summaryrefslogtreecommitdiffstats
path: root/src/analyse.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2015-12-03 13:25:31 +0100
committerChristophe Grenier <grenier@cgsecurity.org>2015-12-03 13:25:31 +0100
commit636fcb513db03d9b9276979b97324a5e6622b80d (patch)
treed94ebcd7bc28f28a50ea77dafd6ab17c55f6cb11 /src/analyse.c
parentdc6dc8cce268f288b777c7d703b71617abf59daf (diff)
Detect Microsoft ReFS filesystem
Diffstat (limited to 'src/analyse.c')
-rw-r--r--src/analyse.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/analyse.c b/src/analyse.c
index 99d47aa..a8448d1 100644
--- a/src/analyse.c
+++ b/src/analyse.c
@@ -2,7 +2,7 @@
File: analyse.c
- Copyright (C) 1998-2011 Christophe GRENIER <grenier@cgsecurity.org>
+ Copyright (C) 1998-2015 Christophe GRENIER <grenier@cgsecurity.org>
This software is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -49,6 +49,7 @@
#include "md.h"
#include "netware.h"
#include "ntfs.h"
+#include "refs.h"
#include "rfs.h"
#include "sun.h"
#include "swap.h"
@@ -145,6 +146,7 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit
const struct wbfs_head *wbfs=(const struct wbfs_head *)buffer;
const struct xfs_sb *xfs=(const struct xfs_sb *)buffer;
const union swap_header *swap_header=(const union swap_header *)buffer;
+ const struct ReFS_boot_sector *refs_header=(const struct ReFS_boot_sector *)buffer;
static const uint8_t LUKS_MAGIC[LUKS_MAGIC_L] = {'L','U','K','S', 0xba, 0xbe};
// assert(sizeof(union swap_header)<=8*DEFAULT_SECTOR_SIZE);
// assert(sizeof(pv_disk_t)<=8*DEFAULT_SECTOR_SIZE);
@@ -192,6 +194,9 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit
if(memcmp(luks->magic,LUKS_MAGIC,LUKS_MAGIC_L)==0 &&
recover_LUKS(disk, luks, partition, verbose, dump_ind)==0)
return 1;
+ if(refs_header->fsname==be32(0x52654653) &&
+ recover_ReFS(disk, refs_header, partition)==0)
+ return 1;
/* MD 1.1 */
if(le32(sb1->major_version)==1 &&
recover_MD(disk, (const struct mdp_superblock_s*)buffer, partition, verbose, dump_ind)==0)