use real cluster size for undelete command

thewhiteninja · Jul 22, 2023 · 958ae00 · 958ae00
1 parent 8aa1a26
commit 958ae00
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/Sources/Commands/command_undelete.cpp b/Sources/Commands/command_undelete.cpp
@@ -100,8 +100,8 @@ int print_deleted_files(std::shared_ptr<Disk> disk, std::shared_ptr<Volume> vol,
 
 	std::shared_ptr<NTFSExplorer> explorer = std::make_shared<NTFSExplorer>(vol);
 
-	DWORD cluster_size = ((PBOOT_SECTOR_NTFS)explorer->reader()->boot_record())->bytePerSector * ((PBOOT_SECTOR_NTFS)explorer->reader()->boot_record())->sectorPerCluster;
-	DWORD record_size = ((PBOOT_SECTOR_NTFS)explorer->reader()->boot_record())->clusterPerRecord >= 0 ? ((PBOOT_SECTOR_NTFS)explorer->reader()->boot_record())->clusterPerRecord * cluster_size : 1 << -((PBOOT_SECTOR_NTFS)explorer->reader()->boot_record())->clusterPerRecord;
+	DWORD cluster_size = explorer->reader()->sizes.cluster_size;
+	DWORD record_size = explorer->reader()->sizes.record_size;
 
 	std::shared_ptr<MFTRecord> record = explorer->mft()->record_from_number(0);
 	ULONG64 total_size = record->datasize();