ntfs_recovery

1. Overview

The ntfs_recovery.cpp file implements NTFS metadata parsing and file recovery using the Master File Table.

This is an implementation file. It contains executable logic for the subsystem, including parsing, I/O, validation, recovery flow, or graphical behavior declared by the corresponding interface.

Its paired source or interface file is ntfs_recovery.hpp.

Primary responsibilities:

  • Read and validate the boot sector
  • Decode MFT records and attributes
  • Apply update-sequence fixups
  • Resolve runlists and directory names
  • Recover resident and non-resident data

2. File Identity and Scope

  • Source path: src/ntfs_recovery.cpp
  • Language: C++
  • File role: implementation file
  • Physical lines: 1780
  • Non-empty lines: 1672
  • SHA-256: 90d47abd813b462a3917505d5d217122762cc061f59b2df71896de844b650ff7

The declarations in this file use the global namespace.

3. Dependencies

3.1 Project Headers

  • ntfs_recovery.hpp
  • i18n.hpp
  • text_utils.hpp

3.2 Standard and External Headers

  • algorithm
  • array
  • cctype
  • cstdint
  • cstring
  • filesystem
  • fstream
  • limits
  • map
  • optional
  • set
  • sstream
  • string
  • utility
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

  • struct DiskSpan.
  • struct NtfsDataRun.
  • struct NtfsVolumeInfo.
  • struct NtfsAttributeListEntry.
  • struct NtfsDataStream.
  • struct NtfsFileRecordInfo.
  • class NtfsRecoveryImpl.
  • struct I30Entry.
  • struct FlagName.

5. Constants and Configuration Values

  • static constexpr uint32_t kLogPageMagicRSTR=0x52545352u
  • static constexpr uint32_t kLogPageMagicRCRD=0x44524352u
  • static constexpr uint16_t kRedoOpInitFileRecord=0x0010

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • ntfs_recovery.hpp
  • ntfs
  • NTFS recovery started at offset
  • Unable to parse NTFS $MFT data runs
  • NTFS $MFTMirr loaded as fallback
  • NTFS $MFTMirr not loadable -- primary MFT
  • NTFS $I30 indexes walked:
  • NTFS stream export failed
  • NTFS
  • NTFS recovery completed.
  • NTFS deleted files exported
  • NTFS alternate data streams exported
  • NTFS unsupported streams skipped
  • NTFS streams skipped because EFS-encrypted
  • NTFS streams skipped because runlist
  • NTFS files with EFS-encrypted data
  • Unable to read NTFS boot sector
  • Invalid NTFS boot sector
  • Invalid NTFS MFT record descriptor (zero)
  • Invalid NTFS MFT record descriptor (out of range)
  • Invalid NTFS geometry
  • Invalid NTFS update sequence array
  • NTFS fixup mismatch on all sectors
  • NTFS $MFTMirr not available
  • Invalid NTFS compression unit
  • Unsupported or invalid NTFS compressed stream
  • Invalid NTFS attribute offset
  • Invalid NTFS attribute length
  • NTFS $I30 walker: directory MFT#
  • Recovered NTFS reparse as symlink:
  • Recovered NTFS reparse metadata:
  • Recovered NTFS USN summary:
  • NTFS $LogFile: cannot read MFT record 2 (skipping)
  • NTFS $LogFile: parse failed (skipping)
  • NTFS $LogFile: no $DATA stream
  • NTFS $LogFile: too small (<8 KiB)
  • NTFS $LogFile: cannot read content:
  • NTFS $LogFile: loaded
  • NTFS $LogFile:

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • uint16_t le16(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint32_t le32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint64_t le64(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline std::string sanitize_component(const std::string&in) – Implements the operation identified by this API and updates or returns the associated state.
  • inline std::string decode_utf16le_ascii(const unsigned char*data,size_t byte_count) – Reads or derives the requested information and returns or stores the decoded result.
  • bool lznt1_decompress(const std::vector<unsigned char>&src,size_t expected_size,std::vector<unsigned char>&dst) – Implements the operation identified by this API and updates or returns the associated state.
  • explicit NtfsRecoveryImpl(DiskReader&reader): reader_(reader) – Implements the operation identified by this API and updates or returns the associated state.
  • bool recover(uint64_t volume_offset,const std::string&output_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Performs the associated recovery or extraction operation.
  • bool read_boot_sector(uint64_t volume_offset,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • uint64_t cluster_to_offset(uint64_t cluster)const – Implements the operation identified by this API and updates or returns the associated state.
  • bool read_raw_record(uint64_t record_number,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • bool apply_fixup(std::vector<unsigned char>&record,std::string&error) – Implements the operation identified by this API and updates or returns the associated state.
  • bool read_mft_record(uint64_t record_number,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • bool read_mft_record_from_mirror(uint64_t record_number,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • std::vector<NtfsDataRun> parse_runlist(const unsigned char*runlist,size_t max_len,uint64_t start_vcn,bool&has_sparse,bool&malformed) – Reads or derives the requested information and returns or stores the decoded result.
  • static void merge_runs(std::vector<NtfsDataRun>&dst,const std::vector<NtfsDataRun>&src) – Updates the relevant collection or range state.
  • bool parse_attribute_list_entries(const unsigned char*value,uint32_t value_len,std::vector<NtfsAttributeListEntry>&out) – Reads or derives the requested information and returns or stores the decoded result.
  • bool read_runs_to_buffer(const std::vector<NtfsDataRun>&runs,uint64_t expected_size,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • bool decode_compressed_stream(const NtfsDataStream&stream,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • bool process_attributes(uint64_t base_record_number,const std::vector<unsigned char>&record,NtfsFileRecordInfo&info,std::vector<NtfsAttributeListEntry>&attr_list,std::string&error) – Implements the operation identified by this API and updates or returns the associated state.
  • bool load_attribute_list_extensions(uint64_t base_record_number,NtfsFileRecordInfo&info,const std::vector<NtfsAttributeListEntry>&attr_list,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • bool parse_file_record(uint64_t record_number,const std::vector<unsigned char>&record,NtfsFileRecordInfo&info,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • void parse_index_entries(const unsigned char*entries_data,size_t total_size,std::vector<I30Entry>&out) – Reads or derives the requested information and returns or stores the decoded result.
  • bool read_indx_block(const std::vector<NtfsDataRun>&runs,uint64_t vcn,uint32_t irs,std::vector<unsigned char>&out,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • void walk_i30(const NtfsFileRecordInfo&dir_info,std::vector<I30Entry>&out_entries,std::vector<std::string>&logs) – Implements the operation identified by this API and updates or returns the associated state.
  • fs::path build_relative_path(uint64_t record_number,const std::map<uint64_t,NtfsFileRecordInfo>&records) – Constructs the requested object, data structure or user-interface component.
  • bool stream_exportable(const NtfsDataStream&stream)const – Implements the operation identified by this API and updates or returns the associated state.
  • fs::path output_path_for_stream(const fs::path&base,const std::string&stream_name) – Implements the operation identified by this API and updates or returns the associated state.
  • fs::path unique_path(const fs::path&candidate) – Implements the operation identified by this API and updates or returns the associated state.
  • void export_reparse_sidecar(const NtfsFileRecordInfo&info,const fs::path&base_path,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs) – Persists or exports the supplied state to the relevant destination.
  • void export_usn_summary_if_needed(const NtfsFileRecordInfo&info,const fs::path&base_path,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs) – Persists or exports the supplied state to the relevant destination.
  • bool read_stream_data(const NtfsDataStream&stream,std::vector<unsigned char>&data,std::string&error) – Reads or derives the requested information and returns or stores the decoded result.
  • void write_usn_reason_flags(std::ostream&out,uint32_t reason) – Persists or exports the supplied state to the relevant destination.
  • bool export_stream(const NtfsDataStream&stream,const fs::path&out_path,std::string&error) – Persists or exports the supplied state to the relevant destination.
  • void scan_logfile(const fs::path&out_root,const std::map<uint64_t,NtfsFileRecordInfo>&live_records,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs) – Inspects the source and reports matching candidates or detected metadata.
  • NtfsRecovery::NtfsRecovery(DiskReader&reader): reader_(reader) – Implements the operation identified by this API and updates or returns the associated state.
  • bool NtfsRecovery::recover(uint64_t volume_offset,const std::string&output_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Performs the associated recovery or extraction operation.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Read and validate the boot sector.
  2. Decode MFT records and attributes.
  3. Apply update-sequence fixups.
  4. Resolve runlists and directory names.
  5. Recover resident and non-resident data.
  6. Expose or execute the detected APIs: le16, le32, le64, sanitize_component, decode_utf16le_ascii, lznt1_decompress, NtfsRecoveryImpl, recover, read_boot_sector, cluster_to_offset, read_raw_record, apply_fixup, read_mft_record, read_mft_record_from_mirror, parse_runlist, merge_runs, parse_attribute_list_entries, read_runs_to_buffer and additional helpers.
  7. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Errors are propagated through Boolean results, error strings, logs, exceptions, or status records depending on the API.
  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.
  • The implementation contains explicit failure-catching paths and should retain the original diagnostic context.

10. Runtime, Concurrency, and Resource Management

  • I/O: filesystem and raw-source operations can fail partially and must preserve exact byte counts and diagnostic context.
  • Error handling: explicit error, exception or optional-result paths are present and form part of the file contract.
  • File descriptors and streams must be closed on success, cancellation and error paths.
  • Temporary loop devices, mappings and mounts require deterministic reverse-order cleanup.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.
  • Recovered names and destination paths must be sanitized to prevent directory traversal and accidental overwrite outside the selected export directory.
  • Operations that open block devices, create mappings or mount filesystems require elevated privileges and should expose the smallest possible privileged surface.

12. Implementation Considerations

  • The implementation should remain aligned with declarations in the paired header and preserve documented return-value semantics.
  • The file is large and combines multiple parsing or recovery stages; refactoring should preserve byte-level behavior and regression coverage.
  • Binary decoding uses low-level memory operations or casts; alignment, endianness and packed-structure assumptions require careful review.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.
  • Filesystem operations can cross trust boundaries and should use normalized, contained destination paths.

13. Integration with the Recovery Pipeline

  • The file belongs to the extraction layer and consumes scan candidates or validated filesystem metadata.
  • Recovered output is represented through shared models and returned to the exporter or UI.
  • Partial recovery must be reported explicitly rather than silently treated as complete.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: