1 /**
2 * ntfsck - Part of the Linux-NTFS project.
3 *
4 * Copyright (c) 2006 Yuval Fledel
5 *
6 * This utility will check and fix errors on an NTFS volume.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program (in the main directory of the Linux-NTFS
20 * distribution in the file COPYING); if not, write to the Free Software
21 * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 */
23
24
25 #include "config.h"
26
27 #ifdef HAVE_STDIO_H
28 #include <stdio.h>
29 #endif
30 #ifdef HAVE_STDLIB_H
31 #include <stdlib.h>
32 #endif
33 #ifdef HAVE_STRING_H
34 #include <string.h>
35 #endif
36 #ifdef HAVE_FCNTL_H
37 #include <fcntl.h>
38 #endif
39
40 #include <layout.h>
41 #include <bitmap.h>
42 #include <endians.h>
43 #include <bootsect.h>
44 #include <misc.h>
45
46 #include "cluster.h"
47 #include "utils.h"
48
49 #define RETURN_FS_ERRORS_CORRECTED (1)
50 #define RETURN_SYSTEM_NEEDS_REBOOT (2)
51 #define RETURN_FS_ERRORS_LEFT_UNCORRECTED (4)
52 #define RETURN_OPERATIONAL_ERROR (8)
53 #define RETURN_USAGE_OR_SYNTAX_ERROR (16)
54 #define RETURN_CANCELLED_BY_USER (32)
55 /* Where did 64 go? */
56 #define RETURN_SHARED_LIBRARY_ERROR (128)
57
58 /* todo: command line: (everything is optional)
59 * fsck-frontend options:
60 * -C [fd] : display progress bar (send it to the file descriptor if specified)
61 * -T : don't show the title on startup
62 * fsck-checker options:
63 * -a : auto-repair. no questions. (optional: if marked clean and -f not specified, just check if mounable)
64 * -p : auto-repair safe. no questions (optional: same)
65 * -n : only check. no repair.
66 * -r : interactively repair.
67 * -y : always yes.
68 * -v : verbose.
69 * -V : version.
70 * taken from fsck.ext2
71 * -b sb : use the superblock from sb. For corrupted volumes. (do we want separete boot/mft options?)
72 * -c : use badblocks(8) to find bad blocks (R/O mode) and add the findings to $Bad.
73 * -C fd : write competion info to fd. If 0, print a completion bar.
74 * -d : debugging output.
75 * -D : rebalance indices.
76 * -f : force checking even if marked clean.
77 * -F : flush buffers before beginning. (for time-benchmarking)
78 * -k : When used with -c, don't erase previous $Bad items.
79 * -n : Open fs as readonly. assume always no. (why is it needed if -r is not specified?)
80 * -t : Print time statistics.
81 * taken from fsck.reiserfs
82 * --rebuild-sb : try to find $MFT start and rebuild the boot sector.
83 * --rebuild-tree : scan for items and rebuild the indices that point to them (0x30, $SDS, etc.)
84 * --clean-reserved: zero rezerved fields. (use with care!)
85 * --adjust-size -z: insert a sparse hole if the data_size is larger than the size marked in the runlist.
86 * --logfile file : report corruptions (unlike other errors) to a file instead of stderr.
87 * --nolog : don't report corruptions at all.
88 * --quiet -q : no progress bar.
89 * taken from fsck.msdos
90 * -w : flush after every write.
91 * - do n passes. (only 2 in fsck.msdos. second should not report errors. Bonus: stop when error list does not change)
92 * taken from fsck.jfs
93 * --omit-journal-reply: self-descriptive (why would someone do that?)
94 * --replay-journal-only: self-descriptive. don't check otherwise.
95 * taken from fsck.xfs
96 * -s : only serious errors should be reported.
97 * -i ino : verbose behaviour only for inode ino.
98 * -b bno : verbose behaviour only for cluster bno.
99 * -L : zero log.
100 * inspired by others
101 * - don't do cluster accounting.
102 * - don't do mft record accounting.
103 * - don't do file names accounting.
104 * - don't do security_id accounting.
105 * - don't check acl inheritance problems.
106 * - undelete unused mft records. (bonus: different options for 100% salvagable and less)
107 * - error-level-report n: only report errors above this error level
108 * - error-level-repair n: only repair errors below this error level
109 * - don't fail on ntfsclone metadata pruning.
110 * signals:
111 * SIGUSR1 : start displaying progress bar
112 * SIGUSR2 : stop displaying progress bar.
113 */
114
115 /* Assuming NO_NTFS_DEVICE_DEFAULT_IO_OPS is not set */
116
117 static int errors = 0;
118 static int unsupported = 0;
119
120 static short bytes_per_sector, sectors_per_cluster;
121 //static s64 mft_offset, mftmirr_offset;
122 static s64 current_mft_record;
123
124 /**
125 * This is just a preliminary volume.
126 * Filled while checking the boot sector and used in the preliminary MFT check.
127 */
128 //static ntfs_volume vol;
129
130 static runlist_element *mft_rl, *mft_bitmap_rl;
131
132 #define check_failed(FORMAT, ARGS...) \
133 do { \
134 errors++; \
135 ntfs_log_redirect(__FUNCTION__,__FILE__,__LINE__, \
136 NTFS_LOG_LEVEL_ERROR,NULL,FORMAT,##ARGS); \
137 } while (0);
138
139 /**
140 * 0 success.
141 * 1 fail.
142 */
assert_u32_equal(u32 val,u32 ok,const char * name)143 static int assert_u32_equal(u32 val, u32 ok, const char *name)
144 {
145 if (val!=ok) {
146 check_failed("Assertion failed for '%lld:%s'. should be 0x%x, "
147 "was 0x%x.\n", (long long)current_mft_record, name,
148 (int)ok, (int)val);
149 //errors++;
150 return 1;
151 }
152 return 0;
153 }
154
assert_u32_noteq(u32 val,u32 wrong,const char * name)155 static int assert_u32_noteq(u32 val, u32 wrong, const char *name)
156 {
157 if (val==wrong) {
158 check_failed("Assertion failed for '%lld:%s'. should not be "
159 "0x%x.\n", (long long)current_mft_record, name,
160 (int)wrong);
161 return 1;
162 }
163 return 0;
164 }
165
assert_u32_lesseq(u32 val1,u32 val2,const char * name)166 static int assert_u32_lesseq(u32 val1, u32 val2, const char *name)
167 {
168 if (val1 > val2) {
169 check_failed("Assertion failed for '%s'. 0x%x > 0x%x\n",
170 name, (int)val1, (int)val2);
171 //errors++;
172 return 1;
173 }
174 return 0;
175 }
176
assert_u32_less(u32 val1,u32 val2,const char * name)177 static int assert_u32_less(u32 val1, u32 val2, const char *name)
178 {
179 if (val1 >= val2) {
180 check_failed("Assertion failed for '%s'. 0x%x >= 0x%x\n",
181 name, (int)val1, (int)val2);
182 //errors++;
183 return 1;
184 }
185 return 0;
186 }
187
188 /**
189 * Return: 0 ok, 1 error.
190 *
191 * todo: may we use ntfs_boot_sector_is_ntfs() instead?
192 * It already does the checks but will not be able to fix anything.
193 */
verify_boot_sector(struct ntfs_device * dev,ntfs_volume * rawvol)194 static BOOL verify_boot_sector(struct ntfs_device *dev, ntfs_volume *rawvol)
195 {
196 u8 buf[512];
197 NTFS_BOOT_SECTOR *ntfs_boot = (NTFS_BOOT_SECTOR *)&buf;
198 //u32 bytes_per_cluster;
199
200 current_mft_record = 9;
201
202 if (ntfs_pread(dev, 0, sizeof(buf), buf) != sizeof(buf)) {
203 check_failed("Failed to read boot sector.\n");
204 return 1;
205 }
206
207 if ((buf[0]!=0xeb) ||
208 ((buf[1]!=0x52) && (buf[1]!=0x5b)) ||
209 (buf[2]!=0x90)) {
210 check_failed("Boot sector: Bad jump.\n");
211 }
212 if (ntfs_boot->oem_id != magicNTFS) {
213 check_failed("Boot sector: Bad NTFS magic.\n");
214 }
215 bytes_per_sector = le16_to_cpu(ntfs_boot->bpb.bytes_per_sector);
216 if (!bytes_per_sector) {
217 check_failed("Boot sector: Bytes per sector is 0.\n");
218 }
219 if (bytes_per_sector%512) {
220 check_failed("Boot sector: Bytes per sector is not a multiple"
221 " of 512.\n");
222 }
223 sectors_per_cluster = ntfs_boot->bpb.sectors_per_cluster;
224
225 // todo: if partition, query bios and match heads/tracks? */
226
227 // Initialize some values into rawvol. We will need those later.
228 rawvol->dev = dev;
229 ntfs_boot_sector_parse(rawvol, (NTFS_BOOT_SECTOR *)buf);
230
231 return 0;
232 }
233
234 /**
235 * Load the runlist of the <attr_type> attribute.
236 *
237 * Return NULL if an error.
238 * The caller is responsible on freeing the allocated memory if the result is not NULL.
239 *
240 * Set size_of_file_record to some reasonable size when in doubt (the Windows default is 1024.)
241 *
242 * attr_type must be little endian.
243 *
244 * This function has code duplication with check_file_record() and
245 * check_attr_record() but its goal is to be less strict. Thus the
246 * duplicated checks are the minimal required for not crashing.
247 *
248 * Assumes dev is open.
249 */
load_runlist(ntfs_volume * rawvol,s64 offset_to_file_record,ATTR_TYPES attr_type,u32 size_of_file_record)250 static runlist *load_runlist(ntfs_volume *rawvol, s64 offset_to_file_record, ATTR_TYPES attr_type, u32 size_of_file_record)
251 {
252 u8 *buf;
253 u16 attrs_offset;
254 u32 length;
255 ATTR_RECORD *attr_rec;
256
257 if (size_of_file_record<22) // offset to attrs_offset
258 return NULL;
259
260 buf = (u8*)ntfs_malloc(size_of_file_record);
261 if (!buf)
262 return NULL;
263
264 if (ntfs_pread(rawvol->dev, offset_to_file_record, size_of_file_record, buf) !=
265 size_of_file_record) {
266 check_failed("Failed to read file record at offset %lld (0x%llx).\n",
267 (long long)offset_to_file_record,
268 (long long)offset_to_file_record);
269 return NULL;
270 }
271
272 attrs_offset = le16_to_cpu(((MFT_RECORD*)buf)->attrs_offset);
273 // first attribute must be after the header.
274 if (attrs_offset<42) {
275 check_failed("First attribute must be after the header (%u).\n", (int)attrs_offset);
276 }
277 attr_rec = (ATTR_RECORD *)(buf + attrs_offset);
278 //printf("uv1.\n");
279
280 while ((u8*)attr_rec<=buf+size_of_file_record-4) {
281
282 //printf("Attr type: 0x%x.\n", attr_rec->type);
283 // Check attribute record. (Only what is in the buffer)
284 if (attr_rec->type==AT_END) {
285 check_failed("Attribute 0x%x not found in file record at offset %lld (0x%llx).\n", (int)le32_to_cpu(attr_rec->type),
286 (long long)offset_to_file_record,
287 (long long)offset_to_file_record);
288 return NULL;
289 }
290 if ((u8*)attr_rec>buf+size_of_file_record-8) {
291 // not AT_END yet no room for the length field.
292 check_failed("Attribute 0x%x is not AT_END, yet no "
293 "room for the length field.\n",
294 (int)le32_to_cpu(attr_rec->type));
295 return NULL;
296 }
297
298 length = le32_to_cpu(attr_rec->length);
299
300 // Check that this attribute does not overflow the mft_record
301 if ((u8*)attr_rec+length >= buf+size_of_file_record) {
302 check_failed("Attribute (0x%x) is larger than FILE record at offset %lld (0x%llx).\n",
303 (int)le32_to_cpu(attr_rec->type),
304 (long long)offset_to_file_record,
305 (long long)offset_to_file_record);
306 return NULL;
307 }
308 // todo: what ATTRIBUTE_LIST (0x20)?
309
310 if (attr_rec->type==attr_type) {
311 // Eurika!
312
313 // ntfs_mapping_pairs_decompress only use two values from vol. Just fake it.
314 // todo: it will also use vol->major_ver if defined(DEBUG). But only for printing purposes.
315
316 // Assume ntfs_boot_sector_parse() was called.
317 return ntfs_mapping_pairs_decompress(rawvol, attr_rec, NULL);
318 }
319
320 attr_rec = (ATTR_RECORD*)((u8*)attr_rec+length);
321 }
322 // If we got here, there was an overflow.
323 check_failed("file record corrupted at offset %lld (0x%llx).\n",
324 (long long)offset_to_file_record,
325 (long long)offset_to_file_record);
326 return NULL;
327 }
328
329 /**
330 * Return: >=0 last VCN
331 * LCN_EINVAL error.
332 */
get_last_vcn(runlist * rl)333 static VCN get_last_vcn(runlist *rl)
334 {
335 VCN res;
336
337 if (!rl)
338 return LCN_EINVAL;
339
340 res = LCN_EINVAL;
341 while (rl->length) {
342 ntfs_log_verbose("vcn: %lld, length: %lld.\n",
343 (long long)rl->vcn, (long long)rl->length);
344 if (rl->vcn<0)
345 res = rl->vcn;
346 else
347 res = rl->vcn + rl->length;
348 rl++;
349 }
350
351 return res;
352 }
353
354 static u32 mft_bitmap_records;
355 static u8 *mft_bitmap_buf;
356
357 /**
358 * Assumes mft_bitmap_rl is initialized.
359 * return: 0 ok.
360 * RETURN_OPERATIONAL_ERROR on error.
361 */
mft_bitmap_load(ntfs_volume * rawvol)362 static int mft_bitmap_load(ntfs_volume *rawvol)
363 {
364 VCN vcn;
365 u32 mft_bitmap_length;
366
367 vcn = get_last_vcn(mft_bitmap_rl);
368 if (vcn<=LCN_EINVAL) {
369 mft_bitmap_buf = NULL;
370 /* This case should not happen, not even with on-disk errors */
371 goto error;
372 }
373
374 mft_bitmap_length = vcn * rawvol->cluster_size;
375 mft_bitmap_records = 8 * mft_bitmap_length * rawvol->cluster_size /
376 rawvol->mft_record_size;
377
378 //printf("sizes: %d, %d.\n", mft_bitmap_length, mft_bitmap_records);
379
380 mft_bitmap_buf = (u8*)ntfs_malloc(mft_bitmap_length);
381 if (!mft_bitmap_buf)
382 goto error;
383 if (ntfs_rl_pread(rawvol, mft_bitmap_rl, 0, mft_bitmap_length,
384 mft_bitmap_buf)!=mft_bitmap_length)
385 goto error;
386 return 0;
387 error:
388 mft_bitmap_records = 0;
389 ntfs_log_error("Could not load $MFT/Bitmap.\n");
390 return RETURN_OPERATIONAL_ERROR;
391 }
392
393 /**
394 * -1 Error.
395 * 0 Unused record
396 * 1 Used record
397 *
398 * Assumes mft_bitmap_rl was initialized.
399 */
mft_bitmap_get_bit(s64 mft_no)400 static int mft_bitmap_get_bit(s64 mft_no)
401 {
402 if (mft_no>=mft_bitmap_records)
403 return -1;
404 return ntfs_bit_get(mft_bitmap_buf, mft_no);
405 }
406
407 /**
408 * @attr_rec: The attribute record to check
409 * @mft_rec: The parent FILE record.
410 * @buflen: The size of the FILE record.
411 *
412 * Return:
413 * NULL: Fatal error occured. Not sure where is the next record.
414 * otherwise: pointer to the next attribute record.
415 *
416 * The function only check fields that are inside this attr record.
417 *
418 * Assumes mft_rec is current_mft_record.
419 */
check_attr_record(ATTR_REC * attr_rec,MFT_RECORD * mft_rec,u16 buflen)420 static ATTR_REC *check_attr_record(ATTR_REC *attr_rec, MFT_RECORD *mft_rec,
421 u16 buflen)
422 {
423 u16 name_offset;
424 u16 attrs_offset = le16_to_cpu(mft_rec->attrs_offset);
425 u32 attr_type = le32_to_cpu(attr_rec->type);
426 u32 length = le32_to_cpu(attr_rec->length);
427
428 // Check that this attribute does not overflow the mft_record
429 if ((u8*)attr_rec+length >= ((u8*)mft_rec)+buflen) {
430 check_failed("Attribute (0x%x) is larger than FILE record (%lld).\n",
431 (int)attr_type, (long long)current_mft_record);
432 return NULL;
433 }
434
435 // Attr type must be a multiple of 0x10 and 0x10<=x<=0x100.
436 if ((attr_type & ~0x0F0) && (attr_type != 0x100)) {
437 check_failed("Unknown attribute type 0x%x.\n",
438 (int)attr_type);
439 goto check_attr_record_next_attr;
440 }
441
442 if (length<24) {
443 check_failed("Attribute %lld:0x%x Length too short (%u).\n",
444 (long long)current_mft_record, (int)attr_type,
445 (int)length);
446 goto check_attr_record_next_attr;
447 }
448
449 // If this is the first attribute:
450 // todo: instance number must be smaller than next_instance.
451 if ((u8*)attr_rec == ((u8*)mft_rec) + attrs_offset) {
452 if (!mft_rec->base_mft_record)
453 assert_u32_equal(attr_type, 0x10,
454 "First attribute type");
455 // The following not always holds.
456 // attr 0x10 becomes instance 1 and attr 0x40 becomes 0.
457 //assert_u32_equal(attr_rec->instance, 0,
458 // "First attribute instance number");
459 } else {
460 assert_u32_noteq(attr_type, 0x10,
461 "Not-first attribute type");
462 // The following not always holds.
463 //assert_u32_noteq(attr_rec->instance, 0,
464 // "Not-first attribute instance number");
465 }
466 //if (current_mft_record==938 || current_mft_record==1683 || current_mft_record==3152 || current_mft_record==22410)
467 //printf("Attribute %lld:0x%x instance: %u isbase:%d.\n",
468 // current_mft_record, (int)attr_type, (int)le16_to_cpu(attr_rec->instance), (int)mft_rec->base_mft_record);
469 // todo: instance is unique.
470
471 // Check flags.
472 if (attr_rec->flags & ~(const_cpu_to_le16(0xc0ff))) {
473 check_failed("Attribute %lld:0x%x Unknown flags (0x%x).\n",
474 (long long)current_mft_record, (int)attr_type,
475 (int)le16_to_cpu(attr_rec->flags));
476 }
477
478 if (attr_rec->non_resident>1) {
479 check_failed("Attribute %lld:0x%x Unknown non-resident "
480 "flag (0x%x).\n", (long long)current_mft_record,
481 (int)attr_type, (int)attr_rec->non_resident);
482 goto check_attr_record_next_attr;
483 }
484
485 name_offset = le16_to_cpu(attr_rec->name_offset);
486 /*
487 * todo: name must be legal unicode.
488 * Not really, information below in urls is about filenames, but I
489 * believe it also applies to attribute names. (Yura)
490 * http://blogs.msdn.com/michkap/archive/2006/09/24/769540.aspx
491 * http://blogs.msdn.com/michkap/archive/2006/09/10/748699.aspx
492 */
493
494 if (attr_rec->non_resident) {
495 // Non-Resident
496
497 // Make sure all the fields exist.
498 if (length<64) {
499 check_failed("Non-resident attribute %lld:0x%x too short (%u).\n",
500 (long long)current_mft_record, (int)attr_type,
501 (int)length);
502 goto check_attr_record_next_attr;
503 }
504 if (attr_rec->compression_unit && (length<72)) {
505 check_failed("Compressed attribute %lld:0x%x too short (%u).\n",
506 (long long)current_mft_record, (int)attr_type,
507 (int)length);
508 goto check_attr_record_next_attr;
509 }
510
511 // todo: name comes before mapping pairs, and after the header.
512 // todo: length==mapping_pairs_offset+length of compressed mapping pairs.
513 // todo: mapping_pairs_offset is 8-byte aligned.
514
515 // todo: lowest vcn <= highest_vcn
516 // todo: if base record -> lowest vcn==0
517 // todo: lowest_vcn!=0 -> attribute list is used.
518 // todo: lowest_vcn & highest_vcn are in the drive (0<=x<total clusters)
519 // todo: mapping pairs agree with highest_vcn.
520 // todo: compression unit == 0 or 4.
521 // todo: reserved1 == 0.
522 // todo: if not compressed nor sparse, initialized_size <= allocated_size and data_size <= allocated_size.
523 // todo: if compressed or sparse, allocated_size <= initialized_size and allocated_size <= data_size
524 // todo: if mft_no!=0 and not compressed/sparse, data_size==initialized_size.
525 // todo: if mft_no!=0 and compressed/sparse, allocated_size==initialized_size.
526 // todo: what about compressed_size if compressed?
527 // todo: attribute must not be 0x10, 0x30, 0x40, 0x60, 0x70, 0x90, 0xd0 (not sure about 0xb0, 0xe0, 0xf0)
528 } else {
529 u16 value_offset = le16_to_cpu(attr_rec->value_offset);
530 u32 value_length = le32_to_cpu(attr_rec->value_length);
531 // Resident
532 if (attr_rec->name_length) {
533 if (name_offset < 24)
534 check_failed("Resident attribute with "
535 "name intersecting header.\n");
536 if (value_offset < name_offset +
537 attr_rec->name_length)
538 check_failed("Named resident attribute "
539 "with value before name.\n");
540 }
541 // if resident, length==value_length+value_offset
542 //assert_u32_equal(le32_to_cpu(attr_rec->value_length)+
543 // value_offset, length,
544 // "length==value_length+value_offset");
545 // if resident, length==value_length+value_offset
546 if (value_length+value_offset > length) {
547 check_failed("value_length(%d)+value_offset(%d)>length(%d) for attribute 0x%x.\n", (int)value_length, (int)value_offset, (int)length, (int)attr_type);
548 return NULL;
549 }
550
551 // Check resident_flags.
552 if (attr_rec->resident_flags>0x01) {
553 check_failed("Unknown resident flags (0x%x) for attribute 0x%x.\n", (int)attr_rec->resident_flags, (int)attr_type);
554 } else if (attr_rec->resident_flags && (attr_type!=0x30)) {
555 check_failed("Resident flags mark attribute 0x%x as indexed.\n", (int)attr_type);
556 }
557
558 // reservedR is 0.
559 assert_u32_equal(attr_rec->reservedR, 0, "Resident Reserved");
560
561 // todo: attribute must not be 0xa0 (not sure about 0xb0, 0xe0, 0xf0)
562 // todo: check content well-formness per attr_type.
563 }
564 return 0;
565 check_attr_record_next_attr:
566 return (ATTR_REC *)(((u8 *)attr_rec) + length);
567 }
568
569 /**
570 * All checks that can be satisfied only by data from the buffer.
571 * No other [MFT records/metadata files] are required.
572 *
573 * The buffer is changed by removing the Update Sequence.
574 *
575 * Return:
576 * 0 Everything's cool.
577 * else Consider this record as damaged.
578 */
check_file_record(u8 * buffer,u16 buflen)579 static BOOL check_file_record(u8 *buffer, u16 buflen)
580 {
581 u16 usa_count, usa_ofs, attrs_offset, usa;
582 u32 bytes_in_use, bytes_allocated, i;
583 MFT_RECORD *mft_rec = (MFT_RECORD *)buffer;
584 ATTR_REC *attr_rec;
585
586 // check record magic
587 assert_u32_equal(le32_to_cpu(mft_rec->magic), le32_to_cpu(magic_FILE), "FILE record magic");
588 // todo: records 16-23 must be filled in order.
589 // todo: what to do with magic_BAAD?
590
591 // check usa_count+offset to update seq <= attrs_offset <
592 // bytes_in_use <= bytes_allocated <= buflen.
593 usa_ofs = le16_to_cpu(mft_rec->usa_ofs);
594 usa_count = le16_to_cpu(mft_rec->usa_count);
595 attrs_offset = le16_to_cpu(mft_rec->attrs_offset);
596 bytes_in_use = le32_to_cpu(mft_rec->bytes_in_use);
597 bytes_allocated = le32_to_cpu(mft_rec->bytes_allocated);
598 if (assert_u32_lesseq(usa_ofs+usa_count, attrs_offset,
599 "usa_ofs+usa_count <= attrs_offset") ||
600 assert_u32_less(attrs_offset, bytes_in_use,
601 "attrs_offset < bytes_in_use") ||
602 assert_u32_lesseq(bytes_in_use, bytes_allocated,
603 "bytes_in_use <= bytes_allocated") ||
604 assert_u32_lesseq(bytes_allocated, buflen,
605 "bytes_allocated <= max_record_size")) {
606 return 1;
607 }
608
609
610 // We should know all the flags.
611 if (le16_to_cpu(mft_rec->flags) > 0xf) {
612 check_failed("Unknown MFT record flags (0x%x).\n",
613 (unsigned int)le16_to_cpu(mft_rec->flags));
614 }
615 // todo: flag in_use must be on.
616
617 // Remove update seq & check it.
618 usa = *(u16*)(buffer+usa_ofs); // The value that should be at the end of every sector.
619 if (assert_u32_equal(usa_count-1, buflen/NTFS_BLOCK_SIZE, "USA length"))
620 return (1);
621 for (i=1;i<usa_count;i++) {
622 u16 *fixup = (u16*)(buffer+NTFS_BLOCK_SIZE*i-2); // the value at the end of the sector.
623 u16 saved_val = *(u16*)(buffer+usa_ofs+2*i); // the actual data value that was saved in the us array.
624
625 assert_u32_equal(*fixup, usa, "fixup");
626 *fixup = saved_val; // remove it.
627 }
628
629 attr_rec = (ATTR_REC *)(buffer + attrs_offset);
630 while ((u8*)attr_rec<=buffer+buflen-4) {
631
632 // Check attribute record. (Only what is in the buffer)
633 if (attr_rec->type==AT_END) {
634 // Done.
635 return 0;
636 }
637 if ((u8*)attr_rec>buffer+buflen-8) {
638 // not AT_END yet no room for the length field.
639 check_failed("Attribute 0x%x is not AT_END, yet no "
640 "room for the length field.\n",
641 (int)le32_to_cpu(attr_rec->type));
642 return 1;
643 }
644
645 attr_rec = check_attr_record(attr_rec, mft_rec, buflen);
646 if (!attr_rec)
647 return 1;
648 }
649 // If we got here, there was an overflow.
650 return 1;
651
652 // todo: an attribute should be at the offset to first attribute, and the offset should be inside the buffer. It should have the value of "next attribute id".
653 // todo: if base record, it should start with attribute 0x10.
654
655 // Highlevel check of attributes.
656 // todo: Attributes are well-formed.
657 // todo: Room for next attribute in the end of the previous record.
658
659 return FALSE;
660 }
661
replay_log(ntfs_volume * vol)662 static void replay_log(ntfs_volume *vol __attribute__((unused)))
663 {
664 // At this time, only check that the log is fully replayed.
665 ntfs_log_warning("Unsupported: replay_log()\n");
666 // todo: if logfile is clean, return success.
667 unsupported++;
668 }
669
verify_mft_record(ntfs_volume * vol,s64 mft_num)670 static void verify_mft_record(ntfs_volume *vol, s64 mft_num)
671 {
672 u8 *buffer;
673 int is_used;
674
675 current_mft_record = mft_num;
676
677 is_used = mft_bitmap_get_bit(mft_num);
678 if (is_used<0) {
679 ntfs_log_error("Error getting bit value for record %lld.\n",
680 (long long)mft_num);
681 } else if (!is_used) {
682 ntfs_log_verbose("Record %lld unused. Skipping.\n",
683 (long long)mft_num);
684 return;
685 }
686
687 buffer = ntfs_malloc(vol->mft_record_size);
688 if (!buffer)
689 goto verify_mft_record_error;
690
691 ntfs_log_verbose("MFT record %lld\n", (long long)mft_num);
692 if (ntfs_attr_pread(vol->mft_na, mft_num*vol->mft_record_size, vol->mft_record_size, buffer) < 0) {
693 ntfs_log_perror("Couldn't read $MFT record %lld", (long long)mft_num);
694 goto verify_mft_record_error;
695 }
696
697 check_file_record(buffer, vol->mft_record_size);
698 // todo: if offset to first attribute >= 0x30, number of mft record should match.
699 // todo: Match the "record is used" with the mft bitmap.
700 // todo: if this is not base, check that the parent is a base, and is in use, and pointing to this record.
701
702 // todo: if base record: for each extent record:
703 // todo: verify_file_record
704 // todo: hard link count should be the number of 0x30 attributes.
705 // todo: Order of attributes.
706 // todo: make sure compression_unit is the same.
707
708 return;
709 verify_mft_record_error:
710
711 if (buffer)
712 free(buffer);
713 errors++;
714 }
715
716 /**
717 * This function serves as bootstraping for the more comprehensive checks.
718 * It will load the MFT runlist and MFT/Bitmap runlist.
719 * It should not depend on other checks or we may have a circular dependancy.
720 * Also, this loadng must be forgiving, unlike the comprehensive checks.
721 */
verify_mft_preliminary(ntfs_volume * rawvol)722 static int verify_mft_preliminary(ntfs_volume *rawvol)
723 {
724 current_mft_record = 0;
725 s64 mft_offset, mftmirr_offset;
726 int res;
727
728 ntfs_log_trace("Entering verify_mft_preliminary().\n");
729 // todo: get size_of_file_record from boot sector
730 // Load the first segment of the $MFT/DATA runlist.
731 mft_offset = rawvol->mft_lcn * rawvol->cluster_size;
732 mftmirr_offset = rawvol->mftmirr_lcn * rawvol->cluster_size;
733 mft_rl = load_runlist(rawvol, mft_offset, AT_DATA, 1024);
734 if (!mft_rl) {
735 check_failed("Loading $MFT runlist failed. Trying $MFTMirr.\n");
736 mft_rl = load_runlist(rawvol, mftmirr_offset, AT_DATA, 1024);
737 }
738 if (!mft_rl) {
739 check_failed("Loading $MFTMirr runlist failed too. Aborting.\n");
740 return RETURN_FS_ERRORS_LEFT_UNCORRECTED | RETURN_OPERATIONAL_ERROR;
741 }
742 // TODO: else { recover $MFT } // Use $MFTMirr to recover $MFT.
743 // todo: support loading the next runlist extents when ATTRIBUTE_LIST is used on $MFT.
744 // If attribute list: Gradually load mft runlist. (parse runlist from first file record, check all referenced file records, continue with the next file record). If no attribute list, just load it.
745
746 // Load the runlist of $MFT/Bitmap.
747 // todo: what about ATTRIBUTE_LIST? Can we reuse code?
748 mft_bitmap_rl = load_runlist(rawvol, mft_offset, AT_BITMAP, 1024);
749 if (!mft_bitmap_rl) {
750 check_failed("Loading $MFT/Bitmap runlist failed. Trying $MFTMirr.\n");
751 mft_bitmap_rl = load_runlist(rawvol, mftmirr_offset, AT_BITMAP, 1024);
752 }
753 if (!mft_bitmap_rl) {
754 check_failed("Loading $MFTMirr/Bitmap runlist failed too. Aborting.\n");
755 return RETURN_FS_ERRORS_LEFT_UNCORRECTED;
756 // todo: rebuild the bitmap by using the "in_use" file record flag or by filling it with 1's.
757 }
758
759 /* Load $MFT/Bitmap */
760 if ((res = mft_bitmap_load(rawvol)))
761 return res;
762 return -1; /* FIXME: Just added to fix compiler warning without
763 thinking about what should be here. (Yura) */
764 }
765
check_volume(ntfs_volume * vol)766 static void check_volume(ntfs_volume *vol)
767 {
768 s64 mft_num, nr_mft_records;
769
770 ntfs_log_warning("Unsupported: check_volume()\n");
771 unsupported++;
772
773 // For each mft record, verify that it contains a valid file record.
774 nr_mft_records = vol->mft_na->initialized_size >>
775 vol->mft_record_size_bits;
776 ntfs_log_info("Checking %lld MFT records.\n", (long long)nr_mft_records);
777
778 for (mft_num=0; mft_num < nr_mft_records; mft_num++) {
779 verify_mft_record(vol, mft_num);
780 }
781
782 // todo: Check metadata files.
783
784 // todo: Second pass on mft records. Now check the contents as well.
785 // todo: When going through runlists, build a bitmap.
786
787 // todo: cluster accounting.
788 return;
789 }
790
reset_dirty(ntfs_volume * vol)791 static int reset_dirty(ntfs_volume *vol)
792 {
793 le16 flags;
794
795 if (!(vol->flags | VOLUME_IS_DIRTY))
796 return 0;
797
798 ntfs_log_verbose("Resetting dirty flag.\n");
799
800 flags = vol->flags & ~VOLUME_IS_DIRTY;
801
802 if (ntfs_volume_write_flags(vol, flags)) {
803 ntfs_log_error("Error setting volume flags.\n");
804 return -1;
805 }
806 return 0;
807 }
808
809 /**
810 * main - Does just what C99 claim it does.
811 *
812 * For more details on arguments and results, check the man page.
813 */
main(int argc,char ** argv)814 int main(int argc, char **argv)
815 {
816 struct ntfs_device *dev;
817 ntfs_volume rawvol;
818 ntfs_volume *vol;
819 const char *name;
820 int ret;
821
822 if (argc != 2)
823 return RETURN_USAGE_OR_SYNTAX_ERROR;
824 name = argv[1];
825
826 ntfs_log_set_handler(ntfs_log_handler_outerr);
827 //ntfs_log_set_levels(NTFS_LOG_LEVEL_DEBUG | NTFS_LOG_LEVEL_TRACE | NTFS_LOG_LEVEL_QUIET | NTFS_LOG_LEVEL_INFO | NTFS_LOG_LEVEL_VERBOSE | NTFS_LOG_LEVEL_PROGRESS);
828
829 /* Allocate an ntfs_device structure. */
830 dev = ntfs_device_alloc(name, 0, &ntfs_device_default_io_ops, NULL);
831 if (!dev)
832 return RETURN_OPERATIONAL_ERROR;
833 if (dev->d_ops->open(dev, O_RDONLY)) { //O_RDWR/O_RDONLY?
834 ntfs_log_perror("Error opening partition device");
835 ntfs_device_free(dev);
836 return RETURN_OPERATIONAL_ERROR;
837 }
838
839 if ((ret = verify_boot_sector(dev,&rawvol))) {
840 dev->d_ops->close(dev);
841 return ret;
842 }
843 ntfs_log_verbose("Boot sector verification complete. Proceeding to $MFT");
844
845 verify_mft_preliminary(&rawvol);
846
847 /* ntfs_device_mount() expects the device to be closed. */
848 if (dev->d_ops->close(dev))
849 ntfs_log_perror("Failed to close the device.");
850
851 // at this point we know that the volume is valid enough for mounting.
852
853 /* Call ntfs_device_mount() to do the actual mount. */
854 vol = ntfs_device_mount(dev, NTFS_MNT_RDONLY);
855 if (!vol) {
856 ntfs_device_free(dev);
857 return 2;
858 }
859
860 replay_log(vol);
861
862 if (vol->flags & VOLUME_IS_DIRTY)
863 ntfs_log_warning("Volume is dirty.\n");
864
865 check_volume(vol);
866
867 if (errors)
868 ntfs_log_info("Errors found.\n");
869 if (unsupported)
870 ntfs_log_info("Unsupported cases found.\n");
871
872 if (!errors && !unsupported) {
873 reset_dirty(vol);
874 }
875
876 ntfs_umount(vol, FALSE);
877
878 if (errors)
879 return 2;
880 if (unsupported)
881 return 1;
882 return 0;
883 }
884
885