summaryrefslogtreecommitdiffstats
path: root/src/file_bkf.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2009-10-25 18:26:34 +0100
committerChristophe Grenier <grenier@cgsecurity.org>2009-10-25 18:26:34 +0100
commit7cf77194c393f45d4e47c355a4400f4225108931 (patch)
tree481ae7c91f97ff2edd43607b473923984a993431 /src/file_bkf.c
parent5156d5b462f00da3830dc6314dd74feda37f1257 (diff)
PhotoRec: try to detect Microsoft Tape .bkf end of file
Diffstat (limited to 'src/file_bkf.c')
-rw-r--r--src/file_bkf.c20
1 files changed, 18 insertions, 2 deletions
diff --git a/src/file_bkf.c b/src/file_bkf.c
index 4ddeac4..46c8e28 100644
--- a/src/file_bkf.c
+++ b/src/file_bkf.c
@@ -32,6 +32,7 @@
static void register_header_check_bkf(file_stat_t *file_stat);
static int header_check_bkf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
+static void file_check_bkf(file_recovery_t *file_recovery);
const file_hint_t file_hint_bkf= {
.extension="bkf",
@@ -52,12 +53,27 @@ static void register_header_check_bkf(file_stat_t *file_stat)
static int header_check_bkf(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
{
- if(memcmp(buffer,bkf_header,sizeof(bkf_header))==0)
+ if(memcmp(buffer,bkf_header,sizeof(bkf_header))==0 &&
+ buffer[0x14]==0 && buffer[0x15]==0 && buffer[0x16]==0 && buffer[0x17]==0 &&
+ buffer[0x18]==0 && buffer[0x19]==0 && buffer[0x1a]==0 && buffer[0x1b]==0 &&
+ buffer[0x24]==0 && buffer[0x25]==0 && buffer[0x26]==0 && buffer[0x27]==0)
{
+ /* Microsoft Tape Format
+ * The DBLK Type field is set to ‘TAPE’.
+ * The Format Logical Address field is set to zero.
+ * The Control Block ID field is set to zero.
+ */
reset_file_recovery(file_recovery_new);
- file_recovery_new->min_filesize=4;
+ file_recovery_new->min_filesize=52;
file_recovery_new->extension=file_hint_bkf.extension;
+ file_recovery_new->file_check=&file_check_bkf;
return 1;
}
return 0;
}
+
+static void file_check_bkf(file_recovery_t *file_recovery)
+{
+ const unsigned char bkf_footer[4]= { 'S', 'F', 'M', 'B'};
+ file_search_footer(file_recovery, bkf_footer, sizeof(bkf_footer), 0x400-4);
+}