summaryrefslogtreecommitdiffstats
path: root/src/file_fat.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2009-06-21 19:43:25 +0200
committerChristophe Grenier <grenier@cgsecurity.org>2009-06-21 19:43:25 +0200
commite976d6af99cfa1d5b94cc6d8c93f6b09bb66f783 (patch)
tree34168740ce7f3a9faa23747c1203b0f3dfe686fb /src/file_fat.c
parent05063cc236bf7e8b83f3ce9de5dfc2cc447e805a (diff)
PhotoRec: recover FAT filesystem (ie. floppy image)
Note, you should disable the recovery of other filetypes
Diffstat (limited to 'src/file_fat.c')
-rw-r--r--src/file_fat.c140
1 files changed, 140 insertions, 0 deletions
diff --git a/src/file_fat.c b/src/file_fat.c
new file mode 100644
index 0000000..78c4a82
--- /dev/null
+++ b/src/file_fat.c
@@ -0,0 +1,140 @@
+/*
+
+ File: file_fat.c
+
+ Copyright (C) 2009 Christophe GRENIER <grenier@cgsecurity.org>
+
+ This software is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write the Free Software Foundation, Inc., 51
+ Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+#ifdef HAVE_STRING_H
+#include <string.h>
+#endif
+#include <stdio.h>
+#include "types.h"
+#include "common.h"
+#include "filegen.h"
+#include "log.h"
+#include "memmem.h"
+#include "fat.h"
+
+static void register_header_check_fat(file_stat_t *file_stat);
+static int header_check_fat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new);
+
+const file_hint_t file_hint_fat= {
+ .extension="fat",
+ .description="FAT",
+ .min_header_distance=0,
+ .max_filesize=PHOTOREC_MAX_FILE_SIZE,
+ .recover=1,
+ .enable_by_default=1,
+ .register_header_check=&register_header_check_fat
+};
+
+static const unsigned char fat_sign[2]= { 0x55, 0xAA};
+
+static void register_header_check_fat(file_stat_t *file_stat)
+{
+ register_header_check(0x1fe, fat_sign, sizeof(fat_sign), &header_check_fat, file_stat);
+}
+
+static int header_check_fat(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int safe_header_only, const file_recovery_t *file_recovery, file_recovery_t *file_recovery_new)
+{
+ const struct fat_boot_sector *fat_header=(const struct fat_boot_sector *)buffer;
+ uint64_t start_fat1,start_fat2,start_rootdir,start_data,part_size,end_data;
+ unsigned long int no_of_cluster,fat_length,fat_length_calc;
+ if(!(le16(fat_header->marker)==0xAA55
+ && (fat_header->ignored[0]==0xeb || fat_header->ignored[0]==0xe9)
+ && (fat_header->fats==1 || fat_header->fats==2)))
+ return 0; /* Obviously not a FAT */
+ if(!((fat_header->ignored[0]==0xeb && fat_header->ignored[2]==0x90)||fat_header->ignored[0]==0xe9))
+ return 0;
+ if(fat_sector_size(fat_header)==0 || fat_sector_size(fat_header)%512!=0)
+ return 0;
+ switch(fat_header->sectors_per_cluster)
+ {
+ case 1:
+ case 2:
+ case 4:
+ case 8:
+ case 16:
+ case 32:
+ case 64:
+ case 128:
+ break;
+ default:
+ return 0;
+ }
+ if(fat_header->fats!=1 && fat_header->fats!=2)
+ return 0;
+ if(fat_header->media!=0xF0 && fat_header->media<0xF8)
+ return 0;
+ fat_length=le16(fat_header->fat_length)>0?le16(fat_header->fat_length):le32(fat_header->fat32_length);
+ part_size=(sectors(fat_header)>0?sectors(fat_header):le32(fat_header->total_sect));
+ start_fat1=le16(fat_header->reserved);
+ start_fat2=start_fat1+(fat_header->fats>1?fat_length:0);
+ start_data=start_fat1+fat_header->fats*fat_length+(get_dir_entries(fat_header)*32+fat_sector_size(fat_header)-1)/fat_sector_size(fat_header);
+ no_of_cluster=(part_size-start_data)/fat_header->sectors_per_cluster;
+ end_data=start_data+no_of_cluster*fat_header->sectors_per_cluster-1;
+ if(no_of_cluster<4085)
+ {
+ /* FAT12 */
+ if((get_dir_entries(fat_header)==0)||(get_dir_entries(fat_header)%16!=0))
+ return 0;
+ if((le16(fat_header->fat_length)>256)||(le16(fat_header->fat_length)==0))
+ return 0;
+ start_rootdir=start_fat2+fat_length;
+ fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)*2/3-1)*3/2/fat_sector_size(fat_header));
+ }
+ else if(no_of_cluster<65525)
+ {
+ /* FAT16 */
+ if(le16(fat_header->fat_length)==0)
+ return 0;
+ if((get_dir_entries(fat_header)==0)||(get_dir_entries(fat_header)%16!=0))
+ return 0;
+ start_rootdir=start_fat2+fat_length;
+ fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)/2-1)*2/fat_sector_size(fat_header));
+ }
+ else
+ {
+ /* FAT32 */
+ if(sectors(fat_header)!=0)
+ return 0;
+ if(get_dir_entries(fat_header)!=0)
+ return 0;
+ if((le32(fat_header->root_cluster)<2) ||(le32(fat_header->root_cluster)>=2+no_of_cluster))
+ return 0;
+ start_rootdir=start_data+(uint64_t)(le32(fat_header->root_cluster)-2)*fat_header->sectors_per_cluster;
+ fat_length_calc=((no_of_cluster+2+fat_sector_size(fat_header)/4-1)*4/fat_sector_size(fat_header));
+ }
+ if(fat_length<fat_length_calc)
+ return 0;
+ reset_file_recovery(file_recovery_new);
+ file_recovery_new->extension=file_hint_fat.extension;
+ file_recovery_new->calculated_file_size=(uint64_t)
+ (sectors(fat_header)>0?sectors(fat_header):le32(fat_header->total_sect)) *
+ fat_sector_size(fat_header);
+ file_recovery_new->data_check=&data_check_size;
+ file_recovery_new->file_check=&file_check_size;
+ return 1;
+}