SignatureScanner Class Reference

#include <signature_scanner.hpp>

Static Public Member Functions
static std::vector< ScanResult >	scan (DiskReader &reader, std::vector< std::string > &logs)

Detailed Description

Definition at line 7 of file signature_scanner.hpp.

Member Function Documentation

scan()

std::vector< ScanResult > SignatureScanner::scan ( DiskReader & reader, std::vector< std::string > & logs )

static

Definition at line 41 of file signature_scanner.cpp.

                                                                                           {
    std::vector<ScanResult> out;
    const uint64_t max_scan = reader.size() > 8 * GiB ? 8 * GiB : reader.size();
    const uint64_t stride = adaptive_stride(reader.size());
    logs.push_back(trs("Signature scan: starting filesystem signature scan."));
    logs.push_back(trs("Signature scan stride:") + std::string(" ") + std::to_string(stride / MiB) + " MiB");
 
    for (uint64_t offset = 0; offset + 4096 < max_scan; offset += stride) {
        std::array<unsigned char, 512> sector{};
        if (!reader.read_at(offset, sector.data(), sector.size())) {
            continue;
        }
        if (is_ntfs(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "NTFS candidate", "Signature scan", trs("NTFS boot sector detected"), 0.80});
        }
        if (is_fat32(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "FAT32 candidate", "Signature scan", trs("FAT32 boot sector detected"), 0.78});
        }
        if (is_exfat(sector)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "exFAT candidate", "Signature scan", trs("exFAT boot sector detected"), 0.82});
        }
        if (looks_ext4(reader, offset)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "ext4 candidate", "Signature scan", trs("ext4 superblock detected"), 0.76});
        }
        if (looks_btrfs(reader, offset)) {
            out.push_back({ResultKind::FilesystemCandidate, offset, 0, "Btrfs candidate", "Signature scan", trs("Btrfs superblock detected"), 0.79});
        }
    }
 
    logs.push_back(trs("Signature scan: completed."));
    return out;
}

References FilesystemCandidate, DiskReader::read_at(), DiskReader::size(), and trs().

Referenced by ScannerEngine::run_scan().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/signature_scanner.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/signature_scanner.cpp