ntfs_probe.cpp

Go to the documentation of this file.

#include "ntfs_probe.hpp"
#include "i18n.hpp"
 
#include <array>
#include <cmath>
#include <set>
#include <sstream>
#include <string>
 
namespace {
constexpr uint64_t SECTOR_SIZE = 512ull;
 
uint16_t le16(const unsigned char* p) {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}
 
uint64_t le64(const unsigned char* p) {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}
 
bool is_ntfs_boot_sector(const std::array<unsigned char, 512>& sector) {
    return std::string(reinterpret_cast<const char*>(sector.data() + 3), 8) == "NTFS    " &&
           sector[510] == 0x55 && sector[511] == 0xAA;
}
 
uint64_t record_size_from_descriptor(int8_t descriptor, uint64_t cluster_size) {
    if (descriptor > 0) {
        return static_cast<uint64_t>(descriptor) * cluster_size;
    }
    // Bug #3/#4 fix: descriptor==0 means invalid; descriptor < 0 is shift exponent.
    // Range valid for NTFS: 1..30 (records from 2 bytes to 1 GiB).
    if (descriptor == 0) return 0;
    const int exponent = -static_cast<int>(descriptor);
    if (exponent >= 1 && exponent <= 30) {
        return 1ull << exponent;
    }
    return 0; // invalid: caller must reject volume
}
}
 
std::vector<ScanResult> NtfsProbe::analyze(DiskReader& reader,
                                           const std::vector<ScanResult>& seed_results,
                                           std::vector<std::string>& logs) {
    std::vector<ScanResult> out;
    std::set<uint64_t> seen_offsets;
 
    logs.push_back(trs("NTFS probe: analysis started."));
 
    for (const auto& seed : seed_results) {
        const bool interesting_seed =
            seed.kind == ResultKind::Partition ||
            seed.kind == ResultKind::LostPartitionCandidate ||
            seed.kind == ResultKind::FilesystemCandidate;
        if (!interesting_seed || seen_offsets.count(seed.offset_bytes) != 0) {
            continue;
        }
        seen_offsets.insert(seed.offset_bytes);
 
        std::array<unsigned char, 512> sector{};
        if (!reader.read_at(seed.offset_bytes, sector.data(), sector.size()) || !is_ntfs_boot_sector(sector)) {
            continue;
        }
 
        const uint16_t bytes_per_sector = le16(sector.data() + 11);
        const uint8_t sectors_per_cluster = sector[13];
        const uint64_t total_sectors = le64(sector.data() + 40);
        const uint64_t mft_lcn = le64(sector.data() + 48);
        const uint64_t mftmirr_lcn = le64(sector.data() + 56);
        const int8_t record_descriptor = static_cast<int8_t>(sector[64]);
 
        if (bytes_per_sector == 0 || sectors_per_cluster == 0 || total_sectors == 0) {
            continue;
        }
 
        const uint64_t cluster_size = static_cast<uint64_t>(bytes_per_sector) * sectors_per_cluster;
        const uint64_t volume_size = total_sectors * bytes_per_sector;
        const uint64_t record_size = record_size_from_descriptor(record_descriptor, cluster_size);
        // Bug #3/#4 fix: record_size==0 means invalid, skip volume
        if (record_size == 0) {
            continue;
        }
        const uint64_t mft_offset = seed.offset_bytes + (mft_lcn * cluster_size);
        const uint64_t mftmirr_offset = seed.offset_bytes + (mftmirr_lcn * cluster_size);
 
        std::array<char, 4> mft_sig{};
        bool mft_ok = reader.read_at(mft_offset, mft_sig.data(), mft_sig.size()) &&
                      std::string(mft_sig.data(), mft_sig.size()) == "FILE";
 
        std::array<char, 4> mftmirr_sig{};
        bool mftmirr_ok = reader.read_at(mftmirr_offset, mftmirr_sig.data(), mftmirr_sig.size()) &&
                          std::string(mftmirr_sig.data(), mftmirr_sig.size()) == "FILE";
 
        std::ostringstream detail;
        detail << trs("Bytes/sector") << ": " << bytes_per_sector
               << ", " << trs("Sectors/cluster") << ": " << static_cast<unsigned>(sectors_per_cluster)
               << ", " << trs("MFT record size") << ": " << record_size
               << ", " << trs("MFT") << ": " << (mft_ok ? "OK" : "missing")
               << ", " << trs("MFTMirr") << ": " << (mftmirr_ok ? "OK" : "missing");
 
        double confidence = 0.85;
        if (mft_ok) confidence += 0.10;
        if (mftmirr_ok) confidence += 0.03;
        if (confidence > 0.99) confidence = 0.99;
 
        out.push_back({ResultKind::NtfsVolume,
                       seed.offset_bytes,
                       volume_size,
                       "NTFS volume",
                       "NTFS probe",
                       detail.str(),
                       confidence});
 
        if (mft_ok) {
            out.push_back({ResultKind::NtfsMetadata,
                           mft_offset,
                           record_size,
                           "NTFS $MFT",
                           "NTFS probe",
                           trs("Primary MFT record signature validated"),
                           0.96});
        }
        if (mftmirr_ok) {
            out.push_back({ResultKind::NtfsMetadata,
                           mftmirr_offset,
                           record_size,
                           "NTFS $MFTMirr",
                           "NTFS probe",
                           trs("MFT mirror record signature validated"),
                           0.93});
        }
    }
 
    logs.push_back(trs("NTFS probe: analysis completed."));
    return out;
}