locate truecrypt logical partition by using the logical partition entry.
Diffstat (limited to 'src/analyse.c')
-rw-r--r--src/analyse.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/analyse.c b/src/analyse.c
index 3036f1d..bfe9fc8 100644
--- a/src/analyse.c
+++ b/src/analyse.c
@@ -55,6 +55,7 @@
#include "xfs.h"
#include "zfs.h"
#include "log.h"
+#include "parti386.h"
int search_NTFS_backup(unsigned char *buffer, disk_t *disk, partition_t *partition, const int verbose, const int dump_ind)
{
@@ -199,6 +200,11 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit
partition->part_offset-=le64(sb1->super_offset)*512;
return 1;
}
+ /* Try to locate logical partition that may host truecrypt encrypted filesystem */
+ if(buffer[0x1fe]==0x55 && buffer[0x1ff]==0xAA &&
+ recover_i386_logical(disk, buffer, partition)==0 &&
+ partition->upart_type==UP_UNK)
+ return 1;
return 0;
}