Lines Matching refs:file
24 * distribution in the file COPYING); if not, write to the Free Software
119 static short avoid_duplicate_printing; /* Flag No duplicate printing of file infos */
423 " -T, --truncate Truncate 100%% recoverable file to exact size.\n"
426 " -c, --copy RANGE Write a range of MFT records to a file\n"
894 * free_file - Release the resources used by a file object
895 * @file: The unwanted file object
897 * This will free up the memory used by a file object and iterate through the
902 static void free_file(struct ufile *file)
906 if (!file)
909 ntfs_list_for_each_safe(item, tmp, &file->name) {
925 ntfs_list_for_each_safe(item, tmp, &file->data) {
937 free(file->mft);
938 free(file);
942 * verify_parent - confirm a record is parent of a file
943 * @name: a filename of the file
946 * Check that @rec is the parent of the file represented by @name.
1007 * get_parent_name - Find the name of a file's parent.
1061 * Rescue the last deleted name of a file
1118 ntfs_log_verbose("Recovered file name %s\n",
1130 * @file: The file object to work with
1132 * A single file may have more than one filename. This is quite common.
1137 * linked list of filenames in the file object. For convenience, the unicode
1147 static int get_filenames(struct ufile *file, ntfs_volume* vol)
1156 if (!file)
1159 ctx = ntfs_attr_get_search_ctx(NULL, file->mft);
1202 file->pref_name = name->name;
1203 file->pref_pname = name->parent_name;
1207 file->max_size = max(file->max_size, name->size_alloc);
1208 file->max_size = max(file->max_size, name->size_data);
1210 ntfs_list_add_tail(&name->list, &file->name);
1215 name = rescue_name(file->mft,ctx);
1218 file->pref_name = name->name;
1238 ntfs_list_add_tail(&name->list, &file->name);
1249 * @file: The file object to work with
1252 * A file may have more than one data stream. All files will have an unnamed
1253 * data stream which contains the file's data. Some Windows applications store
1257 * list of data streams in the file object.
1262 static int get_data(struct ufile *file, ntfs_volume *vol)
1269 if (!file)
1272 ctx = ntfs_attr_get_search_ctx(NULL, file->mft);
1317 file->max_size = max(file->max_size, data->size_data);
1318 file->max_size = max(file->max_size, data->size_init);
1320 ntfs_list_add_tail(&data->list, &file->data);
1343 struct ufile *file;
1350 file = calloc(1, sizeof(*file));
1351 if (!file) {
1356 NTFS_INIT_LIST_HEAD(&file->name);
1357 NTFS_INIT_LIST_HEAD(&file->data);
1358 file->inode = record;
1360 file->mft = malloc(vol->mft_record_size);
1361 if (!file->mft) {
1363 free_file(file);
1370 free_file(file);
1374 if (ntfs_attr_mst_pread(mft, vol->mft_record_size * record, 1, vol->mft_record_size, file->mft) < 1) {
1377 free_file(file);
1386 attr10 = find_first_attribute(AT_STANDARD_INFORMATION, file->mft);
1387 attr20 = find_first_attribute(AT_ATTRIBUTE_LIST, file->mft);
1388 attr90 = find_first_attribute(AT_INDEX_ROOT, file->mft);
1396 file->date = ntfs2timespec(si->last_data_change_time).tv_sec;
1400 file->attr_list = 1;
1402 file->directory = 1;
1404 if (get_filenames(file, vol) < 0) {
1407 if (get_data(file, vol) < 0) {
1413 return file;
1417 * calc_percentage - Calculate how much of the file is recoverable
1418 * @file: The file object to work with
1423 * recovery. The data may have still been overwritten by a another file which
1435 * Return: n The percentage of the file that _could_ be recovered
1438 static int calc_percentage(struct ufile *file, ntfs_volume *vol)
1448 if (!file || !vol)
1451 if (file->directory) {
1456 if (ntfs_list_empty(&file->data)) {
1461 ntfs_list_for_each(pos, &file->data) {
1534 file->inode);
1550 * @file: The file to work with
1552 * Output the contents of the file object. This will print everything that has
1563 static void dump_record(struct ufile *file)
1569 if (!file)
1572 ntfs_log_quiet("MFT Record %lld\n", file->inode);
1573 ntfs_log_quiet("Type: %s\n", (file->directory) ? "Directory" : "File");
1574 strftime(buffer, sizeof(buffer), "%F %R", localtime(&file->date));
1577 if (file->attr_list)
1580 ntfs_list_for_each(item, &file->name) {
1629 ntfs_list_for_each(item, &file->data) {
1665 * list_record - Print a one line summary of the file
1666 * @file: The file to work with
1668 * Print a one line description of a file.
1672 * The output will contain the file's inode number (MFT Record), some flags,
1673 * the percentage of the file that is recoverable, the last modification date,
1679 * N.B. The file size is stored in many forms in several attributes. This
1687 static void list_record(struct ufile *file)
1697 strftime(buffer, sizeof(buffer), "%F %R", localtime(&file->date));
1699 if (file->attr_list)
1702 if (file->directory)
1707 ntfs_list_for_each(item, &file->data) {
1727 if (file->pref_name)
1728 name = file->pref_name;
1733 file->inode, flagd, flagr, flagc, flagx,
1739 * name_match - Does a file have a name matching a regex
1741 * @file: The file to be tested
1743 * Iterate through the file's $FILENAME attributes and compare them against the
1749 static int name_match(regex_t *re, struct ufile *file)
1754 if (!re || !file)
1757 ntfs_list_for_each(item, &file->name) {
1777 ntfs_log_debug("Filename '%s' doesn't match regex.\n", file->pref_name);
1787 * Write a block of data to a file descriptor.
1818 * create_pathname - Create a path/file from some components
1819 * @dir: Directory in which to create the file (optional)
1820 * @name: Filename to give the file (optional)
1826 * dir/file
1827 * dir/file:stream
1828 * file
1829 * file:stream
1832 * used. If the directory is missing the file will be created in the current
1891 * open_file - Open a file to write to
1892 * @pathname: Path, name and stream of the file to open
1894 * Create a file and return the file descriptor.
1896 * N.B. If option force is given and existing file will be overwritten.
1898 * Return: -1 Error, failed to create the file
1899 * n Success, this is the file descriptor
1905 ntfs_log_verbose("Creating file: %s\n", pathname);
1919 * set_date - Set the file's date and time
1920 * @pathname: Path and name of the file to alter
1923 * Give a file a particular date and time.
1925 * Return: 1 Success, set the file's date and time
1926 * 0 Error, failed to change the file's date and time
1938 ntfs_log_error("ERROR: Couldn't set the file's date and time\n");
1945 * undelete_file - Recover a deleted file from an NTFS volume
1953 * Each data stream will be recovered and saved to a file. The file's name will
1957 * The output file's name and location can be altered by using the command line
1961 * file was deleted.
1971 struct ufile *file;
1986 file = read_record(vol, inode);
1987 if (!file || !file->mft) {
1992 /* if flag was not set, print file informations */
1995 dump_record(file);
1997 list_record(file);
2008 * list_record(). Otherwise, when undeleting, a file will always be
2011 if (file->mft->flags & MFT_RECORD_IN_USE) {
2015 free_file(file);
2021 if (calc_percentage(file, vol) == 0) {
2026 if (ntfs_list_empty(&file->data)) {
2031 ntfs_list_for_each(item, &file->data) {
2038 if (file->pref_name)
2039 name = file->pref_name;
2042 (long long)file->inode);
2050 ntfs_log_perror("Couldn't create file %s",
2080 ntfs_log_perror("Couldn't create file %s",
2165 * cluster_count * vol->cluster_size == data->size_alloc THEN file
2179 } else ntfs_log_quiet("Truncation not performed because file has an "
2189 set_date(pathname, file->date);
2192 file->pref_name, d->name, pathname);
2195 file->pref_name, pathname);
2201 free_file(file);
2229 struct ufile *file;
2283 file = read_record(vol, (i+j)*8+k);
2284 if (!file) {
2290 if ((opts.since > 0) && (file->date <= opts.since))
2292 if (opts.match && !name_match(&re, file))
2294 if (opts.size_begin && (opts.size_begin > file->max_size))
2296 if (opts.size_end && (opts.size_end < file->max_size))
2299 percent = calc_percentage(file, vol);
2302 dump_record(file);
2304 list_record(file);
2307 so undelete file by regex */
2309 if (!undelete_file(vol, file->inode))
2312 file->inode);
2321 free_file(file);
2339 * copy_mft - Write a range of MFT Records to a file
2344 * Read a number of MFT Records and write them to a file.
2390 ntfs_log_perror("Couldn't create output file '%s'", name);
2418 ntfs_log_quiet("MFT extracted to file %s\n", pathname);
2460 /* Now undelete file */