filesystem_recovery

1. Overview

The filesystem_recovery.cpp file selects and coordinates the appropriate filesystem-specific recovery implementation.

This is an implementation file. It contains executable logic for the subsystem, including parsing, I/O, validation, recovery flow, or graphical behavior declared by the corresponding interface.

Its paired source or interface file is filesystem_recovery.hpp.

Primary responsibilities:

  • Inspect scan results and filesystem type
  • Dispatch EXT4, NTFS, BTRFS, XFS or HFS recovery
  • Normalize logs and recovered-file records
  • Provide a shared recovery entry point

2. File Identity and Scope

  • Source path: src/filesystem_recovery.cpp
  • Language: C++
  • File role: implementation file
  • Physical lines: 963
  • Non-empty lines: 893
  • SHA-256: f3d068c2fe777f1ee8d64291731244dc61c7b1d596227a31d34772a25f001d84

The declarations in this file use the global namespace.

3. Dependencies

3.1 Project Headers

  • filesystem_recovery.hpp
  • i18n.hpp
  • ntfs_recovery.hpp
  • ext4_recovery.hpp
  • btrfs_recovery.hpp
  • xfs_recovery.hpp
  • hfs_recovery.hpp
  • carving.hpp
  • text_utils.hpp

3.2 Standard and External Headers

  • algorithm
  • array
  • cctype
  • cstdlib
  • filesystem
  • fstream
  • map
  • optional
  • set
  • sstream
  • string
  • vector

These dependencies define the file’s compile-time integration with the recovery engine, GTK interface, on-disk format decoders, operating-system services, or C++ standard library.

4. Declared Types

  • class Fat32Recovery.
  • class ExfatRecovery.
  • struct StreamInfo.

5. Constants and Configuration Values

No preprocessor or compile-time constants were detected as top-level declarations in this file.

5.1 Operational Strings, Paths, Formats, or Commands

The following code literals are operationally relevant and may identify filesystem paths, helper commands, formats, signatures, or subsystem labels:

  • ntfs_recovery.hpp
  • ext4_recovery.hpp
  • btrfs_recovery.hpp
  • xfs_recovery.hpp
  • hfs_recovery.hpp
  • NTFS volume
  • Lost NTFS partition candidate
  • NTFS candidate
  • ext4 volume
  • Lost ext4 partition candidate
  • ext4 candidate
  • Btrfs volume
  • Lost Btrfs partition candidate
  • Btrfs candidate
  • XFS volume
  • Lost XFS partition candidate
  • HFS+ volume
  • HFSX volume
  • Lost HFS+ partition candidate
  • ntfs
  • ext4
  • btrfs
  • xfs
  • hfs
  • NTFS recovery skipped or failed at offset
  • ext4 recovery skipped or failed at offset
  • Btrfs recovery skipped or failed at offset
  • XFS recovery skipped or failed at offset
  • HFS+ recovery skipped or failed at offset

6. Data Members and Persistent State

No class data members are declared directly in this file, or the file primarily implements methods declared elsewhere.

7. API and Function Inventory

The following callable interfaces or definitions were detected:

  • uint16_t le16(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint32_t le32(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • uint64_t le64(const unsigned char*p) – Implements the operation identified by this API and updates or returns the associated state.
  • inline std::string sanitize_path_component(const std::string&in) – Implements the operation identified by this API and updates or returns the associated state.
  • bool write_data_to_file(DiskReader&reader,const std::vector<std::pair<uint64_t,uint64_t>>&ranges,const fs::path&out_path,uint64_t expected_size,std::string&error) – Persists or exports the supplied state to the relevant destination.
  • explicit Fat32Recovery(DiskReader&reader): reader_(reader) – Implements the operation identified by this API and updates or returns the associated state.
  • bool recover(uint64_t volume_offset,const fs::path&out_root,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Performs the associated recovery or extraction operation.
  • bool load_bpb(uint64_t volume_offset) – Reads or derives the requested information and returns or stores the decoded result.
  • uint64_t cluster_to_offset(uint32_t cluster)const – Implements the operation identified by this API and updates or returns the associated state.
  • bool read_cluster(uint32_t cluster,std::vector<unsigned char>&out) – Reads or derives the requested information and returns or stores the decoded result.
  • bool next_cluster(uint32_t current,uint32_t&next) – Implements the operation identified by this API and updates or returns the associated state.
  • std::vector<uint32_t> cluster_chain(uint32_t start,size_t hard_limit=1 << 20) – Implements the operation identified by this API and updates or returns the associated state.
  • static std::string decode_lfn_part(const unsigned char*entry) – Reads or derives the requested information and returns or stores the decoded result.
  • static std::string short_name(const unsigned char*entry) – Implements the operation identified by this API and updates or returns the associated state.
  • bool export_file(const std::string&name,uint32_t start_cluster,uint32_t size_bytes,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Persists or exports the supplied state to the relevant destination.
  • bool recover_directory(uint32_t dir_cluster,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error,std::set<uint32_t>&dir_guard,int depth) – Performs the associated recovery or extraction operation.
  • bool export_file_to_dir(const std::string&name,uint32_t start_cluster,uint32_t size_bytes,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&,bool is_deleted) – Persists or exports the supplied state to the relevant destination.
  • explicit ExfatRecovery(DiskReader&reader): reader_(reader) – Implements the operation identified by this API and updates or returns the associated state.
  • bool load_vbr(uint64_t volume_offset) – Reads or derives the requested information and returns or stores the decoded result.
  • bool cluster_allocated(uint32_t cluster)const – Implements the operation identified by this API and updates or returns the associated state.
  • bool load_allocation_bitmap() – Reads or derives the requested information and returns or stores the decoded result.
  • std::vector<uint32_t> cluster_chain(uint32_t start,bool no_fat_chain,uint64_t data_length,size_t hard_limit=1 << 20) – Implements the operation identified by this API and updates or returns the associated state.
  • static std::string decode_utf16_name(const std::vector<unsigned char>&bytes) – Reads or derives the requested information and returns or stores the decoded result.
  • bool export_stream(const StreamInfo&info,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Persists or exports the supplied state to the relevant destination.
  • bool export_stream_deleted(const StreamInfo&info,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Persists or exports the supplied state to the relevant destination.
  • bool recover_directory(uint32_t start_cluster,const fs::path&out_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error,std::set<uint32_t>&dir_guard,int depth) – Performs the associated recovery or extraction operation.
  • bool FilesystemRecovery::recover_supported_filesystems(DiskReader&reader,const ScanReport&report,const std::string&output_dir,std::vector<RecoveredFileRecord>&recovered,std::vector<std::string>&logs,std::string&error) – Performs the associated recovery or extraction operation.
  • } catch(const std::exception&ex) – Implements the operation identified by this API and updates or returns the associated state.

8. Operational Flow

The subsystem represented by this file normally participates in the following flow:

  1. Inspect scan results and filesystem type.
  2. Dispatch EXT4, NTFS, BTRFS, XFS or HFS recovery.
  3. Normalize logs and recovered-file records.
  4. Provide a shared recovery entry point.
  5. Expose or execute the detected APIs: le16, le32, le64, sanitize_path_component, write_data_to_file, Fat32Recovery, recover, load_bpb, cluster_to_offset, read_cluster, next_cluster, cluster_chain, decode_lfn_part, short_name, export_file, recover_directory, export_file_to_dir, ExfatRecovery and additional helpers.
  6. Return explicit results, progress data, recovered records, or diagnostics to the calling layer.

9. Validation and Error Handling

  • Errors are propagated through Boolean results, error strings, logs, exceptions, or status records depending on the API.
  • Byte offsets, sizes and lengths must be validated before arithmetic and before every read to avoid overflow and out-of-bounds access.
  • On-disk structures are accepted only after validating signatures, magic values and structural constraints.
  • Input and output paths require existence checks, permission handling and safe destination construction.
  • The implementation contains explicit failure-catching paths and should retain the original diagnostic context.

10. Runtime, Concurrency, and Resource Management

  • I/O: filesystem and raw-source operations can fail partially and must preserve exact byte counts and diagnostic context.
  • Error handling: explicit error, exception or optional-result paths are present and form part of the file contract.
  • File descriptors and streams must be closed on success, cancellation and error paths.

11. Security and Data-Recovery Considerations

  • Recovery code should prefer read-only source access and avoid writing to the original damaged medium.
  • Raw devices and image files are treated as untrusted binary input; every offset and length must remain bounded by the source size.
  • Recovered names and destination paths must be sanitized to prevent directory traversal and accidental overwrite outside the selected export directory.

12. Implementation Considerations

  • The implementation should remain aligned with declarations in the paired header and preserve documented return-value semantics.
  • Binary decoding uses low-level memory operations or casts; alignment, endianness and packed-structure assumptions require careful review.
  • Large-device arithmetic uses 64-bit values; additions and multiplications should be checked before use as offsets or allocation sizes.
  • Filesystem operations can cross trust boundaries and should use normalized, contained destination paths.

13. Integration with the Recovery Pipeline

  • The file belongs to the extraction layer and consumes scan candidates or validated filesystem metadata.
  • Recovered output is represented through shared models and returned to the exporter or UI.
  • Partial recovery must be reported explicitly rather than silently treated as complete.

14. Licensing and Provenance

No explicit copyright or software-license statement was detected in the opening section of this individual file. Distribution terms should therefore be verified against the project-level license and repository metadata.

The SHA-256 value in this document can be used to associate the generated documentation with the exact source version analyzed.

Published on:
Last updated on: