summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--src/analyse.c6
-rw-r--r--src/parti386.c27
-rw-r--r--src/parti386.h1
3 files changed, 34 insertions, 0 deletions
diff --git a/src/analyse.c b/src/analyse.c
index 3036f1d..bfe9fc8 100644
--- a/src/analyse.c
+++ b/src/analyse.c
@@ -55,6 +55,7 @@
#include "xfs.h"
#include "zfs.h"
#include "log.h"
+#include "parti386.h"
int search_NTFS_backup(unsigned char *buffer, disk_t *disk, partition_t *partition, const int verbose, const int dump_ind)
{
@@ -199,6 +200,11 @@ int search_type_0(const unsigned char *buffer, disk_t *disk, partition_t *partit
partition->part_offset-=le64(sb1->super_offset)*512;
return 1;
}
+ /* Try to locate logical partition that may host truecrypt encrypted filesystem */
+ if(buffer[0x1fe]==0x55 && buffer[0x1ff]==0xAA &&
+ recover_i386_logical(disk, buffer, partition)==0 &&
+ partition->upart_type==UP_UNK)
+ return 1;
return 0;
}
diff --git a/src/parti386.c b/src/parti386.c
index f39b9ad..7f0a98c 100644
--- a/src/parti386.c
+++ b/src/parti386.c
@@ -612,6 +612,33 @@ static list_part_t *get_ext_data_i386(disk_t *disk_car, list_part_t *list_part,
return list_part;
}
+int recover_i386_logical(disk_t *disk, const unsigned char *buffer, partition_t *partition)
+{
+ const struct partition_dos *p=pt_offset_const(buffer,0);
+ if(partition->arch!=&arch_i386)
+ return 1;
+ if(is_extended(p->sys_ind))
+ p=pt_offset_const(buffer,1);
+ switch(p->sys_ind)
+ {
+ case P_12FAT:
+ case P_16FAT:
+ case P_16FATBD:
+ case P_16FATBD_LBA:
+ case P_NTFS:
+ case P_32FAT:
+ case P_32FAT_LBA:
+ break;
+ default:
+ return 1;
+ }
+ if(partition->part_offset==0)
+ return 1;
+ i386_entry2partition(disk, partition->part_offset, partition, p, STATUS_DELETED, 0, 0, 0);
+ partition->order=NO_ORDER;
+ return 0;
+}
+
static int test_MBR_over(disk_t *disk_car,list_part_t *list_part)
{/* Test if partitions overlap */
int res=0;
diff --git a/src/parti386.h b/src/parti386.h
index 80a1909..fde6957 100644
--- a/src/parti386.h
+++ b/src/parti386.h
@@ -25,6 +25,7 @@ extern "C" {
int parti386_can_be_ext(const disk_t *disk_car, const partition_t *partition);
list_part_t *add_partition_i386_cli(disk_t *disk_car, list_part_t *list_part, char **current_cmd);
+int recover_i386_logical(disk_t *disk, const unsigned char *buffer, partition_t *partition);
#ifdef __cplusplus
} /* closing brace for extern "C" */