ntfs_probe.hpp

1. Overview

The ntfs_probe.hpp file validates NTFS boot sectors and emits normalized NTFS scan candidates.

This is an interface and data-contract file. It declares the public and internal types used by this subsystem, allowing implementation files and callers to share a stable compile-time contract.

Its paired source or interface file is ntfs_probe.cpp.

Primary responsibilities:

  • Check OEM and structural signatures
  • Decode sector and cluster geometry
  • Estimate volume size
  • Return confidence and diagnostic details

2. File Identity and Scope

  • Source path: src/ntfs_probe.hpp
  • Language: C++
  • File role: interface and data-contract file
  • Physical lines: 13
  • Non-empty lines: 10
  • SHA-256: efd2927433b7e19e2a2dd981e57ddaf150b9bc65c652221a11b96040fcce77f6

The declarations in this file use the global namespace.

3. Dependencies

3.1 Project Headers

  • disk_reader.hpp
  • models.hpp

3.2 Standard and External Headers

  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

  • class NtfsProbe.

5. Constants and Configuration Values

No preprocessor or compile-time constants were detected as top-level declarations in this file.

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • static std::vector<ScanResult> analyze(DiskReader&reader,const std::vector<ScanResult>&seed_results,std::vector<std::string>&logs) – Implements the operation identified by this API and updates or returns the associated state.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Check OEM and structural signatures.
  2. Decode sector and cluster geometry.
  3. Estimate volume size.
  4. Return confidence and diagnostic details.
  5. Expose or execute the detected APIs: analyze.
  6. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Callers must inspect return values and avoid treating partial output as a complete recovery result.

10. Runtime, Concurrency, and Resource Management

  • Deterministic behavior: callers depend on explicit return values and stable data structures to distinguish successful recovery from partial or invalid results.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.

12. Implementation Considerations

  • Changes to public declarations can affect every translation unit that includes this header and should preserve binary and source compatibility where required.

13. Integration with the Recovery Pipeline

  • The file belongs to the source-discovery, parsing or support layer.
  • Its results feed scanner, recovery or reporting modules through shared models.
  • The API should remain deterministic so higher layers can combine results safely.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: