FilesystemRecovery Class Reference

#include <filesystem_recovery.hpp>

Static Public Member Functions
static bool	recover_supported_filesystems (DiskReader &reader, const ScanReport &report, const std::string &output_dir, std::vector< RecoveredFileRecord > &recovered, std::vector< std::string > &logs, std::string &error)

Detailed Description

Definition at line 18 of file filesystem_recovery.hpp.

Member Function Documentation

recover_supported_filesystems()

bool FilesystemRecovery::recover_supported_filesystems ( DiskReader & reader, const ScanReport & report, const std::string & output_dir, std::vector< RecoveredFileRecord > & recovered, std::vector< std::string > & logs, std::string & error )

static

Definition at line 831 of file filesystem_recovery.cpp.

                                                                         {
    std::set<uint64_t> ntfs_offsets;
    std::set<uint64_t> fat32_offsets;
    std::set<uint64_t> exfat_offsets;
    std::set<uint64_t> ext4_offsets;
    std::set<uint64_t> btrfs_offsets;
    std::set<uint64_t> xfs_offsets;
    std::set<uint64_t> hfs_offsets;
    for (const auto& r : report.results) {
        if (r.type == "NTFS volume" || r.type == "Lost NTFS partition candidate" || r.type == "NTFS candidate") ntfs_offsets.insert(r.offset_bytes);
        if (r.type == "FAT32 volume" || r.type == "Lost FAT32 partition candidate") fat32_offsets.insert(r.offset_bytes);
        if (r.type == "exFAT volume" || r.type == "Lost exFAT partition candidate") exfat_offsets.insert(r.offset_bytes);
        if (r.type == "ext4 volume" || r.type == "Lost ext4 partition candidate" || r.type == "ext4 candidate") ext4_offsets.insert(r.offset_bytes);
        if (r.type == "Btrfs volume" || r.type == "Lost Btrfs partition candidate" || r.type == "Btrfs candidate") btrfs_offsets.insert(r.offset_bytes);
        if (r.type == "XFS volume"   || r.type == "Lost XFS partition candidate")   xfs_offsets.insert(r.offset_bytes);
        if (r.type == "HFS+ volume"  || r.type == "HFSX volume" || r.type == "Lost HFS+ partition candidate") hfs_offsets.insert(r.offset_bytes);
    }
 
    try {
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "ntfs");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "fat32");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "exfat");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "ext4");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "btrfs");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "xfs");
        fs::create_directories(fs::path(output_dir) / "filesystem_recovered" / "hfs");
    } catch (const std::exception& ex) {
        error = ex.what();
        return false;
    }
 
 
    for (uint64_t offset : ntfs_offsets) {
        NtfsRecovery ntfs(reader);
        std::string local_error;
        if (!ntfs.recover(offset, output_dir, recovered, logs, local_error)) {
            logs.push_back(trs("NTFS recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : fat32_offsets) {
        Fat32Recovery fat32(reader);
        const fs::path out_root = fs::path(output_dir) / "filesystem_recovered" / "fat32" / ("offset_" + std::to_string(offset));
        std::string local_error;
        if (!fat32.recover(offset, out_root, recovered, logs, local_error)) {
            logs.push_back(trs("FAT32 recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : exfat_offsets) {
        ExfatRecovery exfat(reader);
        const fs::path out_root = fs::path(output_dir) / "filesystem_recovered" / "exfat" / ("offset_" + std::to_string(offset));
        std::string local_error;
        if (!exfat.recover(offset, out_root, recovered, logs, local_error)) {
            logs.push_back(trs("exFAT recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : ext4_offsets) {
        Ext4Recovery ext4(reader);
        std::string local_error;
        if (!ext4.recover(offset, output_dir, recovered, logs, local_error)) {
            logs.push_back(trs("ext4 recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : btrfs_offsets) {
        BtrfsRecovery btrfs(reader);
        std::string local_error;
        if (!btrfs.recover(offset, output_dir, recovered, logs, local_error)) {
            logs.push_back(trs("Btrfs recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : xfs_offsets) {
        XfsRecovery xfs(reader);
        std::string local_error;
        if (!xfs.recover(offset, output_dir, recovered, logs, local_error)) {
            logs.push_back(trs("XFS recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    for (uint64_t offset : hfs_offsets) {
        HfsRecovery hfs(reader);
        std::string local_error;
        if (!hfs.recover(offset, output_dir, recovered, logs, local_error)) {
            logs.push_back(trs("HFS+ recovery skipped or failed at offset") + std::string(" ") + std::to_string(offset) + ": " + local_error);
        }
    }
 
    // ---- Optional file carving pass ----
    //
    // Carving is opt-in via environment variable BASTIONGUARD_CARVING=1.
    // It runs AFTER all filesystem-specific recovery has been tried,
    // so it complements (not replaces) the per-FS results. The carving
    // pass is filesystem-agnostic: it recognises file content directly
    // by magic-byte signatures and is the right tool for cases where
    // filesystem metadata (MFT/inode table/catalog) is destroyed but
    // content blocks remain intact. It also recovers files with any
    // FS where deletion zeros the metadata but not the data.
    //
    // We make it opt-in (rather than always-on) because:
    //   * On a healthy disk, every file is also recovered by FS-aware
    //     recovery -- carving would produce duplicates.
    //   * Carving has a non-zero false-positive rate.
    //   * Carving is slow on big disks (full sequential scan).
    {
        const char* env = std::getenv("BASTIONGUARD_CARVING");
        if (env != nullptr && env[0] == '1') {
            carving::CarvingOptions opts;
            // Defaults are reasonable (16 GiB scan limit, 500 MiB per
            // file). The user can override these by editing the source
            // for now; a CLI flag is a future addition.
            std::string carve_err;
            const size_t before = recovered.size();
            carving::run_carving(reader, output_dir, opts, recovered,
                                  logs, carve_err);
            const size_t carved = recovered.size() - before;
            if (!carve_err.empty()) {
                logs.push_back(trs("Carving error: ") + carve_err);
            }
            logs.push_back(trs("Carving pass added ") +
                           std::to_string(carved) + trs(" file(s)"));
        }
    }
 
    return true;
}

References BtrfsRecovery::recover(), Ext4Recovery::recover(), NtfsRecovery::recover(), ScanReport::results, carving::run_carving(), and trs().

Referenced by RecoveryExporter::export_results_and_carve().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/filesystem_recovery.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/filesystem_recovery.cpp