| /** |
| * ntfsclone - Part of the Linux-NTFS project. |
| * |
| * Copyright (c) 2003-2006 Szabolcs Szakacsits |
| * Copyright (c) 2004-2006 Anton Altaparmakov |
| * Copyright (c) 2010-2012 Jean-Pierre Andre |
| * Special image format support copyright (c) 2004 Per Olofsson |
| * |
| * Clone NTFS data and/or metadata to a sparse file, image, device or stdout. |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU General Public License as published by |
| * the Free Software Foundation; either version 2 of the License, or |
| * (at your option) any later version. |
| */ |
| |
| #include "config.h" |
| |
| #ifdef HAVE_UNISTD_H |
| #include <unistd.h> |
| #endif |
| #ifdef HAVE_STDLIB_H |
| #include <stdlib.h> |
| #endif |
| #ifdef HAVE_STDIO_H |
| #include <stdio.h> |
| #endif |
| #ifdef HAVE_SYS_TYPES_H |
| #include <sys/types.h> |
| #endif |
| #ifdef HAVE_SYS_STAT_H |
| #include <sys/stat.h> |
| #endif |
| #ifdef HAVE_TIME_H |
| #include <time.h> |
| #endif |
| #ifdef HAVE_SYS_IOCTL_H |
| #include <sys/ioctl.h> |
| #endif |
| #ifdef HAVE_SYS_VFS_H |
| #include <sys/vfs.h> |
| #endif |
| #ifdef HAVE_SYS_STATVFS_H |
| #include <sys/statvfs.h> |
| #endif |
| #ifdef HAVE_FCNTL_H |
| #include <fcntl.h> |
| #endif |
| #ifdef HAVE_STDARG_H |
| #include <stdarg.h> |
| #endif |
| #ifdef HAVE_STRING_H |
| #include <string.h> |
| #endif |
| #ifdef HAVE_ERRNO_H |
| #include <errno.h> |
| #endif |
| #ifdef HAVE_GETOPT_H |
| #include <getopt.h> |
| #endif |
| #ifdef HAVE_UNISTD_H |
| #include <unistd.h> |
| #endif |
| |
| /* |
| * FIXME: ntfsclone do bad things about endians handling. Fix it and remove |
| * this note and define. |
| */ |
| #define NTFS_DO_NOT_CHECK_ENDIANS |
| |
| #include "debug.h" |
| #include "types.h" |
| #include "support.h" |
| #include "endians.h" |
| #include "bootsect.h" |
| #include "device.h" |
| #include "attrib.h" |
| #include "mst.h" |
| #include "volume.h" |
| #include "mft.h" |
| #include "bitmap.h" |
| #include "inode.h" |
| #include "index.h" |
| #include "dir.h" |
| #include "runlist.h" |
| #include "ntfstime.h" |
| #include "utils.h" |
| /* #include "version.h" */ |
| #include "misc.h" |
| |
| #if defined(linux) && defined(_IO) && !defined(BLKGETSIZE) |
| #define BLKGETSIZE _IO(0x12,96) /* Get device size in 512-byte blocks. */ |
| #endif |
| #if defined(linux) && defined(_IOR) && !defined(BLKGETSIZE64) |
| #define BLKGETSIZE64 _IOR(0x12,114,size_t) /* Get device size in bytes. */ |
| #endif |
| |
| #ifdef __sun |
| #define NO_STATFS 1 /* statfs(2) and f_type are not universal */ |
| #endif |
| |
| static const char *EXEC_NAME = "ntfsclone"; |
| |
| static const char *bad_sectors_warning_msg = |
| "*************************************************************************\n" |
| "* WARNING: The disk has one or more bad sectors. This means that damage *\n" |
| "* has occurred on the disk surface, possibly caused by deterioration of *\n" |
| "* the physical media, manufacturing faults or other reasons. The *\n" |
| "* reliability of the disk may stay stable or degrade fast. *\n" |
| "* Use the --rescue option to efficiently save as much data as possible! *\n" |
| "*************************************************************************\n"; |
| |
| static const char *dirty_volume_msg = |
| "Volume '%s' is scheduled for a check or it was shutdown \n" |
| "uncleanly. Please boot Windows or use the --force option to progress.\n"; |
| |
| static struct { |
| int verbose; |
| int quiet; |
| int debug; |
| int force; |
| int overwrite; |
| int std_out; |
| int blkdev_out; /* output file is block device */ |
| int metadata; /* metadata only cloning */ |
| int ignore_fs_check; |
| int rescue; |
| int save_image; |
| int new_serial; |
| int metadata_image; |
| int preserve_timestamps; |
| int restore_image; |
| char *output; |
| char *volume; |
| #ifndef NO_STATFS |
| struct statfs stfs; |
| #endif |
| } opt; |
| |
| struct bitmap { |
| s64 size; |
| u8 *bm; |
| }; |
| |
| struct progress_bar { |
| u64 start; |
| u64 stop; |
| int resolution; |
| float unit; |
| }; |
| |
| typedef struct { |
| ntfs_inode *ni; /* inode being processed */ |
| ntfs_attr_search_ctx *ctx; /* inode attribute being processed */ |
| s64 inuse; /* number of clusters in use */ |
| LCN current_lcn; |
| } ntfs_walk_clusters_ctx; |
| |
| typedef int (ntfs_walk_op)(ntfs_inode *ni, void *data); |
| |
| struct ntfs_walk_cluster { |
| ntfs_walk_op *inode_op; /* not implemented yet */ |
| ntfs_walk_clusters_ctx *image; |
| }; |
| |
| |
| static ntfs_volume *vol = NULL; |
| static struct bitmap lcn_bitmap; |
| |
| static int fd_in; |
| static int fd_out; |
| static FILE *stream_out = (FILE*)NULL; |
| static FILE *msg_out = NULL; |
| |
| static int wipe = 0; |
| static unsigned int nr_used_mft_records = 0; |
| static unsigned int wiped_unused_mft_data = 0; |
| static unsigned int wiped_unused_mft = 0; |
| static unsigned int wiped_resident_data = 0; |
| static unsigned int wiped_timestamp_data = 0; |
| |
| static le64 volume_serial_number; /* new random serial number */ |
| static u64 full_device_size; /* full size, including the backup boot sector */ |
| |
| static BOOL image_is_host_endian = FALSE; |
| |
| #define IMAGE_MAGIC "\0ntfsclone-image" |
| #define IMAGE_MAGIC_SIZE 16 |
| #define IMAGE_OFFSET_OFFSET 46 /* must be the same for all versions ! */ |
| #define IMAGE_HDR_ALIGN 8 /* alignment wanted after header */ |
| |
| /* This is the first endianness safe format version. */ |
| #define NTFSCLONE_IMG_VER_MAJOR_ENDIANNESS_SAFE 10 |
| #define NTFSCLONE_IMG_VER_MINOR_ENDIANNESS_SAFE 0 |
| |
| /* |
| * Set the version to 10.0 to avoid colisions with old ntfsclone which |
| * stupidly used the volume version as the image version... )-: I hope NTFS |
| * never reaches version 10.0 and if it does one day I hope no-one is using |
| * such an old ntfsclone by then... |
| * |
| * NOTE: Only bump the minor version if the image format and header are still |
| * backwards compatible. Otherwise always bump the major version. If in |
| * doubt, bump the major version. |
| * |
| * Moved to 10.1 : Alternate boot sector now saved. Still compatible. |
| */ |
| #define NTFSCLONE_IMG_VER_MAJOR 10 |
| #define NTFSCLONE_IMG_VER_MINOR 1 |
| |
| /* All values are in little endian. */ |
| static struct image_hdr { |
| char magic[IMAGE_MAGIC_SIZE]; |
| u8 major_ver; |
| u8 minor_ver; |
| /* the following is aligned dangerously (too late...) */ |
| le32 cluster_size; |
| le64 device_size; |
| sle64 nr_clusters; |
| le64 inuse; |
| le32 offset_to_image_data; /* From start of image_hdr. */ |
| } __attribute__((__packed__)) image_hdr; |
| |
| #define NTFSCLONE_IMG_HEADER_SIZE_OLD \ |
| (offsetof(struct image_hdr, offset_to_image_data)) |
| |
| #define NTFS_MBYTE (1000 * 1000) |
| |
| #define ERR_PREFIX "ERROR" |
| #define PERR_PREFIX ERR_PREFIX "(%d): " |
| #define NERR_PREFIX ERR_PREFIX ": " |
| |
| #define LAST_METADATA_INODE 11 |
| |
| #define NTFS_MAX_CLUSTER_SIZE 65536 |
| #define NTFS_SECTOR_SIZE 512 |
| |
| #define rounded_up_division(a, b) (((a) + (b - 1)) / (b)) |
| |
| #define read_all(f, p, n) io_all((f), (p), (n), 0) |
| #define write_all(f, p, n) io_all((f), (p), (n), 1) |
| |
| __attribute__((format(printf, 1, 2))) |
| static void Printf(const char *fmt, ...) |
| { |
| va_list ap; |
| |
| va_start(ap, fmt); |
| vfprintf(msg_out, fmt, ap); |
| va_end(ap); |
| fflush(msg_out); |
| } |
| |
| __attribute__((format(printf, 1, 2))) |
| static void perr_printf(const char *fmt, ...) |
| { |
| va_list ap; |
| int eo = errno; |
| |
| Printf(PERR_PREFIX, eo); |
| va_start(ap, fmt); |
| vfprintf(msg_out, fmt, ap); |
| va_end(ap); |
| Printf(": %s\n", strerror(eo)); |
| fflush(msg_out); |
| } |
| |
| __attribute__((format(printf, 1, 2))) |
| static void err_printf(const char *fmt, ...) |
| { |
| va_list ap; |
| |
| Printf(NERR_PREFIX); |
| va_start(ap, fmt); |
| vfprintf(msg_out, fmt, ap); |
| va_end(ap); |
| fflush(msg_out); |
| } |
| |
| __attribute__((noreturn)) |
| __attribute__((format(printf, 1, 2))) |
| static void err_exit(const char *fmt, ...) |
| { |
| va_list ap; |
| |
| Printf(NERR_PREFIX); |
| va_start(ap, fmt); |
| vfprintf(msg_out, fmt, ap); |
| va_end(ap); |
| fflush(msg_out); |
| if (vol) |
| ntfs_umount(vol,FALSE); |
| exit(1); |
| } |
| |
| __attribute__((noreturn)) |
| __attribute__((format(printf, 1, 2))) |
| static void perr_exit(const char *fmt, ...) |
| { |
| va_list ap; |
| int eo = errno; |
| |
| Printf(PERR_PREFIX, eo); |
| va_start(ap, fmt); |
| vfprintf(msg_out, fmt, ap); |
| va_end(ap); |
| Printf(": %s\n", strerror(eo)); |
| fflush(msg_out); |
| if (vol) |
| ntfs_umount(vol,FALSE); |
| exit(1); |
| } |
| |
| |
| __attribute__((noreturn)) |
| static void usage(void) |
| { |
| fprintf(stderr, "\nUsage: %s [OPTIONS] SOURCE\n" |
| " Efficiently clone NTFS to a sparse file, image, device or standard output.\n" |
| "\n" |
| " -o, --output FILE Clone NTFS to the non-existent FILE\n" |
| " -O, --overwrite FILE Clone NTFS to FILE, overwriting if exists\n" |
| " -s, --save-image Save to the special image format\n" |
| " -r, --restore-image Restore from the special image format\n" |
| " --rescue Continue after disk read errors\n" |
| " -m, --metadata Clone *only* metadata (for NTFS experts)\n" |
| " --ignore-fs-check Ignore the filesystem check result\n" |
| " --new-serial Set a new serial number\n" |
| " --new-half-serial Set a partial new serial number\n" |
| " -t, --preserve-timestamps Do not clear the timestamps\n" |
| " -q, --quiet Do not display any progress bars\n" |
| " -f, --force Force to progress (DANGEROUS)\n" |
| " -h, --help Display this help\n" |
| #ifdef DEBUG |
| " -d, --debug Show debug information\n" |
| #endif |
| "\n" |
| " If FILE is '-' then send the image to the standard output. If SOURCE is '-'\n" |
| " and --restore-image is used then read the image from the standard input.\n" |
| "\n", EXEC_NAME); |
| fprintf(stderr, "%s%s", ntfs_bugs, ntfs_home); |
| exit(1); |
| } |
| |
| static void parse_options(int argc, char **argv) |
| { |
| static const char *sopt = "-dfhmo:O:qrst"; |
| static const struct option lopt[] = { |
| #ifdef DEBUG |
| { "debug", no_argument, NULL, 'd' }, |
| #endif |
| { "quiet", no_argument, NULL, 'q' }, |
| { "force", no_argument, NULL, 'f' }, |
| { "help", no_argument, NULL, 'h' }, |
| { "metadata", no_argument, NULL, 'm' }, |
| { "output", required_argument, NULL, 'o' }, |
| { "overwrite", required_argument, NULL, 'O' }, |
| { "restore-image", no_argument, NULL, 'r' }, |
| { "ignore-fs-check", no_argument, NULL, 'C' }, |
| { "rescue", no_argument, NULL, 'R' }, |
| { "new-serial", no_argument, NULL, 'I' }, |
| { "new-half-serial", no_argument, NULL, 'i' }, |
| { "save-image", no_argument, NULL, 's' }, |
| { "preserve-timestamps", no_argument, NULL, 't' }, |
| { NULL, 0, NULL, 0 } |
| }; |
| |
| int c; |
| |
| memset(&opt, 0, sizeof(opt)); |
| |
| while ((c = getopt_long(argc, argv, sopt, lopt, NULL)) != -1) { |
| switch (c) { |
| case 1: /* A non-option argument */ |
| if (opt.volume) |
| usage(); |
| opt.volume = argv[optind-1]; |
| break; |
| case 'd': |
| opt.debug++; |
| break; |
| case 'q': |
| opt.quiet++; |
| break; |
| case 'f': |
| opt.force++; |
| break; |
| case 'h': |
| case '?': |
| usage(); |
| case 'i': /* not proposed as a short option */ |
| opt.new_serial |= 1; |
| break; |
| case 'I': /* not proposed as a short option */ |
| opt.new_serial |= 2; |
| break; |
| case 'm': |
| opt.metadata++; |
| break; |
| case 'O': |
| opt.overwrite++; |
| case 'o': |
| if (opt.output) |
| usage(); |
| opt.output = optarg; |
| break; |
| case 'r': |
| opt.restore_image++; |
| break; |
| case 'C': |
| opt.ignore_fs_check++; |
| break; |
| case 'R': |
| opt.rescue++; |
| break; |
| case 's': |
| opt.save_image++; |
| break; |
| case 't': |
| opt.preserve_timestamps++; |
| break; |
| default: |
| err_printf("Unknown option '%s'.\n", argv[optind-1]); |
| usage(); |
| } |
| } |
| |
| if (opt.output == NULL) { |
| err_printf("You must specify an output file.\n"); |
| usage(); |
| } |
| |
| if (strcmp(opt.output, "-") == 0) |
| opt.std_out++; |
| |
| if (opt.volume == NULL) { |
| err_printf("You must specify a device file.\n"); |
| usage(); |
| } |
| |
| if (opt.metadata && opt.save_image) { |
| opt.metadata_image++; |
| opt.save_image = 0; |
| } |
| |
| if (opt.metadata && opt.restore_image) |
| err_exit("Restoring only metadata from an image is not " |
| "supported!\n"); |
| |
| if (opt.metadata && !opt.metadata_image && opt.std_out) |
| err_exit("Cloning only metadata to stdout isn't supported!\n"); |
| |
| if (opt.ignore_fs_check && !opt.metadata) |
| err_exit("Filesystem check can be ignored only for metadata " |
| "cloning!\n"); |
| |
| if (opt.save_image && opt.restore_image) |
| err_exit("Saving and restoring an image at the same time " |
| "is not supported!\n"); |
| |
| if (!opt.std_out) { |
| struct stat st; |
| |
| if (stat(opt.output, &st) == -1) { |
| if (errno != ENOENT) |
| perr_exit("Couldn't access '%s'", opt.output); |
| } else { |
| if (!opt.overwrite) |
| err_exit("Output file '%s' already exists.\n" |
| "Use option --overwrite if you want to" |
| " replace its content.\n", opt.output); |
| |
| if (S_ISBLK(st.st_mode)) { |
| opt.blkdev_out = 1; |
| if (opt.metadata && !opt.force) |
| err_exit("Cloning only metadata to a " |
| "block device does not usually " |
| "make sense, aborting...\n" |
| "If you were instructed to do " |
| "this by a developer and/or are " |
| "sure that this is what you want " |
| "to do, run this utility again " |
| "but this time add the force " |
| "option, i.e. add '--force' to " |
| "the command line arguments."); |
| } |
| } |
| } |
| |
| msg_out = stdout; |
| |
| /* FIXME: this is a workaround for losing debug info if stdout != stderr |
| and for the uncontrollable verbose messages in libntfs. Ughhh. */ |
| if (opt.std_out) |
| msg_out = stderr; |
| else if (opt.debug) { |
| /* Redirect stderr to stdout, note fflush()es are essential! */ |
| fflush(stdout); |
| fflush(stderr); |
| if (dup2(STDOUT_FILENO, STDERR_FILENO) == -1) { |
| perror("Failed to redirect stderr to stdout"); |
| exit(1); |
| } |
| fflush(stdout); |
| fflush(stderr); |
| } else { |
| fflush(stderr); |
| if (!freopen("/dev/null", "w", stderr)) |
| perr_exit("Failed to redirect stderr to /dev/null"); |
| } |
| } |
| |
| /* |
| * Initialize the random number generator with the current |
| * time, and generate a 64-bit random number for the serial |
| * number |
| */ |
| static void generate_serial_number(void) { |
| u64 sn; |
| |
| /* different values for parallel processes */ |
| srandom(time((time_t*)NULL) ^ (getpid() << 16)); |
| sn = ((u64)random() << 32) | ((u64)random() & 0xffffffff); |
| volume_serial_number = cpu_to_le64(sn); |
| } |
| |
| static void progress_init(struct progress_bar *p, u64 start, u64 stop, int res) |
| { |
| p->start = start; |
| p->stop = stop; |
| p->unit = 100.0 / (stop - start); |
| p->resolution = res; |
| } |
| |
| |
| static void progress_update(struct progress_bar *p, u64 current) |
| { |
| float percent = p->unit * current; |
| |
| if (opt.quiet) |
| return; |
| |
| if (current != p->stop) { |
| if ((current - p->start) % p->resolution) |
| return; |
| Printf("%6.2f percent completed\r", percent); |
| } else |
| Printf("100.00 percent completed\n"); |
| fflush(msg_out); |
| } |
| |
| static s64 is_critical_metadata(ntfs_walk_clusters_ctx *image, runlist *rl) |
| { |
| s64 inode = image->ni->mft_no; |
| |
| if (inode <= LAST_METADATA_INODE) { |
| |
| /* Don't save bad sectors (both $Bad and unnamed are ignored */ |
| if (inode == FILE_BadClus && image->ctx->attr->type == AT_DATA) |
| return 0; |
| |
| if (inode != FILE_LogFile) |
| return rl->length; |
| |
| if (image->ctx->attr->type == AT_DATA) { |
| |
| /* Save at least the first 16 KiB of FILE_LogFile */ |
| s64 s = (s64)16384 - rl->vcn * vol->cluster_size; |
| if (s > 0) { |
| s = rounded_up_division(s, vol->cluster_size); |
| if (rl->length < s) |
| s = rl->length; |
| return s; |
| } |
| return 0; |
| } |
| } |
| |
| if (image->ctx->attr->type != AT_DATA) |
| return rl->length; |
| |
| return 0; |
| } |
| |
| |
| static int io_all(void *fd, void *buf, int count, int do_write) |
| { |
| int i; |
| struct ntfs_device *dev = fd; |
| |
| while (count > 0) { |
| if (do_write) { |
| if (opt.save_image || opt.metadata_image) |
| i = fwrite(buf, 1, count, stream_out); |
| else |
| i = write(*(int *)fd, buf, count); |
| } else if (opt.restore_image) |
| i = read(*(int *)fd, buf, count); |
| else |
| i = dev->d_ops->read(dev, buf, count); |
| if (i < 0) { |
| if (errno != EAGAIN && errno != EINTR) |
| return -1; |
| } else if (i == 0 && !do_write && opt.restore_image) { |
| return -1; |
| } else { |
| count -= i; |
| buf = i + (char *) buf; |
| } |
| } |
| return 0; |
| } |
| |
| |
| static void rescue_sector(void *fd, off_t pos, void *buff) |
| { |
| const char *badsector_magic = "BadSectoR\0"; |
| struct ntfs_device *dev = fd; |
| |
| if (opt.restore_image) { |
| if (lseek(*(int *)fd, pos, SEEK_SET) == (off_t)-1) |
| perr_exit("lseek"); |
| } else { |
| if (vol->dev->d_ops->seek(dev, pos, SEEK_SET) == (off_t)-1) |
| perr_exit("seek input"); |
| } |
| |
| if (read_all(fd, buff, NTFS_SECTOR_SIZE) == -1) { |
| Printf("WARNING: Can't read sector at %llu, lost data.\n", |
| (unsigned long long)pos); |
| memset(buff, '?', NTFS_SECTOR_SIZE); |
| memmove(buff, badsector_magic, sizeof(badsector_magic)); |
| } |
| } |
| |
| /* |
| * Read a cluster, try to rescue if cannot read |
| */ |
| |
| static void read_rescue(void *fd, char *buff, u32 csize, u64 rescue_lcn) |
| { |
| off_t rescue_pos; |
| |
| if (read_all(fd, buff, csize) == -1) { |
| |
| if (errno != EIO) |
| perr_exit("read_all"); |
| else if (opt.rescue){ |
| u32 i; |
| |
| rescue_pos = (off_t)(rescue_lcn * csize); |
| for (i = 0; i < csize; i += NTFS_SECTOR_SIZE) |
| rescue_sector(fd, rescue_pos + i, buff + i); |
| } else { |
| Printf("%s", bad_sectors_warning_msg); |
| err_exit("Disk is faulty, can't make full backup!"); |
| } |
| } |
| } |
| |
| static void copy_cluster(int rescue, u64 rescue_lcn, u64 lcn) |
| { |
| char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */ |
| /* vol is NULL if opt.restore_image is set */ |
| s32 csize = le32_to_cpu(image_hdr.cluster_size); |
| BOOL backup_bootsector; |
| void *fd = (void *)&fd_in; |
| off_t rescue_pos; |
| NTFS_BOOT_SECTOR *bs; |
| le64 mask; |
| static u16 bytes_per_sector; |
| |
| if (!opt.restore_image) { |
| csize = vol->cluster_size; |
| fd = vol->dev; |
| } |
| |
| rescue_pos = (off_t)(rescue_lcn * csize); |
| |
| /* possible partial cluster holding the backup boot sector */ |
| backup_bootsector = (lcn + 1)*csize >= full_device_size; |
| if (backup_bootsector) { |
| csize = full_device_size - lcn*csize; |
| if (csize < 0) { |
| err_exit("Corrupted input, copy aborted"); |
| } |
| } |
| |
| // need reading when not about to write ? |
| if (read_all(fd, buff, csize) == -1) { |
| |
| if (errno != EIO) |
| perr_exit("read_all"); |
| else if (rescue){ |
| s32 i; |
| for (i = 0; i < csize; i += NTFS_SECTOR_SIZE) |
| rescue_sector(fd, rescue_pos + i, buff + i); |
| } else { |
| Printf("%s", bad_sectors_warning_msg); |
| err_exit("Disk is faulty, can't make full backup!"); |
| } |
| } |
| |
| /* Set the new serial number if requested */ |
| if (opt.new_serial |
| && !opt.save_image |
| && (!lcn || backup_bootsector)) { |
| /* |
| * For updating the backup boot sector, we need to |
| * know the sector size, but this is not recorded |
| * in the image header, so we collect it on the fly |
| * while reading the first boot sector. |
| */ |
| if (!lcn) { |
| bs = (NTFS_BOOT_SECTOR*)buff; |
| bytes_per_sector = le16_to_cpu(bs->bpb.bytes_per_sector); |
| if ((bytes_per_sector > csize) |
| || (bytes_per_sector < NTFS_SECTOR_SIZE)) |
| bytes_per_sector = NTFS_SECTOR_SIZE; |
| } else |
| bs = (NTFS_BOOT_SECTOR*)(buff |
| + csize - bytes_per_sector); |
| if (opt.new_serial & 2) |
| bs->volume_serial_number = volume_serial_number; |
| else { |
| mask = const_cpu_to_le64(~0x0ffffffffULL); |
| bs->volume_serial_number |
| = (volume_serial_number & mask) |
| | (bs->volume_serial_number & ~mask); |
| } |
| /* Show the new full serial after merging */ |
| if (!lcn) |
| Printf("New serial number : 0x%llx\n", |
| (long long)le64_to_cpu( |
| bs->volume_serial_number)); |
| } |
| |
| if (opt.save_image || (opt.metadata_image && wipe)) { |
| char cmd = 1; |
| if (write_all(&fd_out, &cmd, sizeof(cmd)) == -1) |
| perr_exit("write_all"); |
| } |
| |
| if ((!opt.metadata_image || wipe) |
| && (write_all(&fd_out, buff, csize) == -1)) { |
| #ifndef NO_STATFS |
| int err = errno; |
| perr_printf("Write failed"); |
| if (err == EIO && opt.stfs.f_type == 0x517b) |
| Printf("Apparently you tried to clone to a remote " |
| "Windows computer but they don't\nhave " |
| "efficient sparse file handling by default. " |
| "Please try a different method.\n"); |
| exit(1); |
| #else |
| perr_printf("Write failed"); |
| #endif |
| } |
| } |
| |
| static void lseek_to_cluster(s64 lcn) |
| { |
| off_t pos; |
| |
| pos = (off_t)(lcn * vol->cluster_size); |
| |
| if (vol->dev->d_ops->seek(vol->dev, pos, SEEK_SET) == (off_t)-1) |
| perr_exit("lseek input"); |
| |
| if (opt.std_out || opt.save_image || opt.metadata_image) |
| return; |
| |
| if (lseek(fd_out, pos, SEEK_SET) == (off_t)-1) |
| perr_exit("lseek output"); |
| } |
| |
| static void gap_to_cluster(s64 gap) |
| { |
| sle64 count; |
| char buf[1 + sizeof(count)]; |
| |
| if (gap) { |
| count = cpu_to_sle64(gap); |
| buf[0] = 0; |
| memcpy(&buf[1], &count, sizeof(count)); |
| if (write_all(&fd_out, buf, sizeof(buf)) == -1) |
| perr_exit("write_all"); |
| } |
| } |
| |
| static void image_skip_clusters(s64 count) |
| { |
| if (opt.save_image && count > 0) { |
| s64 count_buf; |
| char buff[1 + sizeof(count)]; |
| |
| buff[0] = 0; |
| count_buf = cpu_to_sle64(count); |
| memcpy(buff + 1, &count_buf, sizeof(count_buf)); |
| |
| if (write_all(&fd_out, buff, sizeof(buff)) == -1) |
| perr_exit("write_all"); |
| } |
| } |
| |
| static void write_image_hdr(void) |
| { |
| char alignment[IMAGE_HDR_ALIGN]; |
| |
| if (opt.save_image || opt.metadata_image) { |
| int alignsize = le32_to_cpu(image_hdr.offset_to_image_data) |
| - sizeof(image_hdr); |
| memset(alignment,0,IMAGE_HDR_ALIGN); |
| if ((alignsize < 0) |
| || write_all(&fd_out, &image_hdr, sizeof(image_hdr)) |
| || write_all(&fd_out, alignment, alignsize)) |
| perr_exit("write_all"); |
| } |
| } |
| |
| static void clone_ntfs(u64 nr_clusters) |
| { |
| u64 cl, last_cl; /* current and last used cluster */ |
| void *buf; |
| u32 csize = vol->cluster_size; |
| u64 p_counter = 0; |
| char alignment[IMAGE_HDR_ALIGN]; |
| struct progress_bar progress; |
| |
| if (opt.save_image) |
| Printf("Saving NTFS to image ...\n"); |
| else |
| Printf("Cloning NTFS ...\n"); |
| |
| if (opt.new_serial) |
| generate_serial_number(); |
| |
| buf = ntfs_calloc(csize); |
| if (!buf) |
| perr_exit("clone_ntfs"); |
| |
| progress_init(&progress, p_counter, nr_clusters, 100); |
| |
| if (opt.save_image) { |
| int alignsize = le32_to_cpu(image_hdr.offset_to_image_data) |
| - sizeof(image_hdr); |
| memset(alignment,0,IMAGE_HDR_ALIGN); |
| if ((alignsize < 0) |
| || write_all(&fd_out, &image_hdr, sizeof(image_hdr)) |
| || write_all(&fd_out, alignment, alignsize)) |
| perr_exit("write_all"); |
| } |
| |
| /* Examine up to the alternate boot sector */ |
| for (last_cl = cl = 0; cl <= (u64)vol->nr_clusters; cl++) { |
| |
| if (ntfs_bit_get(lcn_bitmap.bm, cl)) { |
| progress_update(&progress, ++p_counter); |
| lseek_to_cluster(cl); |
| image_skip_clusters(cl - last_cl - 1); |
| |
| copy_cluster(opt.rescue, cl, cl); |
| last_cl = cl; |
| continue; |
| } |
| |
| if (opt.std_out && !opt.save_image) { |
| progress_update(&progress, ++p_counter); |
| if (write_all(&fd_out, buf, csize) == -1) |
| perr_exit("write_all"); |
| } |
| } |
| image_skip_clusters(cl - last_cl - 1); |
| free(buf); |
| } |
| |
| static void write_empty_clusters(s32 csize, s64 count, |
| struct progress_bar *progress, u64 *p_counter) |
| { |
| s64 i; |
| char buff[NTFS_MAX_CLUSTER_SIZE]; |
| |
| memset(buff, 0, csize); |
| |
| for (i = 0; i < count; i++) { |
| if (write_all(&fd_out, buff, csize) == -1) |
| perr_exit("write_all"); |
| progress_update(progress, ++(*p_counter)); |
| } |
| } |
| |
| static void restore_image(void) |
| { |
| s64 pos = 0, count; |
| s32 csize = le32_to_cpu(image_hdr.cluster_size); |
| char cmd; |
| u64 p_counter = 0; |
| struct progress_bar progress; |
| |
| Printf("Restoring NTFS from image ...\n"); |
| |
| progress_init(&progress, p_counter, opt.std_out ? |
| sle64_to_cpu(image_hdr.nr_clusters) + 1 : |
| sle64_to_cpu(image_hdr.inuse) + 1, |
| 100); |
| |
| if (opt.new_serial) |
| generate_serial_number(); |
| |
| /* Restore up to the alternate boot sector */ |
| while (pos <= sle64_to_cpu(image_hdr.nr_clusters)) { |
| if (read_all(&fd_in, &cmd, sizeof(cmd)) == -1) { |
| if (pos == sle64_to_cpu(image_hdr.nr_clusters)) { |
| /* alternate boot sector no present in old images */ |
| Printf("Warning : no alternate boot" |
| " sector in image\n"); |
| break; |
| } else |
| perr_exit("read_all"); |
| } |
| |
| if (cmd == 0) { |
| if (!image_is_host_endian) { |
| le64 lecount; |
| |
| /* little endian image, on any computer */ |
| if (read_all(&fd_in, &lecount, |
| sizeof(lecount)) == -1) |
| perr_exit("read_all"); |
| count = sle64_to_cpu(lecount); |
| } else { |
| /* big endian image on big endian computer */ |
| if (read_all(&fd_in, &count, |
| sizeof(count)) == -1) |
| perr_exit("read_all"); |
| } |
| if (opt.std_out) { |
| if ((!p_counter && count) || (count < 0)) |
| err_exit("Cannot restore a metadata" |
| " image to stdout\n"); |
| else |
| write_empty_clusters(csize, count, |
| &progress, &p_counter); |
| } else { |
| if (((pos + count) < 0) |
| || ((pos + count) |
| > sle64_to_cpu(image_hdr.nr_clusters))) |
| err_exit("restore_image: corrupt image\n"); |
| else |
| if (lseek(fd_out, count * csize, |
| SEEK_CUR) == (off_t)-1) |
| perr_exit("restore_image: lseek"); |
| } |
| pos += count; |
| } else if (cmd == 1) { |
| copy_cluster(0, 0, pos); |
| pos++; |
| progress_update(&progress, ++p_counter); |
| } else |
| err_exit("Invalid command code in image\n"); |
| } |
| } |
| |
| static void wipe_index_entry_timestams(INDEX_ENTRY *e) |
| { |
| static const struct timespec zero_time = { .tv_sec = 0, .tv_nsec = 0 }; |
| le64 timestamp = timespec2ntfs(zero_time); |
| |
| /* FIXME: can fall into infinite loop if corrupted */ |
| while (!(e->ie_flags & INDEX_ENTRY_END)) { |
| |
| e->key.file_name.creation_time = timestamp; |
| e->key.file_name.last_data_change_time = timestamp; |
| e->key.file_name.last_mft_change_time = timestamp; |
| e->key.file_name.last_access_time = timestamp; |
| |
| wiped_timestamp_data += 32; |
| |
| e = (INDEX_ENTRY *)((u8 *)e + le16_to_cpu(e->length)); |
| } |
| } |
| |
| static void wipe_index_allocation_timestamps(ntfs_inode *ni, ATTR_RECORD *attr) |
| { |
| INDEX_ALLOCATION *indexa, *tmp_indexa; |
| INDEX_ENTRY *entry; |
| INDEX_ROOT *indexr; |
| u8 *bitmap, *byte; |
| int bit; |
| ntfs_attr *na; |
| ntfschar *name; |
| u32 name_len; |
| |
| indexr = ntfs_index_root_get(ni, attr); |
| if (!indexr) { |
| perr_printf("Failed to read $INDEX_ROOT attribute of inode " |
| "%lld", (long long)ni->mft_no); |
| return; |
| } |
| |
| if (indexr->type != AT_FILE_NAME) |
| goto out_indexr; |
| |
| name = (ntfschar *)((u8 *)attr + le16_to_cpu(attr->name_offset)); |
| name_len = attr->name_length; |
| |
| byte = bitmap = ntfs_attr_readall(ni, AT_BITMAP, name, name_len, |
| NULL); |
| if (!byte) { |
| perr_printf("Failed to read $BITMAP attribute"); |
| goto out_indexr; |
| } |
| |
| na = ntfs_attr_open(ni, AT_INDEX_ALLOCATION, name, name_len); |
| if (!na) { |
| perr_printf("Failed to open $INDEX_ALLOCATION attribute"); |
| goto out_bitmap; |
| } |
| |
| if (!na->data_size) |
| goto out_na; |
| |
| tmp_indexa = indexa = ntfs_malloc(na->data_size); |
| if (!tmp_indexa) |
| goto out_na; |
| |
| if (ntfs_attr_pread(na, 0, na->data_size, indexa) != na->data_size) { |
| perr_printf("Failed to read $INDEX_ALLOCATION attribute"); |
| goto out_indexa; |
| } |
| |
| bit = 0; |
| while ((u8 *)tmp_indexa < (u8 *)indexa + na->data_size) { |
| if (*byte & (1 << bit)) { |
| if (ntfs_mst_post_read_fixup((NTFS_RECORD *)tmp_indexa, |
| le32_to_cpu( |
| indexr->index_block_size))) { |
| perr_printf("Damaged INDX record"); |
| goto out_indexa; |
| } |
| entry = (INDEX_ENTRY *)((u8 *)tmp_indexa + le32_to_cpu( |
| tmp_indexa->index.entries_offset) + 0x18); |
| |
| wipe_index_entry_timestams(entry); |
| |
| if (ntfs_mft_usn_dec((MFT_RECORD *)tmp_indexa)) |
| perr_exit("ntfs_mft_usn_dec"); |
| |
| if (ntfs_mst_pre_write_fixup((NTFS_RECORD *)tmp_indexa, |
| le32_to_cpu( |
| indexr->index_block_size))) { |
| perr_printf("INDX write fixup failed"); |
| goto out_indexa; |
| } |
| } |
| tmp_indexa = (INDEX_ALLOCATION *)((u8 *)tmp_indexa + |
| le32_to_cpu(indexr->index_block_size)); |
| bit++; |
| if (bit > 7) { |
| bit = 0; |
| byte++; |
| } |
| } |
| if (ntfs_rl_pwrite(vol, na->rl, 0, 0, na->data_size, indexa) != na->data_size) |
| perr_printf("ntfs_rl_pwrite failed for inode %lld", |
| (long long)ni->mft_no); |
| out_indexa: |
| free(indexa); |
| out_na: |
| ntfs_attr_close(na); |
| out_bitmap: |
| free(bitmap); |
| out_indexr: |
| free(indexr); |
| } |
| |
| static void wipe_index_root_timestamps(ATTR_RECORD *attr, le64 timestamp) |
| { |
| INDEX_ENTRY *entry; |
| INDEX_ROOT *iroot; |
| |
| iroot = (INDEX_ROOT *)((u8 *)attr + le16_to_cpu(attr->value_offset)); |
| entry = (INDEX_ENTRY *)((u8 *)iroot + |
| le32_to_cpu(iroot->index.entries_offset) + 0x10); |
| |
| while (!(entry->ie_flags & INDEX_ENTRY_END)) { |
| |
| if (iroot->type == AT_FILE_NAME) { |
| |
| entry->key.file_name.creation_time = timestamp; |
| entry->key.file_name.last_access_time = timestamp; |
| entry->key.file_name.last_data_change_time = timestamp; |
| entry->key.file_name.last_mft_change_time = timestamp; |
| |
| wiped_timestamp_data += 32; |
| |
| } else if (ntfs_names_are_equal(NTFS_INDEX_Q, |
| sizeof(NTFS_INDEX_Q) / 2 - 1, |
| (ntfschar *)((char *)attr + |
| le16_to_cpu(attr->name_offset)), |
| attr->name_length, CASE_SENSITIVE, NULL, 0)) { |
| |
| QUOTA_CONTROL_ENTRY *quota_q; |
| |
| quota_q = (QUOTA_CONTROL_ENTRY *)((u8 *)entry + |
| le16_to_cpu(entry->data_offset)); |
| /* |
| * FIXME: no guarantee it's indeed /$Extend/$Quota:$Q. |
| * For now, as a minimal safeguard, we check only for |
| * quota version 2 ... |
| */ |
| if (le32_to_cpu(quota_q->version) == 2) { |
| quota_q->change_time = timestamp; |
| wiped_timestamp_data += 4; |
| } |
| } |
| |
| entry = (INDEX_ENTRY*)((u8*)entry + le16_to_cpu(entry->length)); |
| } |
| } |
| |
| #define WIPE_TIMESTAMPS(atype, attr, timestamp) \ |
| do { \ |
| atype *ats; \ |
| ats = (atype *)((char *)(attr) + le16_to_cpu((attr)->value_offset)); \ |
| \ |
| ats->creation_time = (timestamp); \ |
| ats->last_data_change_time = (timestamp); \ |
| ats->last_mft_change_time= (timestamp); \ |
| ats->last_access_time = (timestamp); \ |
| \ |
| wiped_timestamp_data += 32; \ |
| \ |
| } while (0) |
| |
| static void wipe_timestamps(ntfs_walk_clusters_ctx *image) |
| { |
| static const struct timespec zero_time = { .tv_sec = 0, .tv_nsec = 0 }; |
| ATTR_RECORD *a = image->ctx->attr; |
| le64 timestamp = timespec2ntfs(zero_time); |
| |
| if (a->type == AT_FILE_NAME) |
| WIPE_TIMESTAMPS(FILE_NAME_ATTR, a, timestamp); |
| |
| else if (a->type == AT_STANDARD_INFORMATION) |
| WIPE_TIMESTAMPS(STANDARD_INFORMATION, a, timestamp); |
| |
| else if (a->type == AT_INDEX_ROOT) |
| wipe_index_root_timestamps(a, timestamp); |
| } |
| |
| static void wipe_resident_data(ntfs_walk_clusters_ctx *image) |
| { |
| ATTR_RECORD *a; |
| u32 i; |
| int n = 0; |
| u8 *p; |
| |
| a = image->ctx->attr; |
| p = (u8*)a + le16_to_cpu(a->value_offset); |
| |
| if (image->ni->mft_no <= LAST_METADATA_INODE) |
| return; |
| |
| if (a->type != AT_DATA) |
| return; |
| |
| for (i = 0; i < le32_to_cpu(a->value_length); i++) { |
| if (p[i]) { |
| p[i] = 0; |
| n++; |
| } |
| } |
| |
| wiped_resident_data += n; |
| } |
| |
| static int wipe_data(char *p, int pos, int len) |
| { |
| int wiped = 0; |
| |
| for (p += pos; --len >= 0;) { |
| if (p[len]) { |
| p[len] = 0; |
| wiped++; |
| } |
| } |
| |
| return wiped; |
| } |
| |
| static void wipe_unused_mft_data(ntfs_inode *ni) |
| { |
| int unused; |
| MFT_RECORD *m = ni->mrec; |
| |
| /* FIXME: broken MFTMirr update was fixed in libntfs, check if OK now */ |
| if (ni->mft_no <= LAST_METADATA_INODE) |
| return; |
| |
| unused = le32_to_cpu(m->bytes_allocated) - le32_to_cpu(m->bytes_in_use); |
| wiped_unused_mft_data += wipe_data((char *)m, |
| le32_to_cpu(m->bytes_in_use), unused); |
| } |
| |
| static void wipe_unused_mft(ntfs_inode *ni) |
| { |
| int unused; |
| MFT_RECORD *m = ni->mrec; |
| |
| /* FIXME: broken MFTMirr update was fixed in libntfs, check if OK now */ |
| if (ni->mft_no <= LAST_METADATA_INODE) |
| return; |
| |
| unused = le32_to_cpu(m->bytes_in_use) - sizeof(MFT_RECORD); |
| wiped_unused_mft += wipe_data((char *)m, sizeof(MFT_RECORD), unused); |
| } |
| |
| static void clone_logfile_parts(ntfs_walk_clusters_ctx *image, runlist *rl) |
| { |
| s64 offset = 0, lcn, vcn; |
| |
| while (1) { |
| |
| vcn = offset / image->ni->vol->cluster_size; |
| lcn = ntfs_rl_vcn_to_lcn(rl, vcn); |
| if (lcn < 0) |
| break; |
| |
| lseek_to_cluster(lcn); |
| |
| if (opt.metadata_image && wipe) |
| gap_to_cluster(lcn - image->current_lcn); |
| |
| copy_cluster(opt.rescue, lcn, lcn); |
| image->current_lcn = lcn + 1; |
| if (opt.metadata_image && !wipe) |
| image->inuse++; |
| |
| if (offset == 0) |
| offset = NTFS_BLOCK_SIZE >> 1; |
| else |
| offset <<= 1; |
| } |
| } |
| |
| /* |
| * In-memory wiping of MFT record or MFTMirr record |
| * (only for metadata images) |
| * |
| * The resident data and (optionally) the timestamps are wiped. |
| */ |
| |
| static void wipe_mft(char *mrec, u32 mrecsz, u64 mft_no) |
| { |
| ntfs_walk_clusters_ctx image; |
| ntfs_attr_search_ctx *ctx; |
| ntfs_inode ni; |
| |
| ni.mft_no = mft_no; |
| ni.mrec = (MFT_RECORD*)mrec; |
| ni.vol = vol; /* Hmm */ |
| image.ni = ∋ |
| ntfs_mst_post_read_fixup_warn((NTFS_RECORD*)mrec,mrecsz,FALSE); |
| wipe_unused_mft_data(&ni); |
| if (!(((MFT_RECORD*)mrec)->flags & MFT_RECORD_IN_USE)) { |
| wipe_unused_mft(&ni); |
| } else { |
| /* ctx with no ntfs_inode prevents from searching external attrs */ |
| if (!(ctx = ntfs_attr_get_search_ctx((ntfs_inode*)NULL, (MFT_RECORD*)mrec))) |
| perr_exit("ntfs_get_attr_search_ctx"); |
| |
| while (!ntfs_attr_lookup(AT_UNUSED, NULL, 0, CASE_SENSITIVE, 0, |
| NULL, 0, ctx)) { |
| if (ctx->attr->type == AT_END) |
| break; |
| |
| image.ctx = ctx; |
| if (!ctx->attr->non_resident |
| && (mft_no > LAST_METADATA_INODE)) |
| wipe_resident_data(&image); |
| if (!opt.preserve_timestamps) |
| wipe_timestamps(&image); |
| } |
| ntfs_attr_put_search_ctx(ctx); |
| } |
| ntfs_mft_usn_dec((MFT_RECORD*)mrec); |
| ntfs_mst_pre_write_fixup((NTFS_RECORD*)mrec,mrecsz); |
| } |
| |
| /* |
| * In-memory wiping of a directory record (I30) |
| * (only for metadata images) |
| * |
| * The timestamps are (optionally) wiped |
| */ |
| |
| static void wipe_indx(char *mrec, u32 mrecsz) |
| { |
| INDEX_ENTRY *entry; |
| INDEX_ALLOCATION *indexa; |
| |
| if (ntfs_mst_post_read_fixup((NTFS_RECORD *)mrec, mrecsz)) { |
| perr_printf("Damaged INDX record"); |
| goto out_indexa; |
| } |
| indexa = (INDEX_ALLOCATION*)mrec; |
| /* |
| * The index bitmap is not checked, obsoleted records are |
| * wiped if they pass the safety checks |
| */ |
| if ((indexa->magic == magic_INDX) |
| && (le32_to_cpu(indexa->index.entries_offset) >= sizeof(INDEX_HEADER)) |
| && (le32_to_cpu(indexa->index.allocated_size) <= mrecsz)) { |
| entry = (INDEX_ENTRY *)((u8 *)mrec + le32_to_cpu( |
| indexa->index.entries_offset) + 0x18); |
| wipe_index_entry_timestams(entry); |
| } |
| |
| if (ntfs_mft_usn_dec((MFT_RECORD *)mrec)) |
| perr_exit("ntfs_mft_usn_dec"); |
| |
| if (ntfs_mst_pre_write_fixup((NTFS_RECORD *)mrec, mrecsz)) { |
| perr_printf("INDX write fixup failed"); |
| goto out_indexa; |
| } |
| out_indexa : ; |
| } |
| |
| /* |
| * Output a set of related clusters (MFT record or index block) |
| */ |
| |
| static void write_set(char *buff, u32 csize, s64 *current_lcn, |
| runlist_element *rl, u32 wi, u32 wj, u32 cnt) |
| { |
| u32 k; |
| s64 target_lcn; |
| char cmd = 1; |
| |
| for (k=0; k<cnt; k++) { |
| target_lcn = rl[wi].lcn + wj; |
| if (target_lcn != *current_lcn) |
| gap_to_cluster(target_lcn - *current_lcn); |
| if ((write_all(&fd_out, &cmd, sizeof(cmd)) == -1) |
| || (write_all(&fd_out, &buff[k*csize], csize) == -1)) |
| perr_exit("Failed to write_all"); |
| *current_lcn = target_lcn + 1; |
| |
| if (++wj >= rl[wi].length) { |
| wj = 0; |
| wi++; |
| } |
| } |
| } |
| |
| /* |
| * Copy and wipe the full MFT or MFTMirr data. |
| * (only for metadata images) |
| * |
| * Data are read and written by full clusters, but the wiping is done |
| * per MFT record. |
| */ |
| |
| static void copy_wipe_mft(ntfs_walk_clusters_ctx *image, runlist *rl) |
| { |
| char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */ |
| void *fd; |
| s64 mft_no; |
| u32 mft_record_size; |
| u32 csize; |
| u32 records_per_set; |
| u32 clusters_per_set; |
| u32 wi,wj; /* indexes for reading */ |
| u32 ri,rj; /* indexes for writing */ |
| u32 k; /* lcn within run */ |
| u32 r; /* mft_record within set */ |
| s64 current_lcn; |
| |
| current_lcn = image->current_lcn; |
| mft_record_size = image->ni->vol->mft_record_size; |
| csize = image->ni->vol->cluster_size; |
| fd = image->ni->vol->dev; |
| /* |
| * Depending on the sizes, there may be several records |
| * per cluster, or several clusters per record. |
| */ |
| if (csize >= mft_record_size) { |
| records_per_set = csize/mft_record_size; |
| clusters_per_set = 1; |
| } else { |
| clusters_per_set = mft_record_size/csize; |
| records_per_set = 1; |
| } |
| mft_no = 0; |
| ri = rj = 0; |
| wi = wj = 0; |
| lseek_to_cluster(rl[ri].lcn); |
| while (rl[ri].length) { |
| for (k=0; (k<clusters_per_set) && rl[ri].length; k++) { |
| read_rescue(fd, &buff[k*csize], csize, rl[ri].lcn + rj); |
| if (++rj >= rl[ri].length) { |
| rj = 0; |
| if (rl[++ri].length) |
| lseek_to_cluster(rl[ri].lcn); |
| } |
| } |
| if (k == clusters_per_set) { |
| for (r=0; r<records_per_set; r++) { |
| if (!strncmp(&buff[r*mft_record_size],"FILE",4)) |
| wipe_mft(&buff[r*mft_record_size], |
| mft_record_size, mft_no); |
| mft_no++; |
| } |
| write_set(buff, csize, ¤t_lcn, |
| rl, wi, wj, clusters_per_set); |
| wj += clusters_per_set; |
| while (rl[wi].length && (wj >= rl[wi].length)) |
| wj -= rl[wi++].length; |
| } else { |
| err_exit("Short last MFT record\n"); |
| } |
| } |
| image->current_lcn = current_lcn; |
| } |
| |
| /* |
| * Copy and wipe the non-resident part of a directory index |
| * (only for metadata images) |
| * |
| * Data are read and written by full clusters, but the wiping is done |
| * per index record. |
| */ |
| |
| static void copy_wipe_i30(ntfs_walk_clusters_ctx *image, runlist *rl) |
| { |
| char buff[NTFS_MAX_CLUSTER_SIZE]; /* overflow checked at mount time */ |
| void *fd; |
| u32 indx_record_size; |
| u32 csize; |
| u32 records_per_set; |
| u32 clusters_per_set; |
| u32 wi,wj; /* indexes for reading */ |
| u32 ri,rj; /* indexes for writing */ |
| u32 k; /* lcn within run */ |
| u32 r; /* mft_record within set */ |
| s64 current_lcn; |
| |
| current_lcn = image->current_lcn; |
| csize = image->ni->vol->cluster_size; |
| fd = image->ni->vol->dev; |
| /* |
| * Depending on the sizes, there may be several records |
| * per cluster, or several clusters per record. |
| */ |
| indx_record_size = image->ni->vol->indx_record_size; |
| if (csize >= indx_record_size) { |
| records_per_set = csize/indx_record_size; |
| clusters_per_set = 1; |
| } else { |
| clusters_per_set = indx_record_size/csize; |
| records_per_set = 1; |
| } |
| ri = rj = 0; |
| wi = wj = 0; |
| lseek_to_cluster(rl[ri].lcn); |
| while (rl[ri].length) { |
| for (k=0; (k<clusters_per_set) && rl[ri].length; k++) { |
| read_rescue(fd, &buff[k*csize], csize, rl[ri].lcn + rj); |
| if (++rj >= rl[ri].length) { |
| rj = 0; |
| if (rl[++ri].length) |
| lseek_to_cluster(rl[ri].lcn); |
| } |
| } |
| if (k == clusters_per_set) { |
| /* wipe records_per_set records */ |
| if (!opt.preserve_timestamps) |
| for (r=0; r<records_per_set; r++) { |
| if (!strncmp(&buff[r*indx_record_size],"INDX",4)) |
| wipe_indx(&buff[r*indx_record_size], |
| indx_record_size); |
| } |
| write_set(buff, csize, ¤t_lcn, |
| rl, wi, wj, clusters_per_set); |
| wj += clusters_per_set; |
| while (rl[wi].length && (wj >= rl[wi].length)) |
| wj -= rl[wi++].length; |
| } else { |
| err_exit("Short last directory index record\n"); |
| } |
| } |
| image->current_lcn = current_lcn; |
| } |
| |
| static void dump_clusters(ntfs_walk_clusters_ctx *image, runlist *rl) |
| { |
| s64 i, len; /* number of clusters to copy */ |
| |
| if (opt.restore_image) |
| err_exit("Bug : invalid dump_clusters()\n"); |
| |
| if ((opt.std_out && !opt.metadata_image) || !opt.metadata) |
| return; |
| if (!(len = is_critical_metadata(image, rl))) |
| return; |
| |
| lseek_to_cluster(rl->lcn); |
| if (opt.metadata_image && wipe) |
| gap_to_cluster(rl->lcn - image->current_lcn); |
| if (opt.metadata_image ? wipe : !wipe) { |
| /* FIXME: this could give pretty suboptimal performance */ |
| for (i = 0; i < len; i++) |
| copy_cluster(opt.rescue, rl->lcn + i, rl->lcn + i); |
| image->current_lcn = rl->lcn + len; |
| } |
| } |
| |
| static void walk_runs(struct ntfs_walk_cluster *walk) |
| { |
| int i, j; |
| runlist *rl; |
| ATTR_RECORD *a; |
| ntfs_attr_search_ctx *ctx; |
| BOOL mft_data; |
| BOOL index_i30; |
| |
| ctx = walk->image->ctx; |
| a = ctx->attr; |
| |
| if (!a->non_resident) { |
| if (wipe) { |
| wipe_resident_data(walk->image); |
| if (!opt.preserve_timestamps) |
| wipe_timestamps(walk->image); |
| } |
| return; |
| } |
| |
| if (wipe |
| && !opt.preserve_timestamps |
| && walk->image->ctx->attr->type == AT_INDEX_ALLOCATION) |
| wipe_index_allocation_timestamps(walk->image->ni, a); |
| |
| if (!(rl = ntfs_mapping_pairs_decompress(vol, a, NULL))) |
| perr_exit("ntfs_decompress_mapping_pairs"); |
| |
| /* special wipings for MFT records and directory indexes */ |
| mft_data = ((walk->image->ni->mft_no == FILE_MFT) |
| || (walk->image->ni->mft_no == FILE_MFTMirr)) |
| && (a->type == AT_DATA); |
| index_i30 = (walk->image->ctx->attr->type == AT_INDEX_ALLOCATION) |
| && (a->name_length == 4) |
| && !memcmp((char*)a + le16_to_cpu(a->name_offset), |
| NTFS_INDEX_I30,8); |
| |
| for (i = 0; rl[i].length; i++) { |
| s64 lcn = rl[i].lcn; |
| s64 lcn_length = rl[i].length; |
| |
| if (lcn == LCN_HOLE || lcn == LCN_RL_NOT_MAPPED) |
| continue; |
| |
| /* FIXME: ntfs_mapping_pairs_decompress should return error */ |
| if (lcn < 0 || lcn_length < 0) |
| err_exit("Corrupt runlist in inode %lld attr %x LCN " |
| "%llx length %llx\n", |
| (long long)ctx->ntfs_ino->mft_no, |
| (unsigned int)le32_to_cpu(a->type), |
| (long long)lcn, (long long)lcn_length); |
| |
| if (opt.metadata_image ? wipe && !mft_data && !index_i30 : !wipe) |
| dump_clusters(walk->image, rl + i); |
| |
| for (j = 0; j < lcn_length; j++) { |
| u64 k = (u64)lcn + j; |
| if (ntfs_bit_get_and_set(lcn_bitmap.bm, k, 1)) |
| err_exit("Cluster %llu referenced twice!\n" |
| "You didn't shutdown your Windows " |
| "properly?\n", (unsigned long long)k); |
| } |
| |
| if (!opt.metadata_image) |
| walk->image->inuse += lcn_length; |
| /* |
| * For a metadata image, we have to compute the |
| * number of metadata clusters for the percentages |
| * to be displayed correctly while restoring. |
| */ |
| if (!wipe && opt.metadata_image) { |
| if ((walk->image->ni->mft_no == FILE_LogFile) |
| && (walk->image->ctx->attr->type == AT_DATA)) { |
| /* 16 KiB of FILE_LogFile */ |
| walk->image->inuse |
| += is_critical_metadata(walk->image,rl); |
| } else { |
| if ((walk->image->ni->mft_no |
| <= LAST_METADATA_INODE) |
| || (walk->image->ctx->attr->type != AT_DATA)) |
| walk->image->inuse += lcn_length; |
| } |
| } |
| } |
| if (wipe && opt.metadata_image) { |
| if (mft_data) |
| copy_wipe_mft(walk->image,rl); |
| if (index_i30) |
| copy_wipe_i30(walk->image,rl); |
| } |
| if (opt.metadata |
| && (opt.metadata_image || !wipe) |
| && (walk->image->ni->mft_no == FILE_LogFile) |
| && (walk->image->ctx->attr->type == AT_DATA)) |
| clone_logfile_parts(walk->image, rl); |
| |
| free(rl); |
| } |
| |
| |
| static void walk_attributes(struct ntfs_walk_cluster *walk) |
| { |
| ntfs_attr_search_ctx *ctx; |
| |
| if (!(ctx = ntfs_attr_get_search_ctx(walk->image->ni, NULL))) |
| perr_exit("ntfs_get_attr_search_ctx"); |
| |
| while (!ntfs_attrs_walk(ctx)) { |
| if (ctx->attr->type == AT_END) |
| break; |
| |
| walk->image->ctx = ctx; |
| walk_runs(walk); |
| } |
| |
| ntfs_attr_put_search_ctx(ctx); |
| } |
| |
| |
| |
| static void compare_bitmaps(struct bitmap *a) |
| { |
| s64 i, pos, count; |
| int mismatch = 0; |
| u8 bm[NTFS_BUF_SIZE]; |
| |
| Printf("Accounting clusters ...\n"); |
| |
| pos = 0; |
| while (1) { |
| count = ntfs_attr_pread(vol->lcnbmp_na, pos, NTFS_BUF_SIZE, bm); |
| if (count == -1) |
| perr_exit("Couldn't get $Bitmap $DATA"); |
| |
| if (count == 0) { |
| /* the backup bootsector need not be accounted for */ |
| if (((vol->nr_clusters + 7) >> 3) > pos) |
| err_exit("$Bitmap size is smaller than expected" |
| " (%lld < %lld)\n", |
| (long long)pos, (long long)a->size); |
| break; |
| } |
| |
| for (i = 0; i < count; i++, pos++) { |
| s64 cl; /* current cluster */ |
| |
| if (a->size <= pos) |
| goto done; |
| |
| if (a->bm[pos] == bm[i]) |
| continue; |
| |
| for (cl = pos * 8; cl < (pos + 1) * 8; cl++) { |
| char bit; |
| |
| bit = ntfs_bit_get(a->bm, cl); |
| if (bit == ntfs_bit_get(bm, i * 8 + cl % 8)) |
| continue; |
| |
| if (opt.ignore_fs_check) { |
| lseek_to_cluster(cl); |
| copy_cluster(opt.rescue, cl, cl); |
| } |
| |
| if (++mismatch > 10) |
| continue; |
| |
| Printf("Cluster accounting failed at %lld " |
| "(0x%llx): %s cluster in $Bitmap\n", |
| (long long)cl, (unsigned long long)cl, |
| bit ? "missing" : "extra"); |
| } |
| } |
| } |
| done: |
| if (mismatch) { |
| Printf("Totally %d cluster accounting mismatches.\n", mismatch); |
| if (opt.ignore_fs_check) { |
| Printf("WARNING: The NTFS inconsistency was overruled " |
| "by the --ignore-fs-check option.\n"); |
| return; |
| } |
| err_exit("Filesystem check failed! Windows wasn't shutdown " |
| "properly or inconsistent\nfilesystem. Please run " |
| "chkdsk /f on Windows then reboot it TWICE.\n"); |
| } |
| } |
| |
| |
| static void mft_record_write_with_same_usn(ntfs_volume *volume, ntfs_inode *ni) |
| { |
| if (ntfs_mft_usn_dec(ni->mrec)) |
| perr_exit("ntfs_mft_usn_dec"); |
| |
| if (ntfs_mft_record_write(volume, ni->mft_no, ni->mrec)) |
| perr_exit("ntfs_mft_record_write"); |
| } |
| |
| static void mft_inode_write_with_same_usn(ntfs_volume *volume, ntfs_inode *ni) |
| { |
| s32 i; |
| |
| mft_record_write_with_same_usn(volume, ni); |
| |
| if (ni->nr_extents <= 0) |
| return; |
| |
| for (i = 0; i < ni->nr_extents; ++i) { |
| ntfs_inode *eni = ni->extent_nis[i]; |
| mft_record_write_with_same_usn(volume, eni); |
| } |
| } |
| |
| static int walk_clusters(ntfs_volume *volume, struct ntfs_walk_cluster *walk) |
| { |
| s64 inode = 0; |
| s64 last_mft_rec; |
| u64 nr_clusters; |
| ntfs_inode *ni; |
| struct progress_bar progress; |
| |
| if (opt.restore_image || (!opt.metadata && wipe)) |
| err_exit("Bug : invalid walk_clusters()\n"); |
| Printf("Scanning volume ...\n"); |
| |
| last_mft_rec = (volume->mft_na->initialized_size >> |
| volume->mft_record_size_bits) - 1; |
| walk->image->current_lcn = 0; |
| progress_init(&progress, inode, last_mft_rec, 100); |
| |
| NVolSetNoFixupWarn(volume); |
| for (; inode <= last_mft_rec; inode++) { |
| |
| int err, deleted_inode; |
| MFT_REF mref = (MFT_REF)inode; |
| |
| progress_update(&progress, inode); |
| |
| /* FIXME: Terrible kludge for libntfs not being able to return |
| a deleted MFT record as inode */ |
| ni = ntfs_calloc(sizeof(ntfs_inode)); |
| if (!ni) |
| perr_exit("walk_clusters"); |
| |
| ni->vol = volume; |
| |
| err = ntfs_file_record_read(volume, mref, &ni->mrec, NULL); |
| if (err == -1) { |
| free(ni); |
| continue; |
| } |
| |
| deleted_inode = !(ni->mrec->flags & MFT_RECORD_IN_USE); |
| |
| if (deleted_inode && !opt.metadata_image) { |
| |
| ni->mft_no = MREF(mref); |
| if (wipe) { |
| wipe_unused_mft(ni); |
| wipe_unused_mft_data(ni); |
| mft_record_write_with_same_usn(volume, ni); |
| } |
| } |
| |
| free(ni->mrec); |
| free(ni); |
| |
| if (deleted_inode) |
| continue; |
| |
| if ((ni = ntfs_inode_open(volume, mref)) == NULL) { |
| /* FIXME: continue only if it make sense, e.g. |
| MFT record not in use based on $MFT bitmap */ |
| if (errno == EIO || errno == ENOENT) |
| continue; |
| perr_exit("Reading inode %lld failed", |
| (long long)inode); |
| } |
| |
| if (wipe) |
| nr_used_mft_records++; |
| |
| if (ni->mrec->base_mft_record) |
| goto out; |
| |
| walk->image->ni = ni; |
| walk_attributes(walk); |
| out: |
| if (wipe && !opt.metadata_image) { |
| int i; |
| |
| wipe_unused_mft_data(ni); |
| for (i = 0; i < ni->nr_extents; ++i) { |
| wipe_unused_mft_data(ni->extent_nis[i]); |
| } |
| mft_inode_write_with_same_usn(volume, ni); |
| } |
| |
| if (ntfs_inode_close(ni)) |
| perr_exit("ntfs_inode_close for inode %lld", |
| (long long)inode); |
| } |
| if (opt.metadata) { |
| /* also get the backup bootsector */ |
| nr_clusters = vol->nr_clusters; |
| lseek_to_cluster(nr_clusters); |
| if (opt.metadata_image && wipe) |
| gap_to_cluster(nr_clusters - walk->image->current_lcn); |
| if (opt.metadata_image ? wipe : !wipe) |
| copy_cluster(opt.rescue, nr_clusters, nr_clusters); |
| walk->image->current_lcn = nr_clusters; |
| /* Not counted, for compatibility with older versions */ |
| if (!opt.metadata_image) |
| walk->image->inuse++; |
| } |
| return 0; |
| } |
| |
| |
| /* |
| * $Bitmap can overlap the end of the volume. Any bits in this region |
| * must be set. This region also encompasses the backup boot sector. |
| */ |
| static void bitmap_file_data_fixup(s64 cluster, struct bitmap *bm) |
| { |
| for (; cluster < bm->size << 3; cluster++) |
| ntfs_bit_set(bm->bm, (u64)cluster, 1); |
| } |
| |
| |
| /* |
| * Allocate a block of memory with one bit for each cluster of the disk. |
| * All the bits are set to 0, except those representing the region beyond the |
| * end of the disk. |
| */ |
| static void setup_lcn_bitmap(void) |
| { |
| /* Determine lcn bitmap byte size and allocate it. */ |
| /* include the alternate boot sector in the bitmap count */ |
| lcn_bitmap.size = rounded_up_division(vol->nr_clusters + 1, 8); |
| |
| lcn_bitmap.bm = ntfs_calloc(lcn_bitmap.size); |
| if (!lcn_bitmap.bm) |
| perr_exit("Failed to allocate internal buffer"); |
| |
| bitmap_file_data_fixup(vol->nr_clusters, &lcn_bitmap); |
| } |
| |
| |
| static s64 volume_size(ntfs_volume *volume, s64 nr_clusters) |
| { |
| return nr_clusters * volume->cluster_size; |
| } |
| |
| |
| static void print_volume_size(const char *str, s64 bytes) |
| { |
| Printf("%s: %lld bytes (%lld MB)\n", str, (long long)bytes, |
| (long long)rounded_up_division(bytes, NTFS_MBYTE)); |
| } |
| |
| |
| static void print_disk_usage(const char *spacer, u32 cluster_size, |
| s64 nr_clusters, s64 inuse) |
| { |
| s64 total, used; |
| |
| total = nr_clusters * cluster_size; |
| used = inuse * cluster_size; |
| |
| Printf("Space in use %s: %lld MB (%.1f%%) ", spacer, |
| (long long)rounded_up_division(used, NTFS_MBYTE), |
| 100.0 * ((float)used / total)); |
| |
| Printf("\n"); |
| } |
| |
| static void print_image_info(void) |
| { |
| Printf("Ntfsclone image version: %d.%d\n", |
| image_hdr.major_ver, image_hdr.minor_ver); |
| Printf("Cluster size : %u bytes\n", |
| (unsigned)le32_to_cpu(image_hdr.cluster_size)); |
| print_volume_size("Image volume size ", |
| sle64_to_cpu(image_hdr.nr_clusters) * |
| le32_to_cpu(image_hdr.cluster_size)); |
| Printf("Image device size : %lld bytes\n", |
| (long long)sle64_to_cpu(image_hdr.device_size)); |
| print_disk_usage(" ", le32_to_cpu(image_hdr.cluster_size), |
| sle64_to_cpu(image_hdr.nr_clusters), |
| sle64_to_cpu(image_hdr.inuse)); |
| Printf("Offset to image data : %u (0x%x) bytes\n", |
| (unsigned)le32_to_cpu(image_hdr.offset_to_image_data), |
| (unsigned)le32_to_cpu(image_hdr.offset_to_image_data)); |
| } |
| |
| static void check_if_mounted(const char *device, unsigned long new_mntflag) |
| { |
| unsigned long mntflag; |
| |
| if (ntfs_check_if_mounted(device, &mntflag)) |
| perr_exit("Failed to check '%s' mount state", device); |
| |
| if (mntflag & NTFS_MF_MOUNTED) { |
| if (!(mntflag & NTFS_MF_READONLY)) |
| err_exit("Device '%s' is mounted read-write. " |
| "You must 'umount' it first.\n", device); |
| if (!new_mntflag) |
| err_exit("Device '%s' is mounted. " |
| "You must 'umount' it first.\n", device); |
| } |
| } |
| |
| /** |
| * mount_volume - |
| * |
| * First perform some checks to determine if the volume is already mounted, or |
| * is dirty (Windows wasn't shutdown properly). If everything is OK, then mount |
| * the volume (load the metadata into memory). |
| */ |
| static void mount_volume(unsigned long new_mntflag) |
| { |
| check_if_mounted(opt.volume, new_mntflag); |
| |
| if (!(vol = ntfs_mount(opt.volume, new_mntflag))) { |
| |
| int err = errno; |
| |
| perr_printf("Opening '%s' as NTFS failed", opt.volume); |
| if (err == EINVAL) { |
| Printf("Apparently device '%s' doesn't have a " |
| "valid NTFS. Maybe you selected\nthe whole " |
| "disk instead of a partition (e.g. /dev/hda, " |
| "not /dev/hda1)?\n", opt.volume); |
| } |
| exit(1); |
| } |
| |
| if (vol->flags & VOLUME_IS_DIRTY) |
| if (opt.force-- <= 0) |
| err_exit(dirty_volume_msg, opt.volume); |
| |
| if (NTFS_MAX_CLUSTER_SIZE < vol->cluster_size) |
| err_exit("Cluster size %u is too large!\n", |
| (unsigned int)vol->cluster_size); |
| |
| Printf("NTFS volume version: %d.%d\n", vol->major_ver, vol->minor_ver); |
| if (ntfs_version_is_supported(vol)) |
| perr_exit("Unknown NTFS version"); |
| |
| Printf("Cluster size : %u bytes\n", |
| (unsigned int)vol->cluster_size); |
| print_volume_size("Current volume size", |
| volume_size(vol, vol->nr_clusters)); |
| } |
| |
| static struct ntfs_walk_cluster backup_clusters = { NULL, NULL }; |
| |
| static int device_offset_valid(int fd, s64 ofs) |
| { |
| char ch; |
| |
| if (lseek(fd, ofs, SEEK_SET) >= 0 && read(fd, &ch, 1) == 1) |
| return 0; |
| return -1; |
| } |
| |
| static s64 device_size_get(int fd) |
| { |
| s64 high, low; |
| #ifdef BLKGETSIZE64 |
| { u64 size; |
| |
| if (ioctl(fd, BLKGETSIZE64, &size) >= 0) { |
| ntfs_log_debug("BLKGETSIZE64 nr bytes = %llu " |
| "(0x%llx).\n", (unsigned long long)size, |
| (unsigned long long)size); |
| return (s64)size; |
| } |
| } |
| #endif |
| #ifdef BLKGETSIZE |
| { unsigned long size; |
| |
| if (ioctl(fd, BLKGETSIZE, &size) >= 0) { |
| ntfs_log_debug("BLKGETSIZE nr 512 byte blocks = %lu " |
| "(0x%lx).\n", size, size); |
| return (s64)size * 512; |
| } |
| } |
| #endif |
| #ifdef FDGETPRM |
| { struct floppy_struct this_floppy; |
| |
| if (ioctl(fd, FDGETPRM, &this_floppy) >= 0) { |
| ntfs_log_debug("FDGETPRM nr 512 byte blocks = %lu " |
| "(0x%lx).\n", this_floppy.size, |
| this_floppy.size); |
| return (s64)this_floppy.size * 512; |
| } |
| } |
| #endif |
| /* |
| * We couldn't figure it out by using a specialized ioctl, |
| * so do binary search to find the size of the device. |
| */ |
| low = 0LL; |
| for (high = 1024LL; !device_offset_valid(fd, high); high <<= 1) |
| low = high; |
| while (low < high - 1LL) { |
| const s64 mid = (low + high) / 2; |
| |
| if (!device_offset_valid(fd, mid)) |
| low = mid; |
| else |
| high = mid; |
| } |
| lseek(fd, 0LL, SEEK_SET); |
| return (low + 1LL); |
| } |
| |
| static void fsync_clone(int fd) |
| { |
| Printf("Syncing ...\n"); |
| if (opt.save_image && stream_out && fflush(stream_out)) |
| perr_exit("fflush"); |
| if (fsync(fd) && errno != EINVAL) |
| perr_exit("fsync"); |
| } |
| |
| static void set_filesize(s64 filesize) |
| { |
| #ifndef NO_STATFS |
| long fs_type = 0; /* Unknown filesystem type */ |
| |
| if (fstatfs(fd_out, &opt.stfs) == -1) |
| Printf("WARNING: Couldn't get filesystem type: " |
| "%s\n", strerror(errno)); |
| else |
| fs_type = opt.stfs.f_type; |
| |
| if (fs_type == 0x52654973) |
| Printf("WARNING: You're using ReiserFS, it has very poor " |
| "performance creating\nlarge sparse files. The next " |
| "operation might take a very long time!\n" |
| "Creating sparse output file ...\n"); |
| else if (fs_type == 0x517b) |
| Printf("WARNING: You're using SMBFS and if the remote share " |
| "isn't Samba but a Windows\ncomputer then the clone " |
| "operation will be very inefficient and may fail!\n"); |
| #endif |
| |
| if (ftruncate(fd_out, filesize) == -1) { |
| int err = errno; |
| perr_printf("ftruncate failed for file '%s'", opt.output); |
| #ifndef NO_STATFS |
| if (fs_type) |
| Printf("Destination filesystem type is 0x%lx.\n", |
| (unsigned long)fs_type); |
| #endif |
| if (err == E2BIG) { |
| Printf("Your system or the destination filesystem " |
| "doesn't support large files.\n"); |
| #ifndef NO_STATFS |
| if (fs_type == 0x517b) { |
| Printf("SMBFS needs minimum Linux kernel " |
| "version 2.4.25 and\n the 'lfs' option" |
| "\nfor smbmount to have large " |
| "file support.\n"); |
| } |
| #endif |
| } else if (err == EPERM) { |
| Printf("Apparently the destination filesystem doesn't " |
| "support sparse files.\nYou can overcome this " |
| "by using the more efficient --save-image " |
| "option\nof ntfsclone. Use the --restore-image " |
| "option to restore the image.\n"); |
| } |
| exit(1); |
| } |
| } |
| |
| static s64 open_image(void) |
| { |
| if (strcmp(opt.volume, "-") == 0) { |
| if ((fd_in = fileno(stdin)) == -1) |
| perr_exit("fileno for stdout failed"); |
| } else { |
| if ((fd_in = open(opt.volume, O_RDONLY)) == -1) |
| perr_exit("failed to open image"); |
| } |
| if (read_all(&fd_in, &image_hdr, NTFSCLONE_IMG_HEADER_SIZE_OLD) == -1) |
| perr_exit("read_all"); |
| if (memcmp(image_hdr.magic, IMAGE_MAGIC, IMAGE_MAGIC_SIZE) != 0) |
| err_exit("Input file is not an image! (invalid magic)\n"); |
| if (image_hdr.major_ver < NTFSCLONE_IMG_VER_MAJOR_ENDIANNESS_SAFE) { |
| image_hdr.major_ver = NTFSCLONE_IMG_VER_MAJOR; |
| image_hdr.minor_ver = NTFSCLONE_IMG_VER_MINOR; |
| #if (__BYTE_ORDER == __BIG_ENDIAN) |
| /* |
| * old image read on a big endian computer, |
| * assuming it was created big endian and read cpu-wise, |
| * so we should translate to little endian |
| */ |
| Printf("Old image format detected. If the image was created " |
| "on a little endian architecture it will not " |
| "work. Use a more recent version of " |
| "ntfsclone to recreate the image.\n"); |
| image_hdr.cluster_size = cpu_to_le32(image_hdr.cluster_size); |
| image_hdr.device_size = cpu_to_sle64(image_hdr.device_size); |
| image_hdr.nr_clusters = cpu_to_sle64(image_hdr.nr_clusters); |
| image_hdr.inuse = cpu_to_sle64(image_hdr.inuse); |
| #endif |
| image_hdr.offset_to_image_data = |
| const_cpu_to_le32((sizeof(image_hdr) |
| + IMAGE_HDR_ALIGN - 1) & -IMAGE_HDR_ALIGN); |
| image_is_host_endian = TRUE; |
| } else { |
| /* safe image : little endian data */ |
| le32 offset_to_image_data; |
| int delta; |
| |
| if (image_hdr.major_ver > NTFSCLONE_IMG_VER_MAJOR) |
| err_exit("Do not know how to handle image format " |
| "version %d.%d. Please obtain a " |
| "newer version of ntfsclone.\n", |
| image_hdr.major_ver, |
| image_hdr.minor_ver); |
| /* Read the image header data offset. */ |
| if (read_all(&fd_in, &offset_to_image_data, |
| sizeof(offset_to_image_data)) == -1) |
| perr_exit("read_all"); |
| /* do not translate little endian data */ |
| image_hdr.offset_to_image_data = offset_to_image_data; |
| /* |
| * Read any fields from the header that we have not read yet so |
| * that the input stream is positioned correctly. This means |
| * we can support future minor versions that just extend the |
| * header in a backwards compatible way. |
| */ |
| delta = le32_to_cpu(offset_to_image_data) |
| - (NTFSCLONE_IMG_HEADER_SIZE_OLD + |
| sizeof(image_hdr.offset_to_image_data)); |
| if (delta > 0) { |
| char *dummy_buf; |
| |
| dummy_buf = malloc(delta); |
| if (!dummy_buf) |
| perr_exit("malloc dummy_buffer"); |
| if (read_all(&fd_in, dummy_buf, delta) == -1) |
| perr_exit("read_all"); |
| free(dummy_buf); |
| } |
| } |
| return sle64_to_cpu(image_hdr.device_size); |
| } |
| |
| static s64 open_volume(void) |
| { |
| s64 device_size; |
| |
| mount_volume(NTFS_MNT_RDONLY); |
| |
| device_size = ntfs_device_size_get(vol->dev, 1); |
| if (device_size <= 0) |
| err_exit("Couldn't get device size (%lld)!\n", |
| (long long)device_size); |
| |
| print_volume_size("Current device size", device_size); |
| |
| if (device_size < vol->nr_clusters * vol->cluster_size) |
| err_exit("Current NTFS volume size is bigger than the device " |
| "size (%lld)!\nCorrupt partition table or incorrect " |
| "device partitioning?\n", (long long)device_size); |
| |
| return device_size; |
| } |
| |
| static void initialise_image_hdr(s64 device_size, s64 inuse) |
| { |
| memcpy(image_hdr.magic, IMAGE_MAGIC, IMAGE_MAGIC_SIZE); |
| image_hdr.major_ver = NTFSCLONE_IMG_VER_MAJOR; |
| image_hdr.minor_ver = NTFSCLONE_IMG_VER_MINOR; |
| image_hdr.cluster_size = cpu_to_le32(vol->cluster_size); |
| image_hdr.device_size = cpu_to_sle64(device_size); |
| image_hdr.nr_clusters = cpu_to_sle64(vol->nr_clusters); |
| image_hdr.inuse = cpu_to_sle64(inuse); |
| image_hdr.offset_to_image_data = cpu_to_le32((sizeof(image_hdr) |
| + IMAGE_HDR_ALIGN - 1) & -IMAGE_HDR_ALIGN); |
| } |
| |
| static void check_output_device(s64 input_size) |
| { |
| if (opt.blkdev_out) { |
| s64 dest_size = device_size_get(fd_out); |
| if (dest_size < input_size) |
| err_exit("Output device is too small (%lld) to fit the " |
| "NTFS image (%lld).\n", |
| (long long)dest_size, (long long)input_size); |
| |
| check_if_mounted(opt.output, 0); |
| } else |
| set_filesize(input_size); |
| } |
| |
| static ntfs_attr_search_ctx *attr_get_search_ctx(ntfs_inode *ni) |
| { |
| ntfs_attr_search_ctx *ret; |
| |
| if ((ret = ntfs_attr_get_search_ctx(ni, NULL)) == NULL) |
| perr_printf("ntfs_attr_get_search_ctx"); |
| |
| return ret; |
| } |
| |
| /** |
| * lookup_data_attr |
| * |
| * Find the $DATA attribute (with or without a name) for the given ntfs inode. |
| */ |
| static ntfs_attr_search_ctx *lookup_data_attr(ntfs_inode *ni, const char *aname) |
| { |
| ntfs_attr_search_ctx *ctx; |
| ntfschar *ustr; |
| int len = 0; |
| |
| if ((ctx = attr_get_search_ctx(ni)) == NULL) |
| return NULL; |
| |
| if ((ustr = ntfs_str2ucs(aname, &len)) == NULL) { |
| perr_printf("Couldn't convert '%s' to Unicode", aname); |
| goto error_out; |
| } |
| |
| if (ntfs_attr_lookup(AT_DATA, ustr, len, CASE_SENSITIVE, |
| 0, NULL, 0, ctx)) { |
| perr_printf("ntfs_attr_lookup"); |
| goto error_out; |
| } |
| ntfs_ucsfree(ustr); |
| return ctx; |
| error_out: |
| ntfs_attr_put_search_ctx(ctx); |
| return NULL; |
| } |
| |
| static void ignore_bad_clusters(ntfs_walk_clusters_ctx *image) |
| { |
| ntfs_inode *ni; |
| ntfs_attr_search_ctx *ctx = NULL; |
| runlist *rl, *rl_bad; |
| s64 nr_bad_clusters = 0; |
| |
| if (!(ni = ntfs_inode_open(vol, FILE_BadClus))) |
| perr_exit("ntfs_open_inode"); |
| |
| if ((ctx = lookup_data_attr(ni, "$Bad")) == NULL) |
| exit(1); |
| |
| if (!(rl_bad = ntfs_mapping_pairs_decompress(vol, ctx->attr, NULL))) |
| perr_exit("ntfs_mapping_pairs_decompress"); |
| |
| for (rl = rl_bad; rl->length; rl++) { |
| s64 lcn = rl->lcn; |
| |
| if (lcn == LCN_HOLE || lcn < 0) |
| continue; |
| |
| for (; lcn < rl->lcn + rl->length; lcn++, nr_bad_clusters++) { |
| if (ntfs_bit_get_and_set(lcn_bitmap.bm, lcn, 0)) |
| image->inuse--; |
| } |
| } |
| if (nr_bad_clusters) |
| Printf("WARNING: The disk has %lld or more bad sectors" |
| " (hardware faults).\n", (long long)nr_bad_clusters); |
| free(rl_bad); |
| |
| ntfs_attr_put_search_ctx(ctx); |
| if (ntfs_inode_close(ni)) |
| perr_exit("ntfs_inode_close failed for $BadClus"); |
| } |
| |
| static void check_dest_free_space(u64 src_bytes) |
| { |
| u64 dest_bytes; |
| struct statvfs stvfs; |
| struct stat st; |
| |
| if (opt.metadata || opt.blkdev_out || opt.std_out) |
| return; |
| /* |
| * TODO: save_image needs a bit more space than src_bytes |
| * due to the free space encoding overhead. |
| */ |
| if (fstatvfs(fd_out, &stvfs) == -1) { |
| Printf("WARNING: Unknown free space on the destination: %s\n", |
| strerror(errno)); |
| return; |
| } |
| |
| /* If file is a FIFO then there is no point in checking the size. */ |
| if (!fstat(fd_out, &st)) { |
| if (S_ISFIFO(st.st_mode)) |
| return; |
| } else |
| Printf("WARNING: fstat failed: %s\n", strerror(errno)); |
| |
| dest_bytes = (u64)stvfs.f_frsize * stvfs.f_bfree; |
| if (!dest_bytes) |
| dest_bytes = (u64)stvfs.f_bsize * stvfs.f_bfree; |
| |
| if (dest_bytes < src_bytes) |
| err_exit("Destination doesn't have enough free space: " |
| "%llu MB < %llu MB\n", |
| (unsigned long long)rounded_up_division(dest_bytes, NTFS_MBYTE), |
| (unsigned long long)rounded_up_division(src_bytes, NTFS_MBYTE)); |
| } |
| |
| int main(int argc, char **argv) |
| { |
| ntfs_walk_clusters_ctx image; |
| s64 device_size; /* input device size in bytes */ |
| s64 ntfs_size; |
| unsigned int wiped_total = 0; |
| |
| /* make sure the layout of header is not affected by alignments */ |
| if (offsetof(struct image_hdr, offset_to_image_data) |
| != IMAGE_OFFSET_OFFSET) { |
| fprintf(stderr,"ntfsclone is not compiled properly. " |
| "Please fix\n"); |
| exit(1); |
| } |
| /* print to stderr, stdout can be an NTFS image ... */ |
| fprintf(stderr, "%s v%s (libntfs-3g)\n", EXEC_NAME, VERSION); |
| msg_out = stderr; |
| |
| parse_options(argc, argv); |
| |
| utils_set_locale(); |
| |
| if (opt.restore_image) { |
| device_size = open_image(); |
| ntfs_size = sle64_to_cpu(image_hdr.nr_clusters) * |
| le32_to_cpu(image_hdr.cluster_size); |
| } else { |
| device_size = open_volume(); |
| ntfs_size = vol->nr_clusters * vol->cluster_size; |
| } |
| // FIXME: This needs to be the cluster size... |
| ntfs_size += 512; /* add backup boot sector */ |
| full_device_size = device_size; |
| |
| if (opt.std_out) { |
| if ((fd_out = fileno(stdout)) == -1) |
| perr_exit("fileno for stdout failed"); |
| stream_out = stdout; |
| } else { |
| /* device_size_get() might need to read() */ |
| int flags = O_RDWR; |
| |
| if (!opt.blkdev_out) { |
| flags |= O_CREAT | O_TRUNC; |
| if (!opt.overwrite) |
| flags |= O_EXCL; |
| } |
| |
| if (opt.save_image || opt.metadata_image) { |
| stream_out = fopen(opt.output,"w"); |
| if (!stream_out) |
| perr_exit("Opening file '%s' failed", |
| opt.output); |
| fd_out = fileno(stream_out); |
| } else |
| if ((fd_out = open(opt.output, flags, |
| S_IRUSR | S_IWUSR)) == -1) |
| perr_exit("Opening file '%s' failed", |
| opt.output); |
| |
| if (!opt.save_image && !opt.metadata_image) |
| check_output_device(ntfs_size); |
| } |
| |
| if (opt.restore_image) { |
| print_image_info(); |
| restore_image(); |
| fsync_clone(fd_out); |
| exit(0); |
| } |
| |
| setup_lcn_bitmap(); |
| memset(&image, 0, sizeof(image)); |
| backup_clusters.image = ℑ |
| |
| walk_clusters(vol, &backup_clusters); |
| compare_bitmaps(&lcn_bitmap); |
| print_disk_usage("", vol->cluster_size, vol->nr_clusters, image.inuse); |
| |
| check_dest_free_space(vol->cluster_size * image.inuse); |
| |
| ignore_bad_clusters(&image); |
| |
| if (opt.save_image) |
| initialise_image_hdr(device_size, image.inuse); |
| |
| if ((opt.std_out && !opt.metadata_image) || !opt.metadata) { |
| s64 nr_clusters_to_save = image.inuse; |
| if (opt.std_out && !opt.save_image) |
| nr_clusters_to_save = vol->nr_clusters; |
| nr_clusters_to_save++; /* account for the backup boot sector */ |
| |
| clone_ntfs(nr_clusters_to_save); |
| fsync_clone(fd_out); |
| if (opt.save_image) |
| fclose(stream_out); |
| ntfs_umount(vol,FALSE); |
| free(lcn_bitmap.bm); |
| exit(0); |
| } |
| |
| wipe = 1; |
| if (opt.metadata_image) { |
| initialise_image_hdr(device_size, image.inuse); |
| write_image_hdr(); |
| } else { |
| fsync_clone(fd_out); /* sync copy before mounting */ |
| opt.volume = opt.output; |
| /* 'force' again mount for dirty volumes (e.g. after resize). |
| FIXME: use mount flags to avoid potential side-effects in future */ |
| opt.force++; |
| ntfs_umount(vol,FALSE); |
| mount_volume(0 /*NTFS_MNT_NOATIME*/); |
| } |
| |
| free(lcn_bitmap.bm); |
| setup_lcn_bitmap(); |
| memset(&image, 0, sizeof(image)); |
| backup_clusters.image = ℑ |
| |
| walk_clusters(vol, &backup_clusters); |
| |
| Printf("Num of MFT records = %10lld\n", |
| (long long)vol->mft_na->initialized_size >> |
| vol->mft_record_size_bits); |
| Printf("Num of used MFT records = %10u\n", nr_used_mft_records); |
| |
| Printf("Wiped unused MFT data = %10u\n", wiped_unused_mft_data); |
| Printf("Wiped deleted MFT data = %10u\n", wiped_unused_mft); |
| Printf("Wiped resident user data = %10u\n", wiped_resident_data); |
| Printf("Wiped timestamp data = %10u\n", wiped_timestamp_data); |
| |
| wiped_total += wiped_unused_mft_data; |
| wiped_total += wiped_unused_mft; |
| wiped_total += wiped_resident_data; |
| wiped_total += wiped_timestamp_data; |
| Printf("Wiped totally = %10u\n", wiped_total); |
| |
| if (opt.metadata_image) |
| fclose(stream_out); |
| else |
| fsync_clone(fd_out); |
| ntfs_umount(vol,FALSE); |
| free(lcn_bitmap.bm); |
| return (0); |
| } |