dos.c

linux下开发的针对所有磁盘的数据恢复的源码

    /* Sanity Check */
    if (tsk_getu16(vs->endian, sect.magic) != DOS_MAGIC) {
        tsk_error_reset();
        tsk_errno = TSK_ERR_VS_MAGIC;
        snprintf(tsk_errstr, TSK_ERRSTR_L,
            "Extended DOS partition table in sector %"
            PRIuDADDR, sect_cur);
        tsk_errstr2[0] = '\0';
        return 1;
    }

    /* Add an entry of 1 length for the table  to the internal structure */
    if ((table_str = tsk_malloc(32)) == NULL)
        return 1;

    snprintf(table_str, 32, "Extended Table (#%d)", table);
    if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) sect_cur,
            (TSK_DADDR_T) 1, TSK_VS_PART_FLAG_META, table_str, table,
            -1)) {
        return 1;
    }

    /* Cycle through the four partitions in the table 
     *
     * When another extended partition is found, it is processed
     * inside of the loop
     */
    for (i = 0; i < 4; i++) {
        dos_part *part = &sect.ptable[i];

        /* Get the starting sector and size, we currently
         * ignore CHS */
        uint32_t part_start = tsk_getu32(vs->endian, part->start_sec);
        uint32_t part_size = tsk_getu32(vs->endian, part->size_sec);

        if (tsk_verbose)
            tsk_fprintf(stderr,
                "load_ext: %d:%d    Start: %" PRIu32 "   Size: %"
                PRIu32 "  Type: %d\n", table, i, part_start, part_size,
                part->ptype);

        if (part_size == 0)
            continue;

        /* partitions are addressed differently 
         * in extended partitions */
        if (dos_is_ext(part->ptype)) {

            /* part start is added to the start of the
             * first extended partition (the primary
             * extended partition) */

            if (sect_ext_base + part_start > max_addr) {
                tsk_error_reset();
                tsk_errno = TSK_ERR_VS_BLK_NUM;
                snprintf(tsk_errstr, TSK_ERRSTR_L,
                    "dos_load_ext_table: Starting sector too large for image");
                if (tsk_verbose)
                    tsk_fprintf(stderr,
                        "Starting sector %" PRIuDADDR
                        " too large for image\n",
                        sect_ext_base + part_start);
                return 1;
            }

            if (NULL == tsk_vs_part_add(vs,
                    (TSK_DADDR_T) (sect_ext_base + part_start),
                    (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC,
                    dos_get_desc(part->ptype), table, i))
                return 1;


            /* Process the extended partition */
            if (dos_load_ext_table(vs, sect_ext_base + part_start,
                    sect_ext_base, table + 1))
                return 1;
        }

        else {
            /* part_start is added to the start of the 
             * current partition for the actual
             * starting location */

            if (sect_cur + part_start > max_addr) {
                tsk_error_reset();
                tsk_errno = TSK_ERR_VS_BLK_NUM;
                snprintf(tsk_errstr, TSK_ERRSTR_L,
                    "dos_load_ext_table: Starting sector too large for image");
                if (tsk_verbose)
                    tsk_fprintf(stderr,
                        "Starting sector %" PRIuDADDR
                        " too large for image\n", sect_cur + part_start);
                return 1;
            }
            if (NULL == tsk_vs_part_add(vs,
                    (TSK_DADDR_T) (sect_cur + part_start),
                    (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC,
                    dos_get_desc(part->ptype), table, i))
                return 1;
        }
    }

    return 0;
}


/* 
 * Load the primary partition table (MBR) into the internal
 * data structures in TSK_VS_INFO
 *
 * This will automatically call load_ext_table for extended
 * partitions
 *
 * sect_cur is the addres of the table to load
 *
 * 0 is returned if the load is successful and 1 if error
 */
static uint8_t
dos_load_prim_table(TSK_VS_INFO * vs, uint8_t test)
{
    dos_sect sect;
    int i, added = 0;
    char *table_str;
    ssize_t cnt;
    TSK_DADDR_T taddr = vs->offset / vs->block_size + DOS_PART_SOFFSET;
    TSK_DADDR_T max_addr = (vs->img_info->size - vs->offset) / vs->block_size;  // max sector

    if (tsk_verbose)
        tsk_fprintf(stderr,
            "dos_load_prim: Table Sector: %" PRIuDADDR "\n", taddr);

    /* Read the table */
    cnt = tsk_vs_read_block
        (vs, DOS_PART_SOFFSET, (char *) &sect, sizeof(sect));

    if (cnt != sizeof(sect)) {
        if (cnt >= 0) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_READ;
        }
        snprintf(tsk_errstr2, TSK_ERRSTR_L,
            "Primary DOS table sector %" PRIuDADDR, taddr);
        return 1;
    }


    /* Sanity Check */
    if (tsk_vs_guessu16(vs, sect.magic, DOS_MAGIC)) {
        tsk_error_reset();
        tsk_errno = TSK_ERR_VS_MAGIC;
        snprintf(tsk_errstr, TSK_ERRSTR_L,
            "File is not a DOS partition (invalid primary magic) (Sector: %"
            PRIuDADDR ")", taddr);
        return 1;
    }

    /* Because FAT and NTFS use the same magic - check for a
     * standard MS OEM name and sizes.  Not a great check, but we can't 
     * really test the table entries.  
     */
    if (test) {

        if (tsk_verbose)
            tsk_fprintf(stderr,
                "dos_load_prim_table: Testing FAT/NTFS conditions\n");

        if (strncmp("MSDOS", sect.oemname, 5) == 0) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_MAGIC;
            snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: MSDOS OEM name exists");
            if (tsk_verbose)
                tsk_fprintf(stderr,
                    "dos_load_prim_table: MSDOS OEM name exists\n");
            return 1;
        }
        else if (strncmp("MSWIN", sect.oemname, 5) == 0) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_MAGIC;
            snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: MSWIN OEM name exists");
            if (tsk_verbose)
                tsk_fprintf(stderr,
                    "dos_load_prim_table: MSWIN OEM name exists\n");
            return 1;
        }
        else if (strncmp("NTFS", sect.oemname, 4) == 0) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_MAGIC;
            snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: NTFS OEM name exists");
            if (tsk_verbose)
                tsk_fprintf(stderr,
                    "dos_load_prim_table: NTFS OEM name exists\n");
            return 1;
        }
        else if (strncmp("FAT", sect.oemname, 4) == 0) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_MAGIC;
            snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: FAT OEM name exists");
            if (tsk_verbose)
                tsk_fprintf(stderr,
                    "dos_load_prim_table: FAT OEM name exists\n");
            return 1;
        }
    }

    /* Add an entry of 1 sector for the table  to the internal structure */
    if ((table_str = tsk_malloc(32)) == NULL)
        return 1;

    snprintf(table_str, 32, "Primary Table (#0)");
    if (NULL == tsk_vs_part_add(vs, DOS_PART_SOFFSET, (TSK_DADDR_T) 1,
            TSK_VS_PART_FLAG_META, table_str, -1, -1))
        return 1;

    /* Cycle through the partition table */
    for (i = 0; i < 4; i++) {
        dos_part *part = &sect.ptable[i];

        /* We currently ignore CHS */
        uint32_t part_start = tsk_getu32(vs->endian, part->start_sec);
        uint32_t part_size = tsk_getu32(vs->endian, part->size_sec);

        if (tsk_verbose)
            tsk_fprintf(stderr,
                "load_pri:0:%d    Start: %" PRIu32 "   Size: %" PRIu32
                "  Type: %d\n", i, part_start, part_size, part->ptype);

        if (part_size == 0)
            continue;

        if (part_start > max_addr) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_BLK_NUM;
            snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: Starting sector too large for image");
            if (tsk_verbose)
                tsk_fprintf(stderr,
                    "Starting sector %" PRIu32 " too large for image\n",
                    part_start);

            return 1;
        }
#if 0
// I'm not sure if this is too strict ...
        else if ((part_start + part_size) > max_addr) {
            tsk_error_reset();
            tsk_errno = TSK_ERR_VS_BLK_NUM
                snprintf(tsk_errstr, TSK_ERRSTR_L,
                "dos_load_prim_table: Partition ends after image");
            return 1;
        }
#endif

        added = 1;

        /* Add the partition to the internal structure 
         * If it is an extended partition, process it now */
        if (dos_is_ext(part->ptype)) {
            if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) part_start,
                    (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_META,
                    dos_get_desc(part->ptype), 0, i))
                return 1;

            if (dos_load_ext_table(vs, part_start, part_start, 1))
                return 1;
        }
        else {
            if (NULL == tsk_vs_part_add(vs, (TSK_DADDR_T) part_start,
                    (TSK_DADDR_T) part_size, TSK_VS_PART_FLAG_ALLOC,
                    dos_get_desc(part->ptype), 0, i))
                return 1;
        }
    }
    if (added == 0) {
        if (tsk_verbose)
            tsk_fprintf(stderr, "dos_load_prim: No valid entries\n");

        tsk_error_reset();
        tsk_errno = TSK_ERR_VS_MAGIC;
        snprintf(tsk_errstr, TSK_ERRSTR_L,
            "dos_load_prim_table: No valid entries in primary table");
        return 1;
    }

    return 0;
}


static void
dos_close(TSK_VS_INFO * vs)
{
    tsk_vs_part_free(vs);
    free(vs);
}


/* 
 * Given the path to the file, open it and load the internal
 * partition table structure
 *
 * offset is the byte offset to the start of the volume system
 *
 * If test is 1 then additional tests are performed to make sure 
 * it isn't a FAT or NTFS file system
 */
TSK_VS_INFO *
tsk_vs_dos_open(TSK_IMG_INFO * img_info, TSK_DADDR_T offset, uint8_t test)
{
    TSK_VS_INFO *vs;

    // clean up any errors that are lying around
    tsk_error_reset();

    vs = (TSK_VS_INFO *) tsk_malloc(sizeof(*vs));
    if (vs == NULL)
        return NULL;

    vs->vstype = TSK_VS_TYPE_DOS;
    vs->img_info = img_info;

    vs->offset = offset;

    /* inititialize settings */
    vs->part_list = NULL;
    vs->part_count = 0;
    vs->endian = 0;
    vs->block_size = 512;

    /* Assign functions */
    vs->close = dos_close;

    /* Load the partitions into the sorted list */
    if (dos_load_prim_table(vs, test)) {
        dos_close(vs);
        return NULL;
    }

    /* fill in the sorted list with the 'unknown' values */
    if (tsk_vs_part_unused(vs)) {
        dos_close(vs);
        return NULL;
    }

    return vs;
}