-
Notifications
You must be signed in to change notification settings - Fork 593
/
exfatfs_meta.c
executable file
·1885 lines (1677 loc) · 71.5 KB
/
exfatfs_meta.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
** The Sleuth Kit
**
** Copyright (c) 2013 Basis Technology Corp. All rights reserved
** Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
**
** This software is distributed under the Common Public License 1.0
**
*/
/*
* This code makes use of research presented in the following paper:
* "Reverse Engineering the exFAT File System" by Robert Shullich
* Retrieved May 2013 from:
* http://www.sans.org/reading_room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system_33274
*
* Some additional details concerning TexFAT were obtained in May 2013
* from:
* http://msdn.microsoft.com/en-us/library/ee490643(v=winembedded.60).aspx
*/
/**
* \file exfatfs_meta.c
* Contains the internal TSK exFAT file system code to access the data in the
* metadata data category as defined in the book "File System Forensic
* Analysis" by Brian Carrier (pp. 174-175).
*/
#include "tsk_exfatfs.h" /* Included first to make sure it stands alone. */
#include "tsk_fs_i.h"
#include "tsk_fatfs.h"
#include <assert.h>
/**
* \internal
* Checks whether a specified cluster is allocated according to the allocation
* bitmap of an exFAT file system.
*
* @param [in] a_fatfs A FATFS_INFO struct representing an exFAT file system.
* @param [in] a_cluster_addr The cluster address of the cluster to check.
* @return 1 if the cluster is allocated, 0 if the cluster is not allocated,
* or -1 if an error occurs.
*/
int8_t
exfatfs_is_cluster_alloc(FATFS_INFO *a_fatfs, TSK_DADDR_T a_cluster_addr)
{
const char *func_name = "exfatfs_is_clust_alloc";
TSK_FS_INFO *fs = &(a_fatfs->fs_info);
TSK_DADDR_T bitmap_byte_offset = 0;
uint8_t bitmap_byte;
ssize_t bytes_read = 0;
if (fatfs_ptr_arg_is_null(a_fatfs, "a_fatfs", func_name)) {
return -1;
}
if ((a_cluster_addr < FATFS_FIRST_CLUSTER_ADDR) || (a_cluster_addr > a_fatfs->lastclust)) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr("%s: cluster address %" PRIuINUM " out of range", func_name, a_cluster_addr);
return -1;
}
/* Normalize the cluster address. */
a_cluster_addr = a_cluster_addr - FATFS_FIRST_CLUSTER_ADDR;
/* Determine the offset of the byte in the allocation bitmap that contains
* the bit for the specified cluster. */
bitmap_byte_offset = (a_fatfs->EXFATFS_INFO.first_sector_of_alloc_bitmap * a_fatfs->ssize) + (a_cluster_addr / 8);
/* Read the byte. */
bytes_read = tsk_fs_read(fs, bitmap_byte_offset, (char*)&bitmap_byte, 1);
if (bytes_read != 1) {
if (bytes_read >= 0) {
tsk_error_reset();
tsk_error_set_errno(TSK_ERR_FS_READ);
}
tsk_error_set_errstr2("%s: failed to read bitmap byte at offset %" PRIuINUM "", func_name, bitmap_byte_offset);
return -1;
}
/* Check the bit that corresponds to the specified cluster. Note that this
* computation does not yield 0 or 1. */
if (bitmap_byte & (1 << (a_cluster_addr % 8))) {
return 1;
}
else {
return 0;
}
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT volume label
* directory entry.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @returns 1 if the directory entry buffer likely contains a volume label
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_vol_label_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc)
{
const char *func_name = "exfatfs_is_vol_label_dentry";
EXFATFS_VOL_LABEL_DIR_ENTRY *dentry = (EXFATFS_VOL_LABEL_DIR_ENTRY*)a_dentry;
uint8_t i = 0;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL) {
return 0;
}
/* There should be a single volume label directory entry at the
* beginning of the root directory, so check the allocation status, if
* known, of the cluster from which the buffer was filled. */
if (a_cluster_is_alloc == FATFS_DATA_UNIT_ALLOC_STATUS_UNALLOC) {
return 0;
}
if(exfatfs_get_alloc_status_from_type(dentry->entry_type) == 1){
/* There is supposed to be a label, check its length. */
if ((dentry->volume_label_length_chars < 1) || (dentry->volume_label_length_chars > EXFATFS_MAX_VOLUME_LABEL_LEN_CHAR)) {
if (tsk_verbose) {
fprintf(stderr, "%s: incorrect volume label length\n", func_name);
}
return 0;
}
}
else {
/* There is supposed to be no label, check for a zero in the length
* field. */
if (dentry->volume_label_length_chars != 0x00) {
if (tsk_verbose) {
fprintf(stderr, "%s: volume label length non-zero for no label entry\n", func_name);
}
return 0;
}
/* Every byte of the UTF-16 volume label string should be 0. */
for (i = 0; i < EXFATFS_MAX_VOLUME_LABEL_LEN_BYTE; ++i) {
if (dentry->volume_label[i] != 0x00) {
if (tsk_verbose) {
fprintf(stderr, "%s: non-zero byte in label for no label entry\n", func_name);
}
return 0;
}
}
}
return 1;
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT volume GUID
* directory entry.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @returns 1 if the directory entry buffer likely contains a volume GUID
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_vol_guid_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
{
const char *func_name = "exfatfs_is_vol_guid_dentry";
EXFATFS_VOL_GUID_DIR_ENTRY *dentry = (EXFATFS_VOL_GUID_DIR_ENTRY*)a_dentry;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID) {
return 0;
}
/* There is not enough data in a volume GUID directory entry to test
* anything but the entry type byte. However, a volume GUID directory
* entry should be in allocated space, so check the allocation status, if
* known, of the cluster from which the buffer was filled to reduce false
* positives. */
return ((a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_ALLOC) ||
(a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_UNKNOWN));
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT allocation bitmap
* directory entry. The test will be more reliable if an optional FATFS_INFO
* struct representing the file system is provided.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @param [in] a_fatfs A FATFS_INFO struct representing an exFAT file system,
* may be NULL.
* @returns 1 if the directory entry buffer likely contains an allocation
* bitmap directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_alloc_bitmap_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
{
const char *func_name = "exfatfs_is_alloc_bitmap_dentry";
EXFATFS_ALLOC_BITMAP_DIR_ENTRY *dentry = (EXFATFS_ALLOC_BITMAP_DIR_ENTRY*)a_dentry;
uint32_t first_cluster_of_bitmap = 0;
uint64_t length_of_alloc_bitmap_in_bytes = 0;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP) {
return 0;
}
/* There should be a single allocation bitmap directory entry near the the
* beginning of the root directory, so check the allocation status, if
* known, of the cluster from which the buffer was filled. */
if (a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_UNALLOC) {
return 0;
}
if (a_fatfs != NULL) {
/* The length of the allocation bitmap should be consistent with the
* number of clusters in the data area as specified in the volume boot
* record. */
length_of_alloc_bitmap_in_bytes = tsk_getu64(a_fatfs->fs_info.endian, dentry->length_of_alloc_bitmap_in_bytes);
if (length_of_alloc_bitmap_in_bytes != (a_fatfs->clustcnt + 7) / 8) {
if (tsk_verbose) {
fprintf(stderr, "%s: bitmap length incorrect\n", func_name);
}
return 0;
}
/* The first cluster of the bit map should be within the data area.
* It is usually in the first cluster. */
first_cluster_of_bitmap = tsk_getu32(a_fatfs->fs_info.endian, dentry->first_cluster_of_bitmap);
if ((first_cluster_of_bitmap < EXFATFS_FIRST_CLUSTER) ||
(first_cluster_of_bitmap > a_fatfs->lastclust)) {
if (tsk_verbose) {
fprintf(stderr, "%s: first cluster not in cluster heap\n", func_name);
}
return 0;
}
/* The first cluster of the allocation bitmap should be allocated (the
* other conditions allow this function to be safely used to look for
* the allocation bitmap during FATFS_INFO initialization, before a
* cluster allocation is possible). */
if ((a_fatfs->EXFATFS_INFO.first_sector_of_alloc_bitmap > 0) &&
(a_fatfs->EXFATFS_INFO.length_of_alloc_bitmap_in_bytes > 0) &&
(exfatfs_is_cluster_alloc(a_fatfs, (TSK_DADDR_T)first_cluster_of_bitmap) != 1)) {
if (tsk_verbose) {
fprintf(stderr,
"%s: first cluster of allocation bitmap not allocated\n", func_name);
}
return 0;
}
}
return 1;
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT upcase table
* directory entry. The test will be more reliable if an optional FATFS_INFO
* struct representing the file system is provided.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @param [in] a_fatfs A FATFS_INFO struct representing an exFAT file system,
* may be NULL.
* @returns 1 if the directory entry buffer likely contains an upcase table
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_upcase_table_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
{
const char *func_name = "exfatfs_is_upcase_table_dentry";
EXFATFS_UPCASE_TABLE_DIR_ENTRY *dentry = (EXFATFS_UPCASE_TABLE_DIR_ENTRY*)a_dentry;
uint64_t table_size = 0;
uint32_t first_cluster_of_table = 0;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE) {
return 0;
}
/* There should be a single upcase table directory entry near the the
* beginning of the root directory, so check the allocation status, if
* known, of the cluster from which the buffer was filled. */
if (a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_UNALLOC) {
return 0;
}
if (a_fatfs != NULL) {
/* Check the size of the table. */
table_size = tsk_getu64(a_fatfs->fs_info.endian, dentry->table_length_in_bytes);
if (table_size == 0) {
if (tsk_verbose) {
fprintf(stderr, "%s: table size is zero\n", func_name);
}
return 0;
}
/* Is the table size less than the size of the cluster heap
* (data area)? The cluster heap size is computed by multiplying the
* cluster size by the number of sectors in a cluster and then
* multiplying by the number of bytes in a sector (the last operation
* is optimized as a left shift by the base 2 log of sector size). */
if (table_size > (a_fatfs->clustcnt * a_fatfs->csize) << a_fatfs->ssize_sh) {
if (tsk_verbose) {
fprintf(stderr, "%s: table size too big\n", func_name);
}
return 0;
}
/* Is the address of the first cluster in range? */
first_cluster_of_table = tsk_getu32(a_fatfs->fs_info.endian, dentry->first_cluster_of_table);
if ((first_cluster_of_table < EXFATFS_FIRST_CLUSTER) ||
(first_cluster_of_table > a_fatfs->lastclust)) {
if (tsk_verbose) {
fprintf(stderr,
"%s: first cluster not in cluster heap\n", func_name);
}
return 0;
}
/* The first cluster of the table should be allocated. */
if (exfatfs_is_cluster_alloc(a_fatfs, (TSK_DADDR_T)first_cluster_of_table) != 1) {
if (tsk_verbose) {
fprintf(stderr,
"%s: first cluster of table not allocated\n", func_name);
}
return 0;
}
}
return 1;
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT TexFAT directory
* entry.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @returns 1 if the directory entry buffer likely contains a TexFAT directory
* entry, 0 otherwise.
*/
uint8_t
exfatfs_is_texfat_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
{
const char *func_name = "exfatfs_is_texfat_dentry";
EXFATFS_TEXFAT_DIR_ENTRY *dentry = (EXFATFS_TEXFAT_DIR_ENTRY*)a_dentry;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_TEXFAT) {
return 0;
}
/* There is not enough data in a TexFAT directory entry to test anything
* but the entry type byte. However, a TexFAT directory entry should be in
* allocated space, so check the allocation status, if known, of the
* cluster from which the buffer was filled to reduce false positives. */
return ((a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_ALLOC) ||
(a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_UNKNOWN));
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT access control
* table directory entry.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_alloc_status The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @returns 1 if the directory entry buffer likely contains an access control
* table entry, 0 otherwise.
*/
uint8_t
exfatfs_is_access_ctrl_table_dentry(FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
{
const char *func_name = "exfatfs_is_texfat_dentry";
EXFATFS_TEXFAT_DIR_ENTRY *dentry = (EXFATFS_TEXFAT_DIR_ENTRY*)a_dentry;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_TEXFAT) {
return 0;
}
/* There is not enough data in an access control table directory entry to
* test anything but the entry type byte. However, an access control table
* directory entry should be in allocated space, so check the allocation
* status, if known, of the cluster from which the buffer was filled to
* reduce false positives. */
return ((a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_ALLOC) ||
(a_alloc_status == FATFS_DATA_UNIT_ALLOC_STATUS_UNKNOWN));
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT file directory
* entry. The test will be more reliable if an optional TSK_ENDIAN_ENUM value
* is known. This function was split into two parts so that the main
* test can be run without a FATFS_INFO object.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_fatfs A FATFS_INFO struct representing an exFAT file system,
* may be NULL.
* @returns 1 if the directory entry buffer likely contains a file directory
* entry, 0 otherwise.
*/
uint8_t
exfatfs_is_file_dentry(FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
{
if (a_fatfs != NULL) {
TSK_FS_INFO *fs = &(a_fatfs->fs_info);
return exfatfs_is_file_dentry_standalone(a_dentry, fs->endian);
}
else {
return exfatfs_is_file_dentry_standalone(a_dentry, TSK_UNKNOWN_ENDIAN);
}
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT file directory
* entry. The test will be more reliable if an optional TSK_ENDIAN_ENUM value
* is known. This version of the function can be called without a TSK_FS_INFO
* object.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_endian Endianness of the file system
* @returns 1 if the directory entry buffer likely contains a file directory
* entry, 0 otherwise.
*/
uint8_t
exfatfs_is_file_dentry_standalone(FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian)
{
const char *func_name = "exfatfs_is_file_dentry";
EXFATFS_FILE_DIR_ENTRY *dentry = (EXFATFS_FILE_DIR_ENTRY*)a_dentry;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_FILE){
return 0;
}
/* A file directory entry is the first entry of a file directory entry set
* consisting of a file directory entry followed by a file stream directory
* entry and from 1 to 17 file name directory entries. The file stream and
* file name entries are called secondary entries. */
if (dentry->secondary_entries_count < EXFATFS_MIN_FILE_SECONDARY_DENTRIES_COUNT ||
dentry->secondary_entries_count > EXFATFS_MAX_FILE_SECONDARY_DENTRIES_COUNT) {
if (tsk_verbose) {
fprintf(stderr, "%s: secondary entries count out of range\n",
func_name);
}
return 0;
}
if (a_endian != TSK_UNKNOWN_ENDIAN) {
/* Make sure the time stamps aren't all zeros. */
if ((tsk_getu16(a_endian, dentry->modified_date) == 0) &&
(tsk_getu16(a_endian, dentry->modified_time) == 0) &&
(dentry->modified_time_tenths_of_sec == 0) &&
(tsk_getu16(a_endian, dentry->created_date) == 0) &&
(tsk_getu16(a_endian, dentry->created_time) == 0) &&
(dentry->created_time_tenths_of_sec == 0) &&
(tsk_getu16(a_endian, dentry->accessed_date) == 0) &&
(tsk_getu16(a_endian, dentry->accessed_time) == 0)) {
if (tsk_verbose) {
fprintf(stderr, "%s: time stamps all zero\n",
func_name);
}
return 0;
}
}
return 1;
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT file stream
* directory entry. The test will be more reliable if an optional FATFS_INFO
* struct representing the file system is provided. This function was
* split into two parts so that the main test can be run
* without a FATFS_INFO object.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_fatfs A FATFS_INFO struct representing an exFAT file system,
* may be NULL.
* @returns 1 if the directory entry buffer likely contains a file stream
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_file_stream_dentry(FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
{
TSK_FS_INFO *fs = NULL;
uint64_t cluster_heap_size = 0;
if (a_fatfs != NULL) {
fs = &(a_fatfs->fs_info);
/* Calculate the size of the cluster heap. The cluster heap size
* is computed by multiplying the cluster size
* by the number of sectors in a cluster and then
* multiplying by the number of bytes in a sector (the last operation
* is optimized as a left shift by the base 2 log of sector size). */
cluster_heap_size = (a_fatfs->clustcnt * a_fatfs->csize) << a_fatfs->ssize_sh;
return exfatfs_is_file_stream_dentry_standalone(a_dentry, fs->endian, cluster_heap_size, a_fatfs->lastclust);
}
else{
return exfatfs_is_file_stream_dentry_standalone(a_dentry, TSK_UNKNOWN_ENDIAN, 0, 0);
}
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT file stream
* directory entry. The test will be more reliable if the optional endianness
* and cluster information are used. This version of the function can be
* called without a TSK_FS_INFO object.
*
* The endianness must be known to run all of the extended tests. The other
* parameters can be set to zero if unknown and the function will run whichever
* tests are possible with the given information.
*
* @param [in] a_dentry A directory entry buffer.
* @param [in] a_endian Endianness of the file system
* @param [in] a_cluster_heap_size Size of the cluster heap (in bytes)
* @param [in] a_last_cluster Last cluster in the file system
* @returns 1 if the directory entry buffer likely contains a file stream
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_file_stream_dentry_standalone(FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian,
uint64_t a_cluster_heap_size, TSK_DADDR_T a_last_cluster)
{
const char *func_name = "exfatfs_is_file_stream_dentry";
EXFATFS_FILE_STREAM_DIR_ENTRY *dentry = (EXFATFS_FILE_STREAM_DIR_ENTRY*)a_dentry;
uint64_t file_size = 0;
uint32_t first_cluster = 0;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* Check the entry type byte. */
if (exfatfs_get_enum_from_type(dentry->entry_type) != EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM) {
return 0;
}
if (a_endian != TSK_UNKNOWN_ENDIAN) {
/* Check the size. */
file_size = tsk_getu64(a_endian, dentry->data_length);
if (file_size > 0) {
/* Is the file size less than the size of the cluster heap
* (data area)? The cluster heap size is computed by multiplying the
* cluster size by the number of sectors in a cluster and then
* multiplying by the number of bytes in a sector (the last operation
* is optimized as a left shift by the base 2 log of sector size). */
if(a_cluster_heap_size > 0){
if (file_size > a_cluster_heap_size) {
if (tsk_verbose) {
fprintf(stderr, "%s: file size too big\n", func_name);
}
return 0;
}
}
/* Is the address of the first cluster in range? */
first_cluster = tsk_getu32(a_endian, dentry->first_cluster_addr);
if ((first_cluster < EXFATFS_FIRST_CLUSTER) ||
((a_last_cluster > 0) && (first_cluster > a_last_cluster))) {
if (tsk_verbose) {
fprintf(stderr,
"%s: first cluster not in cluster heap\n", func_name);
}
return 0;
}
}
}
return 1;
}
/**
* \internal
* Determine whether the contents of a buffer may be an exFAT file name
* directory entry.
*
* @param [in] a_dentry A directory entry buffer.
* @returns 1 if the directory entry buffer likely contains an file name
* directory entry, 0 otherwise.
*/
uint8_t
exfatfs_is_file_name_dentry(FATFS_DENTRY *a_dentry)
{
const char *func_name = "exfatfs_is_file_name_dentry";
EXFATFS_FILE_NAME_DIR_ENTRY *dentry = (EXFATFS_FILE_NAME_DIR_ENTRY*)a_dentry;
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
/* There is not enough data in a file name directory entry
* to test anything but the entry type byte. */
return (exfatfs_get_enum_from_type(dentry->entry_type) == EXFATFS_DIR_ENTRY_TYPE_FILE_NAME);
}
/**
* \internal
* Determine whether a buffer likely contains a directory entry.
* For the most reliable results, request the in-depth test.
*
* @param [in] a_fatfs Source file system for the directory entry.
* @param [in] a_dentry Buffer that may contain a directory entry.
* @param [in] a_cluster_is_alloc The allocation status, possibly unknown, of the
* cluster from which the buffer was filled.
* @param [in] a_do_basic_tests_only Whether to do basic or in-depth testing.
* @return 1 if the buffer likely contains a directory entry, 0 otherwise
*/
uint8_t
exfatfs_is_dentry(FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)
{
const char *func_name = "exfatfs_is_dentry";
if (fatfs_ptr_arg_is_null(a_dentry, "a_dentry", func_name)) {
return 0;
}
switch (exfatfs_get_enum_from_type(a_dentry->data[0]))
{
case EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL:
return exfatfs_is_vol_label_dentry(a_dentry, a_cluster_is_alloc);
case EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID:
return exfatfs_is_vol_guid_dentry(a_dentry, a_cluster_is_alloc);
case EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP:
return exfatfs_is_alloc_bitmap_dentry(a_dentry, a_cluster_is_alloc, a_fatfs);
case EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE:
return exfatfs_is_upcase_table_dentry(a_dentry, a_cluster_is_alloc, a_fatfs);
case EXFATFS_DIR_ENTRY_TYPE_TEXFAT:
return exfatfs_is_texfat_dentry(a_dentry, a_cluster_is_alloc);
case EXFATFS_DIR_ENTRY_TYPE_ACT:
return exfatfs_is_access_ctrl_table_dentry(a_dentry, a_cluster_is_alloc);
case EXFATFS_DIR_ENTRY_TYPE_FILE:
return exfatfs_is_file_dentry(a_dentry, a_fatfs);
case EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM:
return exfatfs_is_file_stream_dentry(a_dentry, a_fatfs);
case EXFATFS_DIR_ENTRY_TYPE_FILE_NAME:
return exfatfs_is_file_name_dentry(a_dentry);
default:
return 0;
}
}
/**
* \internal
* Construct a single, non-resident data run for the TSK_FS_META object of a
* TSK_FS_FILE object.
*
* @param [in, out] a_fs_file Generic file with generic inode structure (TSK_FS_META).
* @return 0 on success, 1 on failure, per TSK convention
*/
static uint8_t
exfatfs_make_contiguous_data_run(TSK_FS_FILE *a_fs_file)
{
const char *func_name = "exfatfs_make_contiguous_data_run";
TSK_FS_META *fs_meta = NULL;
TSK_FS_INFO *fs = NULL;
FATFS_INFO *fatfs = NULL;
TSK_DADDR_T first_cluster = 0;
TSK_FS_ATTR_RUN *data_run;
TSK_FS_ATTR *fs_attr = NULL;
// TSK_OFF_T alloc_size = 0;
assert(a_fs_file != NULL);
assert(a_fs_file->meta != NULL);
assert(a_fs_file->fs_info != NULL);
fs_meta = a_fs_file->meta;
fs = (TSK_FS_INFO*)a_fs_file->fs_info;
fatfs = (FATFS_INFO*)fs;
if (tsk_verbose) {
tsk_fprintf(stderr,
"%s: Loading attrs for inode: %" PRIuINUM
"\n", func_name, a_fs_file->meta->addr);
}
/* Get the stashed first cluster address of the file. If the address does
* not make sense, set the attribute state to TSK_FS_META_ATTR_ERROR so
* that there is no subsequent attempt to load a data run for this
* file object. */
first_cluster = ((TSK_DADDR_T*)fs_meta->content_ptr)[0];
if ((first_cluster > (fatfs->lastclust)) &&
(FATFS_ISEOF(first_cluster, fatfs->mask) == 0)) {
fs_meta->attr_state = TSK_FS_META_ATTR_ERROR;
tsk_error_reset();
if (fs_meta->flags & TSK_FS_META_FLAG_UNALLOC) {
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
}
else {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
}
tsk_error_set_errstr
("%s: Starting cluster address too large: %"
PRIuDADDR, func_name, first_cluster);
return 1;
}
/* Figure out the allocated size of the file. The minimum allocation unit
* for exFAT is a cluster, so the the roundup() function is used to round
* up the file size in bytes to a multiple of cluser size in bytes. */
// alloc_size = roundup(fs_meta->size, (fatfs->csize * fs->block_size));
/* Allocate an attribute list for the file. */
fs_meta->attr = tsk_fs_attrlist_alloc();
/* Allocate a non-resident attribute for the file and add it to the
* attribute list. */
if ((fs_attr = tsk_fs_attrlist_getnew(fs_meta->attr,
TSK_FS_ATTR_NONRES)) == NULL) {
return 1;
}
/* Allocate a single data run for the attribute. For exFAT, a data run is
* a contiguous run of sectors. */
data_run = tsk_fs_attr_run_alloc();
if (data_run == NULL) {
return 1;
}
/* Set the starting sector address of the run and the length of the run
* in sectors. */
data_run->addr = FATFS_CLUST_2_SECT(fatfs, first_cluster);
data_run->len = roundup(fs_meta->size,
(fatfs->csize * fs->block_size)) / fs->block_size;
/* Add the data run to the attribute and add the attribute to the
* attribute list. Note that the initial size and the allocation
* size are the same for exFAT. */
if (tsk_fs_attr_set_run(a_fs_file, fs_attr, data_run, NULL,
TSK_FS_ATTR_TYPE_DEFAULT, TSK_FS_ATTR_ID_DEFAULT,
fs_meta->size,
fs_meta->size,
data_run->len * fs->block_size,
TSK_FS_ATTR_FLAG_NONE, 0)) {
return 1;
}
/* Mark the attribute list as loaded. */
fs_meta->attr_state = TSK_FS_META_ATTR_STUDIED;
return 0;
}
/**
* \internal
* Use a volume label directory entry corresponding to the exFAT
* equivalent of an inode to populate the TSK_FS_META object of a
* TSK_FS_FILE object.
*
* @param [in] a_fatfs Source file system for the directory entry.
* @param [in] a_inum Address of the inode.
* @param [in] a_dentry A volume label directory entry.
* @param a_fs_file Generic file with generic inode structure (TSK_FS_META).
* @return TSK_RETVAL_ENUM.
*/
static TSK_RETVAL_ENUM
exfatfs_copy_vol_label_inode(FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, TSK_FS_FILE *a_fs_file)
{
EXFATFS_VOL_LABEL_DIR_ENTRY *dentry = NULL;
assert(a_fatfs != NULL);
assert(fatfs_inum_is_in_range(a_fatfs, a_inum));
assert(a_dentry != NULL);
assert(a_fs_file != NULL);
assert(a_fs_file->meta != NULL);
dentry = (EXFATFS_VOL_LABEL_DIR_ENTRY*)a_dentry;
assert(exfatfs_get_enum_from_type(dentry->entry_type) == EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL);
/* If there is a volume label, copy it to the name field of the
* TSK_FS_META structure. */
if (exfatfs_get_alloc_status_from_type(dentry->entry_type) == 1) {
if (fatfs_utf16_inode_str_2_utf8(a_fatfs, (UTF16*)dentry->volume_label, (size_t)dentry->volume_label_length_chars,
(UTF8*)a_fs_file->meta->name2->name, sizeof(a_fs_file->meta->name2->name), a_inum, "volume label") != TSKconversionOK) {
return TSK_COR;
}
}
else {
strcpy(a_fs_file->meta->name2->name, EXFATFS_EMPTY_VOLUME_LABEL_DENTRY_NAME);
}
return TSK_OK;
}
/**
* \internal
* Use an allocation bitmap directory entry corresponding to the exFAT
* equivalent of an inode to populate the TSK_FS_META object of a
* TSK_FS_FILE object.
*
* @param a_fatfs [in] Source file system for the directory entries.
* @param [in] a_dentry An allocation bitmap directory entry.
* @param a_fs_file [in, out] Generic file with generic inode structure (TSK_FS_META).
* @return TSK_RETVAL_ENUM.
*/
static TSK_RETVAL_ENUM
exfatfs_copy_alloc_bitmap_inode(FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, TSK_FS_FILE *a_fs_file)
{
EXFATFS_ALLOC_BITMAP_DIR_ENTRY *dentry = NULL;
assert(a_fatfs != NULL);
assert(a_dentry != NULL);
assert(a_fs_file != NULL);
assert(a_fs_file->meta != NULL);
dentry = (EXFATFS_ALLOC_BITMAP_DIR_ENTRY*)a_dentry;
assert(exfatfs_get_enum_from_type(dentry->entry_type) == EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP);
/* Set the file name to a descriptive pseudo file name. */
strcpy(a_fs_file->meta->name2->name, EXFATFS_ALLOC_BITMAP_DENTRY_NAME);
/* Set the size of the allocation bitmap and the address of its
* first cluster. */
((TSK_DADDR_T*)a_fs_file->meta->content_ptr)[0] = FATFS_SECT_2_CLUST(a_fatfs, a_fatfs->EXFATFS_INFO.first_sector_of_alloc_bitmap);
a_fs_file->meta->size = a_fatfs->EXFATFS_INFO.length_of_alloc_bitmap_in_bytes;
/* There is no FAT chain walk for the allocation bitmap. Do an eager
* load instead of a lazy load of its data run. */
if (exfatfs_make_contiguous_data_run(a_fs_file)) {
return TSK_ERR;
}
return TSK_OK;
}
/**
* \internal
* Use an UP-Case table directory entry corresponding to the exFAT equivalent
* of an inode to populate the TSK_FS_META object of a TSK_FS_FILE object.
*
* @param a_fatfs [in] Source file system for the directory entries.
* @param [in] a_dentry An upcase table directory entry.
* @param a_fs_file [in, out] Generic file with generic inode structure (TSK_FS_META).
* @return TSK_RETVAL_ENUM.
*/
static TSK_RETVAL_ENUM
exfatfs_copy_upcase_table_inode(FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, TSK_FS_FILE *a_fs_file)
{
EXFATFS_UPCASE_TABLE_DIR_ENTRY *dentry = NULL;
assert(a_fatfs != NULL);
assert(a_dentry != NULL);
assert(a_fs_file != NULL);
assert(a_fs_file->meta != NULL);
dentry = (EXFATFS_UPCASE_TABLE_DIR_ENTRY*)a_dentry;
assert(exfatfs_get_enum_from_type(dentry->entry_type) == EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE);
strcpy(a_fs_file->meta->name2->name, EXFATFS_UPCASE_TABLE_DENTRY_NAME);
/* Set the size of the Up-Case table and the address of its
* first cluster. */((TSK_DADDR_T*)a_fs_file->meta->content_ptr)[0] = tsk_getu32(a_fatfs->fs_info.endian, dentry->first_cluster_of_table);
a_fs_file->meta->size = tsk_getu64(a_fatfs->fs_info.endian, dentry->table_length_in_bytes);
/* There is no FAT chain walk for the upcase table. Do an eager
* load instead of a lazy load of its data run. */
if (exfatfs_make_contiguous_data_run(a_fs_file)) {
return TSK_ERR;
}
return TSK_OK;
}
/**
* \internal
* Given an inode address, load the corresponding directory entry and test
* to see if it's an exFAT file stream directory entry.
*
* @param a_fatfs [in] Source file system for the directory entries.
* @param a_stream_entry_inum [in] The inode address associated with the
* supposed file stream entry.
* @param a_sector_is_alloc [in] The allocation status of the sector that
* contains the supposed file stream entry.
* @param a_file_dentry_type [in] The companion file entry type,
* i.e., deleted or not.
* @param a_dentry [in, out] A directory entry structure. The stream
* entry, if found, will be loaded into it.
* @return 0 on success, 1 on failure, per TSK convention
*/
static uint8_t
exfatfs_load_file_stream_dentry(FATFS_INFO *a_fatfs,
TSK_INUM_T a_stream_entry_inum, uint8_t a_sector_is_alloc,
EXFATFS_DIR_ENTRY_TYPE a_file_dentry_type,
FATFS_DENTRY *a_dentry)
{
assert(a_fatfs != NULL);
assert(fatfs_inum_is_in_range(a_fatfs, a_stream_entry_inum));
assert(a_dentry != NULL);
if (fatfs_dentry_load(a_fatfs, a_dentry, a_stream_entry_inum) == 0 &&
exfatfs_is_dentry(a_fatfs, a_dentry, (FATFS_DATA_UNIT_ALLOC_STATUS_ENUM)a_sector_is_alloc, a_sector_is_alloc)) {
/* If the bytes at the specified inode address are a file stream entry
* with the same allocation status as the file entry, report success. */
if((exfatfs_get_alloc_status_from_type(a_file_dentry_type) == exfatfs_get_alloc_status_from_type(a_dentry->data[0])) &&
(exfatfs_get_enum_from_type(a_file_dentry_type) == EXFATFS_DIR_ENTRY_TYPE_FILE) &&
(exfatfs_get_enum_from_type(a_dentry->data[0]) == EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM)) {
return 0;
}
}
memset((void*)a_dentry, 0, sizeof(FATFS_DENTRY));
return 1;
}
/**
* \internal
* Given an exFAT directory entry, try to find the corresponding file
* stream directory or file name directory entry that follows it and
* return the inum.
*
* @param [in] a_fatfs Source file system for the directory entries.
* @param [in] a_current_entry_inum The inode address associated with the current
* entry.
* @param [in] a_file_dentry The file entry type (only use deleted or not)
* @param [in] a_next_dentry_type The type of the dentry we're searching for
* @param [out] a_next_inum The inode of the next stream/file name directory entry will be stored here (if found)
* @return 0 on success, 1 on failure, per TSK convention
*/
static uint8_t
exfatfs_next_dentry_inum(FATFS_INFO *a_fatfs, TSK_INUM_T a_current_entry_inum,
EXFATFS_FILE_DIR_ENTRY *a_file_dentry, EXFATFS_DIR_ENTRY_TYPE_ENUM a_next_dentry_type,
TSK_INUM_T * a_next_inum)
{
int8_t alloc_check_ret_val = 0;
uint8_t cluster_is_alloc = 0;
TSK_DADDR_T sector = 0;
TSK_DADDR_T cluster = 0;
TSK_DADDR_T cluster_base_sector = 0;
TSK_DADDR_T last_entry_offset = 0;
TSK_DADDR_T file_entry_offset = 0;
TSK_DADDR_T next_cluster = 0;
FATFS_DENTRY temp_dentry;
assert(a_fatfs != NULL);
assert(fatfs_inum_is_in_range(a_fatfs, a_current_entry_inum));
assert(a_file_dentry != NULL);
/* Only look for file stream and file name directory entries */
if((a_next_dentry_type != EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM) &&
(a_next_dentry_type != EXFATFS_DIR_ENTRY_TYPE_FILE_NAME)){
return FATFS_FAIL;
}
sector = FATFS_INODE_2_SECT(a_fatfs, a_current_entry_inum);
cluster = FATFS_SECT_2_CLUST(a_fatfs, sector);
alloc_check_ret_val = exfatfs_is_cluster_alloc(a_fatfs, cluster);
if (alloc_check_ret_val != -1) {