anonymous_namespace{ntfs_recovery.cpp} Namespace Reference

Classes
struct	DiskSpan
struct	NtfsDataRun
struct	NtfsVolumeInfo
struct	NtfsAttributeListEntry
struct	NtfsDataStream
struct	NtfsFileRecordInfo

Functions
uint16_t	le16 (const unsigned char *p)
uint32_t	le32 (const unsigned char *p)
uint64_t	le64 (const unsigned char *p)
std::string	sanitize_component (const std::string &in)
std::string	decode_utf16le_ascii (const unsigned char *data, size_t byte_count)
bool	lznt1_decompress (const std::vector< unsigned char > &src, size_t expected_size, std::vector< unsigned char > &dst)

Function Documentation

decode_utf16le_ascii()

std::string anonymous_namespace{ntfs_recovery.cpp}::decode_utf16le_ascii ( const unsigned char * data, size_t byte_count )

inline

Definition at line 52 of file ntfs_recovery.cpp.

                                                                                    {
    // Function name kept for backwards compatibility, but it now produces
    // proper UTF-8 output (the previous version replaced every non-ASCII
    // character with '_').
    return text_utils::utf16le_to_utf8(data, byte_count);
}

References decode_utf16le_ascii(), and text_utils::utf16le_to_utf8().

Referenced by decode_utf16le_ascii(), NtfsRecoveryImpl::export_reparse_sidecar(), NtfsRecoveryImpl::parse_attribute_list_entries(), NtfsRecoveryImpl::parse_index_entries(), and NtfsRecoveryImpl::process_attributes().

le16()

uint16_t anonymous_namespace{ntfs_recovery.cpp}::le16

(

const unsigned char *

p

)

Definition at line 24 of file ntfs_recovery.cpp.

                                      {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}

References le16().

Referenced by NtfsRecoveryImpl::apply_fixup(), NtfsRecoveryImpl::export_reparse_sidecar(), le16(), lznt1_decompress(), NtfsRecoveryImpl::parse_attribute_list_entries(), NtfsRecoveryImpl::parse_index_entries(), NtfsRecoveryImpl::process_attributes(), NtfsRecoveryImpl::read_boot_sector(), and NtfsRecoveryImpl::scan_logfile().

le32()

uint32_t anonymous_namespace{ntfs_recovery.cpp}::le32

(

const unsigned char *

p

)

Definition at line 28 of file ntfs_recovery.cpp.

                                      {
    return static_cast<uint32_t>(p[0]) |
           (static_cast<uint32_t>(p[1]) << 8) |
           (static_cast<uint32_t>(p[2]) << 16) |
           (static_cast<uint32_t>(p[3]) << 24);
}

References le32().

Referenced by NtfsRecoveryImpl::export_reparse_sidecar(), le32(), NtfsRecoveryImpl::parse_attribute_list_entries(), NtfsRecoveryImpl::parse_index_entries(), NtfsRecoveryImpl::process_attributes(), NtfsRecoveryImpl::scan_logfile(), and NtfsRecoveryImpl::walk_i30().

le64()

uint64_t anonymous_namespace{ntfs_recovery.cpp}::le64

(

const unsigned char *

p

)

Definition at line 35 of file ntfs_recovery.cpp.

                                      {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}

References le64().

Referenced by le64(), NtfsRecoveryImpl::parse_attribute_list_entries(), NtfsRecoveryImpl::parse_index_entries(), NtfsRecoveryImpl::process_attributes(), and NtfsRecoveryImpl::read_boot_sector().

lznt1_decompress()

bool anonymous_namespace{ntfs_recovery.cpp}::lznt1_decompress	(	const std::vector< unsigned char > &	src,
		size_t	expected_size,
		std::vector< unsigned char > &	dst )

Definition at line 144 of file ntfs_recovery.cpp.

                                                     {
    dst.clear();
    size_t pos = 0;
    while (pos + 2 <= src.size() && dst.size() < expected_size) {
        const uint16_t header = le16(src.data() + pos);
        pos += 2;
        const size_t chunk_size = (header & 0x0FFF) + 1;
        const bool is_compressed = (header & 0x8000) != 0;
        if (pos + chunk_size > src.size()) return false;
 
        if (!is_compressed) {
            const size_t take = std::min(chunk_size, expected_size - dst.size());
            dst.insert(dst.end(), src.begin() + static_cast<long>(pos), src.begin() + static_cast<long>(pos + take));
            pos += chunk_size;
            continue;
        }
 
        const size_t chunk_end = pos + chunk_size;
        std::vector<unsigned char> chunk_out;
        chunk_out.reserve(4096);
        while (pos < chunk_end && chunk_out.size() < 4096) {
            const uint8_t flags = src[pos++];
            for (int bit = 0; bit < 8 && pos < chunk_end; ++bit) {
                if ((flags & (1u << bit)) == 0) {
                    chunk_out.push_back(src[pos++]);
                } else {
                    if (pos + 1 >= chunk_end) return false;
                    const uint16_t token = le16(src.data() + pos);
                    pos += 2;
 
                    int length_bits = 4;
                    while ((1u << (length_bits + 4)) < chunk_out.size() && length_bits < 12) ++length_bits;
                    const size_t length_mask = (1u << length_bits) - 1u;
                    const size_t offset = (token >> length_bits) + 1u;
                    const size_t length = (token & length_mask) + 3u;
                    if (offset == 0 || offset > chunk_out.size()) return false;
                    for (size_t i = 0; i < length && chunk_out.size() < 4096; ++i) {
                        chunk_out.push_back(chunk_out[chunk_out.size() - offset]);
                    }
                }
                if (chunk_out.size() >= 4096) break;
            }
        }
        const size_t take = std::min(chunk_out.size(), expected_size - dst.size());
        dst.insert(dst.end(), chunk_out.begin(), chunk_out.begin() + static_cast<long>(take));
        if (chunk_out.size() < 4096 && dst.size() < expected_size) {
            dst.resize(std::min(expected_size, dst.size() + (4096 - chunk_out.size())), 0);
        }
    }
    if (dst.size() < expected_size) dst.resize(expected_size, 0);
    return true;
}

References le16(), and lznt1_decompress().

Referenced by NtfsRecoveryImpl::decode_compressed_stream(), and lznt1_decompress().

sanitize_component()

std::string anonymous_namespace{ntfs_recovery.cpp}::sanitize_component ( const std::string & in )

inline

Definition at line 48 of file ntfs_recovery.cpp.

                                                         {
    return text_utils::sanitize_component(in);
}

References sanitize_component(), and text_utils::sanitize_component().

Referenced by NtfsRecoveryImpl::build_relative_path(), NtfsRecoveryImpl::output_path_for_stream(), NtfsRecoveryImpl::recover(), sanitize_component(), and NtfsRecoveryImpl::scan_logfile().