LostPartitionFinder Class Reference

#include <lost_partition_finder.hpp>

Static Public Member Functions
static std::vector< ScanResult >	find (DiskReader &reader, const std::vector< ScanResult > &known_results, std::vector< std::string > &logs)

Detailed Description

Definition at line 8 of file lost_partition_finder.hpp.

Member Function Documentation

find()

std::vector< ScanResult > LostPartitionFinder::find ( DiskReader & reader, const std::vector< ScanResult > & known_results, std::vector< std::string > & logs )

static

Definition at line 159 of file lost_partition_finder.cpp.

                                                                               {
    std::vector<ScanResult> out;
    std::vector<Range> claimed_ranges;
    claimed_ranges.reserve(known_results.size());
 
    for (const auto& r : known_results) {
        if (r.kind == ResultKind::Partition && r.size_bytes > 0) {
            claimed_ranges.push_back({r.offset_bytes, r.offset_bytes + r.size_bytes});
        }
    }
 
    const uint64_t disk_size = reader.size();
    const uint64_t max_scan = std::min<uint64_t>(disk_size, std::min<uint64_t>(DEFAULT_MAX_SCAN, HARD_MAX_SCAN));
 
    logs.push_back(trs("Lost partition finder: deep scan started."));
    logs.push_back(trs("Lost partition scan stride:") + std::string(" ") +
                   std::to_string(SCAN_STRIDE / MiB) + " MiB");
    logs.push_back(trs("Lost partition scan range:") + std::string(" ") +
                   std::to_string(max_scan / GiB) + " GiB");
 
    // Bug #10/#13 fix: scan with fixed 1 MiB stride from offset SCAN_STRIDE
    // up to max_scan. Partitions are 1 MiB aligned on every modern OS, and the
    // first MiB is reserved for MBR/GPT, never a partition boundary.
    for (uint64_t offset = SCAN_STRIDE; offset + 4096 < max_scan; offset += SCAN_STRIDE) {
        std::array<unsigned char, 512> sector{};
        if (!reader.read_at(offset, sector.data(), sector.size())) {
            continue;
        }
 
        if (is_ntfs(sector)) {
            const uint64_t size_bytes = ntfs_size_bytes(sector);
            const uint64_t end = size_bytes > 0 ? offset + size_bytes : offset + MiB;
            if (!overlaps(claimed_ranges, offset, end)) {
                out.push_back({ResultKind::LostPartitionCandidate,
                               offset,
                               size_bytes,
                               "Lost NTFS partition candidate",
                               trs("Lost partition finder"),
                               trs("Unallocated NTFS boot sector candidate"),
                               0.88});
                claimed_ranges.push_back({offset, end});
            }
        } else if (is_fat32(sector)) {
            const uint64_t size_bytes = fat32_size_bytes(sector);
            const uint64_t end = size_bytes > 0 ? offset + size_bytes : offset + MiB;
            if (!overlaps(claimed_ranges, offset, end)) {
                out.push_back({ResultKind::LostPartitionCandidate,
                               offset,
                               size_bytes,
                               "Lost FAT32 partition candidate",
                               trs("Lost partition finder"),
                               trs("Unallocated FAT32 boot sector candidate"),
                               0.84});
                claimed_ranges.push_back({offset, end});
            }
        } else if (is_exfat(sector)) {
            const uint64_t size_bytes = exfat_size_bytes(sector);
            const uint64_t end = size_bytes > 0 ? offset + size_bytes : offset + MiB;
            if (!overlaps(claimed_ranges, offset, end)) {
                out.push_back({ResultKind::LostPartitionCandidate,
                               offset,
                               size_bytes,
                               "Lost exFAT partition candidate",
                               trs("Lost partition finder"),
                               trs("Unallocated exFAT boot sector candidate"),
                               0.86});
                claimed_ranges.push_back({offset, end});
            }
        } else if (looks_ext4(reader, offset)) {
            // Bug #20 fix: compute real ext4 volume size instead of leaving 0
            const uint64_t size_bytes = ext4_size_bytes(reader, offset);
            const uint64_t end = size_bytes > 0 ? offset + size_bytes : offset + MiB;
            if (!overlaps(claimed_ranges, offset, end)) {
                out.push_back({ResultKind::LostPartitionCandidate,
                               offset,
                               size_bytes,
                               "Lost ext4 partition candidate",
                               trs("Lost partition finder"),
                               trs("Unallocated ext4 superblock candidate"),
                               0.80});
                claimed_ranges.push_back({offset, end});
            }
        } else if (looks_btrfs(reader, offset)) {
            // Bug #20 fix: compute real btrfs volume size instead of leaving 0
            const uint64_t size_bytes = btrfs_size_bytes(reader, offset);
            const uint64_t end = size_bytes > 0 ? offset + size_bytes : offset + MiB;
            if (!overlaps(claimed_ranges, offset, end)) {
                out.push_back({ResultKind::LostPartitionCandidate,
                               offset,
                               size_bytes,
                               trs("Lost Btrfs partition candidate"),
                               trs("Lost partition finder"),
                               trs("Unallocated Btrfs superblock candidate"),
                               0.81});
                claimed_ranges.push_back({offset, end});
            }
        } else if (looks_xfs(reader, offset)) {
            // Use parse_superblock to also validate geometry (rejects false
            // positives where 'XFSB' appears as random bytes).
            const uint64_t size_bytes = xfs_size_bytes(reader, offset);
            if (size_bytes > 0) {
                const uint64_t end = offset + size_bytes;
                if (!overlaps(claimed_ranges, offset, end)) {
                    out.push_back({ResultKind::LostPartitionCandidate,
                                   offset,
                                   size_bytes,
                                   "Lost XFS partition candidate",
                                   trs("Lost partition finder"),
                                   trs("Unallocated XFS superblock candidate"),
                                   0.86});
                    claimed_ranges.push_back({offset, end});
                }
            }
        } else if (looks_hfs(reader, offset)) {
            // HFS+/HFSX: validate geometry through parse_volume_header.
            const uint64_t size_bytes = hfs_size_bytes(reader, offset);
            if (size_bytes > 0) {
                const uint64_t end = offset + size_bytes;
                if (!overlaps(claimed_ranges, offset, end)) {
                    out.push_back({ResultKind::LostPartitionCandidate,
                                   offset,
                                   size_bytes,
                                   "Lost HFS+ partition candidate",
                                   trs("Lost partition finder"),
                                   trs("Unallocated HFS+/HFSX volume header candidate"),
                                   0.85});
                    claimed_ranges.push_back({offset, end});
                }
            }
        }
    }
 
    if (max_scan < disk_size) {
        logs.push_back(trs("Lost partition finder: scan limited to first ") +
                       std::to_string(max_scan / GiB) + " GiB " +
                       trs("(disk is larger; remaining area not scanned)."));
    }
    logs.push_back(trs("Lost partition finder: deep scan completed."));
    return out;
}

References LostPartitionCandidate, Partition, DiskReader::read_at(), DiskReader::size(), and trs().

Referenced by ScannerEngine::run_scan().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-recovery-data/src/lost_partition_finder.hpp
• BastionGuard/thirdparty/bastionguard-recovery-data/src/lost_partition_finder.cpp