filesystem_probes

1. Overview

The filesystem_probes.cpp file detects filesystem signatures and creates normalized scan results for supported formats.

This is an implementation file. It contains executable logic for the subsystem, including parsing, I/O, validation, recovery flow, or graphical behavior declared by the corresponding interface.

Its paired source or interface file is filesystem_probes.hpp.

Primary responsibilities:

  • Probe candidate offsets
  • Recognize filesystem-specific magic values
  • Estimate volume geometry
  • Return confidence-ranked results

2. File Identity and Scope

  • Source path: src/filesystem_probes.cpp
  • Language: C++
  • File role: implementation file
  • Physical lines: 361
  • Non-empty lines: 315
  • SHA-256: 6294af83e87da11c028317a6c52a427aa3ed7c766ace1e247c22a48c02b0c73c

The declarations in this file use the global namespace.

3. Dependencies

3.1 Project Headers

  • filesystem_probes.hpp
  • i18n.hpp
  • xfs_format.hpp
  • hfs_format.hpp

3.2 Standard and External Headers

  • array
  • set
  • sstream
  • string
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

No class, structure, or enumeration definition is declared directly in this file.

5. Constants and Configuration Values

  • constexpr uint64_t SECTOR_SIZE=512ull

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • xfs_format.hpp
  • hfs_format.hpp
  • ext4 volume
  • ext4 probe
  • Btrfs volume
  • Btrfs probe
  • XFS volume
  • XFS probe
  • HFSX volume
  • HFS+ volume
  • HFS+ probe

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • uint16_t le16(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint32_t le32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint64_t le64(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • bool read_sector(DiskReader&reader,uint64_t offset,std::array<unsigned char,512>&sector) – Reads or derives the requested information and returns or stores the decoded result.
  • bool is_fat32(const std::array<unsigned char,512>&sector) – Evaluates the stated condition and returns the corresponding Boolean result.
  • bool is_exfat(const std::array<unsigned char,512>&sector) – Evaluates the stated condition and returns the corresponding Boolean result.
  • bool ext4_has_magic(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • bool btrfs_has_magic(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult fat32_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult exfat_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult ext4_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult btrfs_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult xfs_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • ScanResult hfs_probe(DiskReader&reader,uint64_t offset) – Implements the operation identified by this API and updates or returns the associated state.
  • std::vector<ScanResult> FilesystemProbes::analyze(DiskReader&reader,const std::vector<ScanResult>&seed_results,std::vector<std::string>&logs) – Implements the operation identified by this API and updates or returns the associated state.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Probe candidate offsets.
  2. Recognize filesystem-specific magic values.
  3. Estimate volume geometry.
  4. Return confidence-ranked results.
  5. Expose or execute the detected APIs: le16, le32, le64, read_sector, is_fat32, is_exfat, ext4_has_magic, btrfs_has_magic, fat32_probe, exfat_probe, ext4_probe, btrfs_probe, xfs_probe, hfs_probe, analyze.
  6. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.

10. Runtime, Concurrency, and Resource Management

  • Deterministic behavior: callers depend on explicit return values and stable data structures to distinguish successful recovery from partial or invalid results.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.

12. Implementation Considerations

  • The implementation should remain aligned with declarations in the paired header and preserve documented return-value semantics.
  • Binary decoding uses low-level memory operations or casts; alignment, endianness and packed-structure assumptions require careful review.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.

13. Integration with the Recovery Pipeline

  • The file belongs to the source-discovery, parsing or support layer.
  • Its results feed scanner, recovery or reporting modules through shared models.
  • The API should remain deterministic so higher layers can combine results safely.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: