filesystem_probes.cpp

Go to the documentation of this file.

#include "filesystem_probes.hpp"
#include "i18n.hpp"
#include "xfs_format.hpp"
#include "hfs_format.hpp"
 
#include <array>
#include <set>
#include <sstream>
#include <string>
#include <vector>
 
namespace {
constexpr uint64_t SECTOR_SIZE = 512ull;
 
uint16_t le16(const unsigned char* p) {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}
 
uint32_t le32(const unsigned char* p) {
    return static_cast<uint32_t>(p[0]) |
           (static_cast<uint32_t>(p[1]) << 8) |
           (static_cast<uint32_t>(p[2]) << 16) |
           (static_cast<uint32_t>(p[3]) << 24);
}
 
uint64_t le64(const unsigned char* p) {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}
 
bool read_sector(DiskReader& reader, uint64_t offset, std::array<unsigned char, 512>& sector) {
    return reader.read_at(offset, sector.data(), sector.size());
}
 
bool is_fat32(const std::array<unsigned char, 512>& sector) {
    return std::string(reinterpret_cast<const char*>(sector.data() + 82), 8) == "FAT32   " &&
           sector[510] == 0x55 && sector[511] == 0xAA;
}
 
bool is_exfat(const std::array<unsigned char, 512>& sector) {
    return std::string(reinterpret_cast<const char*>(sector.data() + 3), 8) == "EXFAT   " &&
           sector[510] == 0x55 && sector[511] == 0xAA;
}
 
bool ext4_has_magic(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 2> sig{};
    return reader.read_at(offset + 1024 + 56, sig.data(), sig.size()) && sig[0] == 0x53 && sig[1] == 0xEF;
}
 
bool btrfs_has_magic(DiskReader& reader, uint64_t offset) {
    std::array<char, 8> sig{};
    return reader.read_at(offset + 0x10040, sig.data(), sig.size()) && std::string(sig.data(), sig.size()) == "_BHRfS_M";
}
 
ScanResult fat32_probe(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 512> sector{};
    if (!read_sector(reader, offset, sector) || !is_fat32(sector)) {
        return {};
    }
 
    const uint16_t bytes_per_sector = le16(sector.data() + 11);
    const uint8_t sectors_per_cluster = sector[13];
    const uint16_t reserved_sectors = le16(sector.data() + 14);
    const uint8_t fats = sector[16];
    const uint32_t total_sectors = le32(sector.data() + 32);
    const uint32_t sectors_per_fat = le32(sector.data() + 36);
    const uint32_t root_cluster = le32(sector.data() + 44);
    const uint16_t fsinfo_sector = le16(sector.data() + 48);
    const uint16_t backup_boot_sector = le16(sector.data() + 50);
 
    if (bytes_per_sector == 0 || sectors_per_cluster == 0 || total_sectors == 0) {
        return {};
    }
 
    const uint64_t volume_size = static_cast<uint64_t>(bytes_per_sector) * total_sectors;
    std::ostringstream detail;
    detail << trs("Bytes/sector") << ": " << bytes_per_sector
           << ", " << trs("Sectors/cluster") << ": " << static_cast<unsigned>(sectors_per_cluster)
           << trs(", FATs: ") << static_cast<unsigned>(fats)
           << trs(", Reserved: ") << reserved_sectors
           << trs(", Sectors/FAT: ") << sectors_per_fat
           << trs(", Root cluster: ") << root_cluster
           << trs(", FSInfo: ") << fsinfo_sector
           << trs(", Backup boot: ") << backup_boot_sector;
 
    return {ResultKind::FilesystemVolume,
            offset,
            volume_size,
            "FAT32 volume",
            "FAT32 probe",
            detail.str(),
            0.93};
}
 
ScanResult exfat_probe(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 512> sector{};
    if (!read_sector(reader, offset, sector) || !is_exfat(sector)) {
        return {};
    }
 
    const uint64_t partition_offset = le64(sector.data() + 64);
    const uint64_t volume_length = le64(sector.data() + 72);
    const uint32_t fat_offset = le32(sector.data() + 80);
    const uint32_t fat_length = le32(sector.data() + 84);
    const uint32_t cluster_heap_offset = le32(sector.data() + 88);
    const uint32_t cluster_count = le32(sector.data() + 92);
    const uint32_t root_dir_cluster = le32(sector.data() + 96);
    const uint8_t bytes_per_sector_shift = sector[108];
    const uint8_t sectors_per_cluster_shift = sector[109];
 
    const uint64_t bytes_per_sector = 1ull << bytes_per_sector_shift;
    const uint64_t sectors_per_cluster = 1ull << sectors_per_cluster_shift;
    const uint64_t volume_size = volume_length * bytes_per_sector;
 
    if (volume_length == 0 || bytes_per_sector < 512 || sectors_per_cluster == 0) {
        return {};
    }
 
    std::ostringstream detail;
    detail << trs("Partition offset: ") << partition_offset
           << ", " << trs("Bytes/sector") << ": " << bytes_per_sector
           << ", " << trs("Sectors/cluster") << ": " << sectors_per_cluster
           << trs(", FAT offset: ") << fat_offset
           << trs(", FAT length: ") << fat_length
           << trs(", Cluster heap: ") << cluster_heap_offset
           << trs(", Cluster count: ") << cluster_count
           << trs(", Root dir cluster: ") << root_dir_cluster;
 
    return {ResultKind::FilesystemVolume,
            offset,
            volume_size,
            "exFAT volume",
            "exFAT probe",
            detail.str(),
            0.94};
}
 
ScanResult ext4_probe(DiskReader& reader, uint64_t offset) {
    if (!ext4_has_magic(reader, offset)) {
        return {};
    }
 
    std::array<unsigned char, 1024> super{};
    if (!reader.read_at(offset + 1024, super.data(), super.size())) {
        return {};
    }
 
    const uint32_t inodes_count = le32(super.data() + 0x00);
    const uint32_t blocks_count_lo = le32(super.data() + 0x04);
    const uint32_t log_block_size = le32(super.data() + 0x18);
    const uint32_t blocks_per_group = le32(super.data() + 0x20);
    const uint32_t inodes_per_group = le32(super.data() + 0x28);
    const uint16_t magic = le16(super.data() + 0x38);
    const uint32_t feature_compat = le32(super.data() + 0x5C);
    const uint32_t feature_incompat = le32(super.data() + 0x60);
    const uint32_t feature_ro_compat = le32(super.data() + 0x64);
    const uint16_t inode_size = le16(super.data() + 0x58);
 
    if (magic != 0xEF53) {
        return {};
    }
 
    const uint64_t block_size = 1024ull << log_block_size;
    const uint64_t volume_size = static_cast<uint64_t>(blocks_count_lo) * block_size;
 
    std::ostringstream detail;
    detail << trs("Inodes: ") << inodes_count
           << trs(", Blocks: ") << blocks_count_lo
           << trs(", Block size: ") << block_size
           << trs(", Blocks/group: ") << blocks_per_group
           << trs(", Inodes/group: ") << inodes_per_group
           << trs(", Inode size: ") << inode_size
           << ", Compat: 0x" << std::hex << feature_compat
           << ", Incompat: 0x" << feature_incompat
           << ", RO compat: 0x" << feature_ro_compat;
 
    return {ResultKind::FilesystemVolume,
            offset,
            volume_size,
            "ext4 volume",
            "ext4 probe",
            detail.str(),
            0.91};
}
 
ScanResult btrfs_probe(DiskReader& reader, uint64_t offset) {
    if (!btrfs_has_magic(reader, offset)) {
        return {};
    }
 
    std::array<unsigned char, 0x2000> sb{};
    if (!reader.read_at(offset + 0x10000, sb.data(), sb.size())) {
        return {};
    }
 
    const uint64_t bytenr = le64(sb.data() + 0x00);
    const uint64_t flags = le64(sb.data() + 0x30);
    const uint64_t generation = le64(sb.data() + 0x40);
    const uint64_t root = le64(sb.data() + 0x50);
    const uint64_t chunk_root = le64(sb.data() + 0x58);
    const uint64_t total_bytes = le64(sb.data() + 0x70);
    const uint64_t bytes_used = le64(sb.data() + 0x78);
    const uint32_t sectorsize = le32(sb.data() + 0x90);
    const uint32_t nodesize = le32(sb.data() + 0x94);
    const uint32_t leafsize = le32(sb.data() + 0x98);
    const uint32_t stripesize = le32(sb.data() + 0x9C);
    const uint32_t num_devices = le32(sb.data() + 0xA0);
 
    if (sectorsize == 0 || nodesize == 0 || total_bytes == 0) {
        return {};
    }
 
    std::ostringstream detail;
    detail << trs("Bytenr: ") << bytenr
           << trs(", Generation: ") << generation
           << ", Flags: 0x" << std::hex << flags << std::dec
           << ", Root: " << root
           << ", Chunk root: " << chunk_root
           << ", Total bytes: " << total_bytes
           << ", Used bytes: " << bytes_used
           << ", Sector size: " << sectorsize
           << ", Node size: " << nodesize
           << ", Leaf size: " << leafsize
           << ", Stripe size: " << stripesize
           << ", Devices: " << num_devices;
 
    return {ResultKind::FilesystemVolume,
            offset,
            total_bytes,
            "Btrfs volume",
            "Btrfs probe",
            detail.str(),
            0.92};
}
 
// XFS probe: delegates the heavy lifting to xfs::parse_superblock(), which
// validates magic, geometry, version (4/5), and feature consistency. This
// produces a high-quality identification that won't match on garbage.
ScanResult xfs_probe(DiskReader& reader, uint64_t offset) {
    // The XFS superblock is at byte 0 of the volume. We always read 512 bytes
    // because that's what parse_superblock expects (one sector worth).
    std::array<unsigned char, 512> sector{};
    if (!reader.read_at(offset, sector.data(), sector.size())) {
        return {};
    }
    xfs::Superblock sb;
    if (!xfs::parse_superblock(sector.data(), sb)) {
        return {};
    }
 
    std::ostringstream detail;
    detail << trs("Format version") << ": " << sb.format_version()
           << ", " << trs("Block size") << ": " << sb.blocksize
           << ", " << trs("Sector size") << ": " << sb.sectsize
           << ", " << trs("Inode size") << ": " << sb.inodesize
           << ", " << trs("Inodes/block") << ": " << sb.inopblock
           << ", " << trs("Allocation groups") << ": " << sb.agcount
           << ", " << trs("Blocks/AG") << ": " << sb.agblocks
           << ", " << trs("Total blocks") << ": " << sb.dblocks;
    if (sb.is_v5()) {
        detail << ", " << trs("CRC: V5");
        if (sb.has_ftype()) detail << ", FTYPE";
        if (sb.features_ro_compat & xfs::XFS_SB_FEAT_RO_COMPAT_FINOBT) {
            detail << ", FINOBT";
        }
        if (sb.features_ro_compat & xfs::XFS_SB_FEAT_RO_COMPAT_REFLINK) {
            detail << ", REFLINK";
        }
    }
    const std::string lbl = sb.label();
    if (!lbl.empty()) {
        detail << ", " << trs("Label") << ": " << lbl;
    }
 
    // Confidence: V5 has CRC and stricter validation, so very high.
    // V4 is also reliable when it parses, but slightly lower.
    const double confidence = sb.is_v5() ? 0.96 : 0.92;
 
    return {ResultKind::FilesystemVolume,
            offset,
            sb.volume_size_bytes(),
            "XFS volume",
            "XFS probe",
            detail.str(),
            confidence};
}
 
// HFS+ / HFSX probe. The volume header lives at +1024 from the volume
// start. Delegates field validation to hfs::parse_volume_header.
ScanResult hfs_probe(DiskReader& reader, uint64_t offset) {
    std::array<unsigned char, 512> sector{};
    if (!reader.read_at(offset + hfs::HFSPLUS_VOLUME_HEADER_OFFSET,
                         sector.data(), sector.size())) {
        return {};
    }
    hfs::VolumeHeader vh;
    if (!hfs::parse_volume_header(sector.data(), vh)) {
        return {};
    }
 
    std::ostringstream detail;
    detail << trs("Variant") << ": " << vh.variant_name()
           << ", " << trs("Version") << ": " << vh.version
           << ", " << trs("Block size") << ": " << vh.block_size
           << ", " << trs("Total blocks") << ": " << vh.total_blocks
           << ", " << trs("Free blocks") << ": " << vh.free_blocks
           << ", " << trs("Files") << ": " << vh.file_count
           << ", " << trs("Folders") << ": " << vh.folder_count;
    if (vh.is_journaled()) {
        detail << ", " << trs("Journaled");
    }
 
    // Confidence: high. The volume header is a strong magic + structured
    // sanity (block_size power of 2, fork extents in range, etc.).
    const double confidence = vh.is_hfsx() ? 0.96 : 0.95;
 
    return {ResultKind::FilesystemVolume,
            offset,
            vh.volume_size_bytes(),
            vh.is_hfsx() ? "HFSX volume" : "HFS+ volume",
            "HFS+ probe",
            detail.str(),
            confidence};
}
}
 
std::vector<ScanResult> FilesystemProbes::analyze(DiskReader& reader,
                                                  const std::vector<ScanResult>& seed_results,
                                                  std::vector<std::string>& logs) {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen_offsets;
    logs.push_back(trs("Filesystem probes: analysis started."));
 
    for (const auto& seed : seed_results) {
        const bool interesting_seed =
            seed.kind == ResultKind::Partition ||
            seed.kind == ResultKind::LostPartitionCandidate ||
            seed.kind == ResultKind::FilesystemCandidate ||
            seed.kind == ResultKind::NtfsVolume;
        if (!interesting_seed || seen_offsets.count(seed.offset_bytes) != 0) {
            continue;
        }
        seen_offsets.insert(seed.offset_bytes);
 
        if (auto r = fat32_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = exfat_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = ext4_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = btrfs_probe(reader, seed.offset_bytes); !r.type.empty()) out.push_back(r);
        if (auto r = xfs_probe(reader, seed.offset_bytes);   !r.type.empty()) out.push_back(r);
        if (auto r = hfs_probe(reader, seed.offset_bytes);   !r.type.empty()) out.push_back(r);
    }
 
    logs.push_back(trs("Filesystem probes: analysis completed."));
    return out;
}