extras/volume_id/lib/ntfs.c

   1 /*
   2  * volume_id - reads filesystem label and uuid
   3  *
   4  * Copyright (C) 2004 Kay Sievers <kay.sievers@vrfy.org>
   5  *
   6  * This program is free software: you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #ifndef _GNU_SOURCE
  21 #define _GNU_SOURCE 1
  22 #endif
  23
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <unistd.h>
  27 #include <string.h>
  28 #include <errno.h>
  29 #include <ctype.h>
  30
  31 #include "libvolume_id.h"
  32 #include "libvolume_id-private.h"
  33
  34 static struct ntfs_super_block {
  35         uint8_t         jump[3];
  36         uint8_t         oem_id[8];
  37         uint16_t        bytes_per_sector;
  38         uint8_t         sectors_per_cluster;
  39         uint16_t        reserved_sectors;
  40         uint8_t         fats;
  41         uint16_t        root_entries;
  42         uint16_t        sectors;
  43         uint8_t         media_type;
  44         uint16_t        sectors_per_fat;
  45         uint16_t        sectors_per_track;
  46         uint16_t        heads;
  47         uint32_t        hidden_sectors;
  48         uint32_t        large_sectors;
  49         uint16_t        unused[2];
  50         uint64_t        number_of_sectors;
  51         uint64_t        mft_cluster_location;
  52         uint64_t        mft_mirror_cluster_location;
  53         int8_t          cluster_per_mft_record;
  54         uint8_t         reserved1[3];
  55         int8_t          cluster_per_index_record;
  56         uint8_t         reserved2[3];
  57         uint8_t         volume_serial[8];
  58         uint16_t        checksum;
  59 } PACKED *ns;
  60
  61 static struct master_file_table_record {
  62         uint8_t         magic[4];
  63         uint16_t        usa_ofs;
  64         uint16_t        usa_count;
  65         uint64_t        lsn;
  66         uint16_t        sequence_number;
  67         uint16_t        link_count;
  68         uint16_t        attrs_offset;
  69         uint16_t        flags;
  70         uint32_t        bytes_in_use;
  71         uint32_t        bytes_allocated;
  72 } PACKED *mftr;
  73
  74 static struct file_attribute {
  75         uint32_t        type;
  76         uint32_t        len;
  77         uint8_t         non_resident;
  78         uint8_t         name_len;
  79         uint16_t        name_offset;
  80         uint16_t        flags;
  81         uint16_t        instance;
  82         uint32_t        value_len;
  83         uint16_t        value_offset;
  84 } PACKED *attr;
  85
  86 static struct volume_info {
  87         uint64_t        reserved;
  88         uint8_t         major_ver;
  89         uint8_t         minor_ver;
  90 } PACKED *info;
  91
  92 #define MFT_RECORD_VOLUME                       3
  93 #define MFT_RECORD_ATTR_VOLUME_NAME             0x60
  94 #define MFT_RECORD_ATTR_VOLUME_INFO             0x70
  95 #define MFT_RECORD_ATTR_OBJECT_ID               0x40
  96 #define MFT_RECORD_ATTR_END                     0xffffffffu
  97
  98 int volume_id_probe_ntfs(struct volume_id *id, uint64_t off, uint64_t size)
  99 {
 100         uint8_t volume_serial[8];
 101         unsigned int sector_size;
 102         unsigned int cluster_size;
 103         uint64_t mft_cluster;
 104         uint64_t mft_off;
 105         unsigned int mft_record_size;
 106         unsigned int attr_type;
 107         unsigned int attr_off;
 108         unsigned int attr_len;
 109         unsigned int val_off;
 110         unsigned int val_len;
 111         const uint8_t *buf;
 112         const uint8_t *val;
 113
 114         info("probing at offset 0x%" PRIx64 "\n", off);
 115
 116         ns = (struct ntfs_super_block *) volume_id_get_buffer(id, off, 0x200);
 117         if (ns == NULL)
 118                 return -1;
 119
 120         if (memcmp(ns->oem_id, "NTFS", 4) != 0)
 121                 return -1;
 122
 123         memcpy(volume_serial, ns->volume_serial, sizeof(volume_serial));
 124
 125         sector_size = le16_to_cpu(ns->bytes_per_sector);
 126         if (sector_size < 0x200)
 127                 return -1;
 128
 129         cluster_size = ns->sectors_per_cluster * sector_size;
 130         mft_cluster = le64_to_cpu(ns->mft_cluster_location);
 131         mft_off = mft_cluster * cluster_size;
 132
 133         if (ns->cluster_per_mft_record < 0)
 134                 /* size = -log2(mft_record_size); normally 1024 Bytes */
 135                 mft_record_size = 1 << -ns->cluster_per_mft_record;
 136         else
 137                 mft_record_size = ns->cluster_per_mft_record * cluster_size;
 138
 139         dbg("sectorsize  0x%x\n", sector_size);
 140         dbg("clustersize 0x%x\n", cluster_size);
 141         dbg("mftcluster  %" PRIu64 "\n", mft_cluster);
 142         dbg("mftoffset  0x%" PRIx64 "\n", mft_off);
 143         dbg("cluster per mft_record  %i\n", ns->cluster_per_mft_record);
 144         dbg("mft record size  %i\n", mft_record_size);
 145
 146         buf = volume_id_get_buffer(id, off + mft_off + (MFT_RECORD_VOLUME * mft_record_size),
 147                          mft_record_size);
 148         if (buf == NULL)
 149                 return -1;
 150
 151         mftr = (struct master_file_table_record*) buf;
 152         dbg("mftr->magic '%c%c%c%c'\n", mftr->magic[0], mftr->magic[1], mftr->magic[2], mftr->magic[3]);
 153         if (memcmp(mftr->magic, "FILE", 4) != 0)
 154                 return -1;
 155
 156         attr_off = le16_to_cpu(mftr->attrs_offset);
 157         dbg("file $Volume's attributes are at offset %i\n", attr_off);
 158
 159         while (1) {
 160                 attr = (struct file_attribute*) &buf[attr_off];
 161                 attr_type = le32_to_cpu(attr->type);
 162                 attr_len = le16_to_cpu(attr->len);
 163                 val_off = le16_to_cpu(attr->value_offset);
 164                 val_len = le32_to_cpu(attr->value_len);
 165                 attr_off += attr_len;
 166
 167                 if (attr_len == 0)
 168                         break;
 169
 170                 if (attr_off >= mft_record_size)
 171                         break;
 172
 173                 if (attr_type == MFT_RECORD_ATTR_END)
 174                         break;
 175
 176                 dbg("found attribute type 0x%x, len %i, at offset %i\n",
 177                     attr_type, attr_len, attr_off);
 178
 179                 if (attr_type == MFT_RECORD_ATTR_VOLUME_INFO) {
 180                         dbg("found info, len %i\n", val_len);
 181                         info = (struct volume_info*) (((uint8_t *) attr) + val_off);
 182                         snprintf(id->type_version, sizeof(id->type_version)-1,
 183                                  "%u.%u", info->major_ver, info->minor_ver);
 184                 }
 185
 186                 if (attr_type == MFT_RECORD_ATTR_VOLUME_NAME) {
 187                         dbg("found label, len %i\n", val_len);
 188                         if (val_len > VOLUME_ID_LABEL_SIZE)
 189                                 val_len = VOLUME_ID_LABEL_SIZE;
 190
 191                         val = ((uint8_t *) attr) + val_off;
 192                         volume_id_set_label_raw(id, val, val_len);
 193                         volume_id_set_label_unicode16(id, val, LE, val_len);
 194                 }
 195         }
 196
 197         volume_id_set_uuid(id, volume_serial, 0, UUID_64BIT_LE);
 198         volume_id_set_usage(id, VOLUME_ID_FILESYSTEM);
 199         id->type = "ntfs";
 200         /* we think this is ntfs, but we make sure no other signatures are found */
 201         id->force_unique_result = 1;
 202         return 0;
 203 }