NtfsProbe Class Reference

#include <ntfs_probe.hpp>

Static Public Member Functions
static std::vector< ScanResult >	analyze (DiskReader &reader, const std::vector< ScanResult > &seed_results, std::vector< std::string > &logs)

Detailed Description

Definition at line 8 of file ntfs_probe.hpp.

Member Function Documentation

analyze()

std::vector< ScanResult > NtfsProbe::analyze ( DiskReader & reader, const std::vector< ScanResult > & seed_results, std::vector< std::string > & logs )

static

Definition at line 48 of file ntfs_probe.cpp.

                                                                       {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen_offsets;
 
    logs.push_back(trs("NTFS probe: analysis started."));
 
    for (const auto& seed : seed_results) {
        const bool interesting_seed =
            seed.kind == ResultKind::Partition ||
            seed.kind == ResultKind::LostPartitionCandidate ||
            seed.kind == ResultKind::FilesystemCandidate;
        if (!interesting_seed || seen_offsets.count(seed.offset_bytes) != 0) {
            continue;
        }
        seen_offsets.insert(seed.offset_bytes);
 
        std::array<unsigned char, 512> sector{};
        if (!reader.read_at(seed.offset_bytes, sector.data(), sector.size()) || !is_ntfs_boot_sector(sector)) {
            continue;
        }
 
        const uint16_t bytes_per_sector = le16(sector.data() + 11);
        const uint8_t sectors_per_cluster = sector[13];
        const uint64_t total_sectors = le64(sector.data() + 40);
        const uint64_t mft_lcn = le64(sector.data() + 48);
        const uint64_t mftmirr_lcn = le64(sector.data() + 56);
        const int8_t record_descriptor = static_cast<int8_t>(sector[64]);
 
        if (bytes_per_sector == 0 || sectors_per_cluster == 0 || total_sectors == 0) {
            continue;
        }
 
        const uint64_t cluster_size = static_cast<uint64_t>(bytes_per_sector) * sectors_per_cluster;
        const uint64_t volume_size = total_sectors * bytes_per_sector;
        const uint64_t record_size = record_size_from_descriptor(record_descriptor, cluster_size);
        // Bug #3/#4 fix: record_size==0 means invalid, skip volume
        if (record_size == 0) {
            continue;
        }
        const uint64_t mft_offset = seed.offset_bytes + (mft_lcn * cluster_size);
        const uint64_t mftmirr_offset = seed.offset_bytes + (mftmirr_lcn * cluster_size);
 
        std::array<char, 4> mft_sig{};
        bool mft_ok = reader.read_at(mft_offset, mft_sig.data(), mft_sig.size()) &&
                      std::string(mft_sig.data(), mft_sig.size()) == "FILE";
 
        std::array<char, 4> mftmirr_sig{};
        bool mftmirr_ok = reader.read_at(mftmirr_offset, mftmirr_sig.data(), mftmirr_sig.size()) &&
                          std::string(mftmirr_sig.data(), mftmirr_sig.size()) == "FILE";
 
        std::ostringstream detail;
        detail << trs("Bytes/sector") << ": " << bytes_per_sector
               << ", " << trs("Sectors/cluster") << ": " << static_cast<unsigned>(sectors_per_cluster)
               << ", " << trs("MFT record size") << ": " << record_size
               << ", " << trs("MFT") << ": " << (mft_ok ? "OK" : "missing")
               << ", " << trs("MFTMirr") << ": " << (mftmirr_ok ? "OK" : "missing");
 
        double confidence = 0.85;
        if (mft_ok) confidence += 0.10;
        if (mftmirr_ok) confidence += 0.03;
        if (confidence > 0.99) confidence = 0.99;
 
        out.push_back({ResultKind::NtfsVolume,
                       seed.offset_bytes,
                       volume_size,
                       "NTFS volume",
                       "NTFS probe",
                       detail.str(),
                       confidence});
 
        if (mft_ok) {
            out.push_back({ResultKind::NtfsMetadata,
                           mft_offset,
                           record_size,
                           "NTFS $MFT",
                           "NTFS probe",
                           trs("Primary MFT record signature validated"),
                           0.96});
        }
        if (mftmirr_ok) {
            out.push_back({ResultKind::NtfsMetadata,
                           mftmirr_offset,
                           record_size,
                           "NTFS $MFTMirr",
                           "NTFS probe",
                           trs("MFT mirror record signature validated"),
                           0.93});
        }
    }
 
    logs.push_back(trs("NTFS probe: analysis completed."));
    return out;
}

References FilesystemCandidate, LostPartitionCandidate, NtfsMetadata, NtfsVolume, Partition, DiskReader::read_at(), and trs().

Referenced by ScannerEngine::run_scan().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/ntfs_probe.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/ntfs_probe.cpp