/*

 * The BDE volume header functions

 *

 * Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>

 *

 * Refer to AUTHORS for acknowledgements.

 *

 * This program is free software: you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>.

 */

#include <common.h>

#include <byte_stream.h>

#include <memory.h>

#include <types.h>

#include "libbde_debug.h"

#include "libbde_definitions.h"

#include "libbde_libbfio.h"

#include "libbde_libcerror.h"

#include "libbde_libcnotify.h"

#include "libbde_libfguid.h"

#include "libbde_volume_header.h"

#include "bde_volume.h"

const uint8_t bde_boot_entry_point_vista[ 3 ] = {

  0xeb, 0x52, 0x90 };

const uint8_t bde_boot_entry_point_windows7[ 3 ] = {

  0xeb, 0x58, 0x90 };

const uint8_t bde_identifier[ 16 ] = {

  0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a, 0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01 };

const uint8_t bde_identifier_used_disk_space_only[ 16 ] = {

  0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d, 0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8 };

const char *bde_signature = "-FVE-FS-";

/* Creates a volume header

 * Make sure the value volume_header is referencing, is set to NULL

 * Returns 1 if successful or -1 on error

 */

int libbde_volume_header_initialize(

     libbde_volume_header_t **volume_header,

     libcerror_error_t **error )

{

  static char *function = "libbde_volume_header_initialize";

  if( volume_header == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid volume header.",

     function );

    return( -1 );

  }

  if( *volume_header != NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,

     "%s: invalid volume header value already set.",

     function );

    return( -1 );

  }

  *volume_header = memory_allocate_structure(

                    libbde_volume_header_t );

  if( *volume_header == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,

     "%s: unable to create volume header.",

     function );

    goto on_error;

  }

  if( memory_set(

       *volume_header,

       0,

       sizeof( libbde_volume_header_t ) ) == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_SET_FAILED,

     "%s: unable to clear volume header.",

     function );

    goto on_error;

  }

  return( 1 );

on_error:

  if( *volume_header != NULL )

  {

    memory_free(

     *volume_header );

    *volume_header = NULL;

  }

  return( -1 );

}

/* Frees a volume header

 * Returns 1 if successful or -1 on error

 */

int libbde_volume_header_free(

     libbde_volume_header_t **volume_header,

     libcerror_error_t **error )

{

  static char *function = "libbde_volume_header_free";

  if( volume_header == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid volume header.",

     function );

    return( -1 );

  }

  if( *volume_header != NULL )

  {

    memory_free(

     *volume_header );

    *volume_header = NULL;

  }

  return( 1 );

}

/* Reads the volume header

 * Returns 1 if successful or -1 on error

 */

int libbde_volume_header_read_data(

     libbde_volume_header_t *volume_header,

     const uint8_t *data,

     size_t data_size,

     libcerror_error_t **error )

{

  static char *function                = "libbde_volume_header_read_data";

  uint64_t safe_first_metadata_offset  = 0;

  uint64_t safe_second_metadata_offset = 0;

  uint64_t safe_third_metadata_offset  = 0;

  uint64_t total_number_of_sectors     = 0;

  uint32_t cluster_block_size          = 0;

#if defined( HAVE_DEBUG_OUTPUT )

  uint64_t value_64bit                 = 0;

  uint32_t value_32bit                 = 0;

  uint16_t value_16bit                 = 0;

#endif

  if( volume_header == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid volume header.",

     function );

    return( -1 );

  }

  if( data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,

     "%s: invalid data.",

     function );

    return( -1 );

  }

  if( ( data_size < 512 )

   || ( data_size > (size_t) SSIZE_MAX ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid data size value out of bounds.",

     function );

    return( -1 );

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    libcnotify_printf(

     "%s: volume header data:\n",

     function );

    libcnotify_print_data(

     data,

     512,

     LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

  }

#endif

  if( memory_compare(

       data,

       bde_boot_entry_point_vista,

       3 ) == 0 )

  {

    volume_header->version = LIBBDE_VERSION_WINDOWS_VISTA;

  }

  else if( memory_compare(

            data,

            bde_boot_entry_point_windows7,

            3 ) == 0 )

  {

    if( memory_compare(

         ( (bde_volume_header_windows_7_t *) data )->identifier,

         bde_identifier,

         16 ) == 0 )

    {

      volume_header->version = LIBBDE_VERSION_WINDOWS_7;

    }

#if defined( HAVE_DEBUG_OUTPUT )

    else if( memory_compare(

              ( (bde_volume_header_windows_7_t *) data )->identifier,

              bde_identifier_used_disk_space_only,

              16 ) == 0 )

    {

      volume_header->version = LIBBDE_VERSION_WINDOWS_7;

    }

#endif

    else if( memory_compare(

              ( (bde_volume_header_to_go_t *) data )->identifier,

              bde_identifier,

              16 ) == 0 )

    {

      volume_header->version = LIBBDE_VERSION_TO_GO;

    }

    else

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

       "%s: unsupported identifier.",

       function );

      return( -1 );

    }

  }

  else

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

     "%s: unsupported volume boot entry point.",

     function );

    return( -1 );

  }

  if( ( volume_header->version == LIBBDE_VERSION_WINDOWS_VISTA )

   || ( volume_header->version == LIBBDE_VERSION_WINDOWS_7 ) )

  {

    if( memory_compare(

         &( data[ 3 ] ),

         bde_signature,

         8 ) != 0 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_UNSUPPORTED_VALUE,

       "%s: invalid volume signature.",

       function );

      return( -1 );

    }

  }

  byte_stream_copy_to_uint16_little_endian(

   ( (bde_volume_header_windows_vista_t *) data )->bytes_per_sector,

   volume_header->bytes_per_sector );

  volume_header->sectors_per_cluster_block = ( (bde_volume_header_windows_vista_t *) data )->sectors_per_cluster_block;

  byte_stream_copy_to_uint16_little_endian(

   ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_16bit,

   total_number_of_sectors );

  if( total_number_of_sectors == 0 )

  {

    byte_stream_copy_to_uint32_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_32bit,

     total_number_of_sectors );

  }

  if( volume_header->version == LIBBDE_VERSION_WINDOWS_VISTA )

  {

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->first_metadata_cluster_block_number,

     safe_first_metadata_offset );

    if( total_number_of_sectors == 0 )

    {

      byte_stream_copy_to_uint64_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_64bit,

       total_number_of_sectors );

    }

  }

  else if( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

  {

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_windows_7_t *) data )->first_metadata_offset,

     safe_first_metadata_offset );

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_windows_7_t *) data )->second_metadata_offset,

     safe_second_metadata_offset );

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_windows_7_t *) data )->third_metadata_offset,

     safe_third_metadata_offset );

  }

  else if( volume_header->version == LIBBDE_VERSION_TO_GO )

  {

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_to_go_t *) data )->first_metadata_offset,

     safe_first_metadata_offset );

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_to_go_t *) data )->second_metadata_offset,

     safe_second_metadata_offset );

    byte_stream_copy_to_uint64_little_endian(

     ( (bde_volume_header_to_go_t *) data )->third_metadata_offset,

     safe_third_metadata_offset );

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    libcnotify_printf(

     "%s: boot entry point:\n",

     function );

    libcnotify_print_data(

     data,

     3,

     0 );

    libcnotify_printf(

     "%s: signature\t\t\t\t: %c%c%c%c%c%c%c%c\n",

     function,

     data[ 3 ],

     data[ 4 ],

     data[ 5 ],

     data[ 6 ],

     data[ 7 ],

     data[ 8 ],

     data[ 9 ],

     data[ 10 ] );

    libcnotify_printf(

     "%s: bytes per sector\t\t\t: %" PRIu16 "\n",

     function,

     volume_header->bytes_per_sector );

    libcnotify_printf(

     "%s: sectors per cluster block\t\t: %" PRIu8 "\n",

     function,

     volume_header->sectors_per_cluster_block );

    libcnotify_printf(

     "%s: unknown1\n",

     function );

    libcnotify_print_data(

     ( (bde_volume_header_windows_vista_t *) data )->unknown1,

     5,

     0 );

    byte_stream_copy_to_uint16_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_16bit,

     value_16bit );

    libcnotify_printf(

     "%s: total number of sectors (16-bit)\t: %" PRIu16 "\n",

     function,

     value_16bit );

    libcnotify_printf(

     "%s: media descriptor\t\t\t: 0x%02" PRIx8 "\n",

     function,

     ( (bde_volume_header_windows_vista_t *) data )->media_descriptor );

    byte_stream_copy_to_uint16_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->unknown2,

     value_16bit );

    libcnotify_printf(

     "%s: unknown2\t\t\t\t: %" PRIu16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->sectors_per_track,

     value_16bit );

    libcnotify_printf(

     "%s: sectors per track\t\t\t: %" PRIu16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->number_of_heads,

     value_16bit );

    libcnotify_printf(

     "%s: number of heads\t\t\t\t: %" PRIu16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint32_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->number_of_hidden_sectors,

     value_32bit );

    libcnotify_printf(

     "%s: number of hidden sectors\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_32bit,

     value_32bit );

    libcnotify_printf(

     "%s: total number of sectors (32-bit)\t: %" PRIu32 "\n",

     function,

     value_32bit );

    if( volume_header->version == LIBBDE_VERSION_WINDOWS_VISTA )

    {

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->unknown4,

       value_32bit );

      libcnotify_printf(

       "%s: unknown4\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n",

       function,

       value_32bit,

       value_32bit );

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->total_number_of_sectors_64bit,

       value_64bit );

      libcnotify_printf(

       "%s: total number of sectors (64-bit)\t: %" PRIu64 "\n",

       function,

       value_64bit );

      byte_stream_copy_to_uint64_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->mft_cluster_block_number,

       value_64bit );

      libcnotify_printf(

       "%s: MFT cluster block number\t\t: %" PRIu64 "\n",

       function,

       value_64bit );

      libcnotify_printf(

       "%s: first metadata cluster block\t: 0x%08" PRIx64 "\n",

       function,

       safe_first_metadata_offset );

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->mft_entry_size,

       value_32bit );

      libcnotify_printf(

       "%s: MFT entry size\t\t\t: %" PRIu32 "\n",

       function,

       value_32bit );

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->index_entry_size,

       value_32bit );

      libcnotify_printf(

       "%s: index entry size\t\t\t: %" PRIu32 "\n",

       function,

       value_32bit );

      byte_stream_copy_to_uint64_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->volume_serial_number,

       value_64bit );

      libcnotify_printf(

       "%s: volume serial number\t\t\t: 0x%08" PRIx64 "\n",

       function,

       value_64bit );

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_vista_t *) data )->checksum,

       value_32bit );

      libcnotify_printf(

       "%s: checksum\t\t\t\t: 0x%08" PRIx32 "\n",

       function,

       value_32bit );

      libcnotify_printf(

       "%s: bootcode\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_windows_vista_t *) data )->bootcode,

       426,

       0 );

    }

    else if( ( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

          || ( volume_header->version == LIBBDE_VERSION_TO_GO ) )

    {

      libcnotify_printf(

       "%s: unknown4:\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_windows_7_t *) data )->unknown4,

       31,

       0 );

      byte_stream_copy_to_uint32_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 0 ] ),

       value_32bit );

      libcnotify_printf(

       "%s: unknown4a\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n",

       function,

       value_32bit,

       value_32bit );

      byte_stream_copy_to_uint64_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 4 ] ),

       value_64bit );

      libcnotify_printf(

       "%s: unknown4b\t\t\t\t: 0x%08" PRIx64 " (%" PRIu64 ")\n",

       function,

       value_64bit,

       value_64bit );

      byte_stream_copy_to_uint16_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 12 ] ),

       value_16bit );

      libcnotify_printf(

       "%s: unknown4c\t\t\t\t: 0x%04" PRIx16 " (%" PRIu16 ")\n",

       function,

       value_16bit,

       value_16bit );

      byte_stream_copy_to_uint16_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 14 ] ),

       value_16bit );

      libcnotify_printf(

       "%s: unknown4d\t\t\t\t: 0x%04" PRIx16 " (%" PRIu16 ")\n",

       function,

       value_16bit,

       value_16bit );

      byte_stream_copy_to_uint64_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 16 ] ),

       value_64bit );

      libcnotify_printf(

       "%s: unknown4e\t\t\t\t: 0x%08" PRIx64 " (%" PRIu64 ")\n",

       function,

       value_64bit,

       value_64bit );

      byte_stream_copy_to_uint32_little_endian(

       &( ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 24 ] ),

       value_32bit );

      libcnotify_printf(

       "%s: unknown4f\t\t\t\t: 0x%08" PRIx32 " (%" PRIu32 ")\n",

       function,

       value_32bit,

       value_32bit );

      libcnotify_printf(

       "%s: drive physical number\t\t\t: 0x%02" PRIx8 "\n",

       function,

       ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 28 ] );

      libcnotify_printf(

       "%s: unknown4g\t\t\t\t: 0x%02" PRIx8 "\n",

       function,

       ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 29 ] );

      libcnotify_printf(

       "%s: extended boot signature\t\t\t: 0x%02" PRIx8 "\n",

       function,

       ( ( (bde_volume_header_windows_7_t *) data )->unknown4 )[ 30 ] );

      libcnotify_printf(

       "\n" );

      byte_stream_copy_to_uint32_little_endian(

       ( (bde_volume_header_windows_7_t *) data )->volume_serial_number,

       value_32bit );

      libcnotify_printf(

       "%s: volume serial number\t\t\t: 0x%08" PRIx32 "\n",

       function,

       value_32bit );

      libcnotify_printf(

       "%s: volume label\t\t\t\t: %c%c%c%c%c%c%c%c%c%c%c\n",

       function,

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 0 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 1 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 2 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 3 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 4 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 5 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 6 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 7 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 8 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 9 ],

       ( (bde_volume_header_windows_7_t *) data )->volume_label[ 10 ] );

      libcnotify_printf(

       "%s: file system signature\t\t\t: %c%c%c%c%c%c%c%c\n",

       function,

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 0 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 1 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 2 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 3 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 4 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 5 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 6 ],

       ( (bde_volume_header_windows_7_t *) data )->file_system_signature[ 7 ] );

    }

    if( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

    {

      libcnotify_printf(

       "%s: bootcode\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_windows_7_t *) data )->bootcode,

       47,

       0 );

      if( libbde_debug_print_guid_value(

           function,

           "identifier\t\t\t\t",

           ( (bde_volume_header_windows_7_t *) data )->identifier,

           16,

           LIBFGUID_ENDIAN_LITTLE,

           LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE,

           error ) != 1 )

      {

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,

         "%s: unable to print GUID value.",

         function );

        return( -1 );

      }

    }

    else if( volume_header->version == LIBBDE_VERSION_TO_GO )

    {

      libcnotify_printf(

       "%s: bootcode\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_to_go_t *) data )->bootcode,

       335,

       0 );

      if( libbde_debug_print_guid_value(

           function,

           "identifier\t\t\t\t",

           ( (bde_volume_header_to_go_t *) data )->identifier,

           16,

           LIBFGUID_ENDIAN_LITTLE,

           LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE,

           error ) != 1 )

      {

        libcerror_error_set(

         error,

         LIBCERROR_ERROR_DOMAIN_RUNTIME,

         LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,

         "%s: unable to print GUID value.",

         function );

        return( -1 );

      }

    }

    if( ( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

     || ( volume_header->version == LIBBDE_VERSION_TO_GO ) )

    {

      libcnotify_printf(

       "%s: first metadata offset\t\t\t: 0x%08" PRIx64 "\n",

       function,

       safe_first_metadata_offset );

      libcnotify_printf(

       "%s: second metadata offset\t\t\t: 0x%08" PRIx64 "\n",

       function,

       safe_second_metadata_offset );

      libcnotify_printf(

       "%s: third metadata offset\t\t\t: 0x%08" PRIx64 "\n",

       function,

       safe_third_metadata_offset );

    }

    if( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

    {

      libcnotify_printf(

       "%s: unknown5:\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_windows_7_t *) data )->unknown5,

       310,

       0 );

    }

    else if( volume_header->version == LIBBDE_VERSION_TO_GO )

    {

      libcnotify_printf(

       "%s: unknown5:\n",

       function );

      libcnotify_print_data(

       ( (bde_volume_header_to_go_t *) data )->unknown5,

       46,

       0 );

    }

    byte_stream_copy_to_uint16_little_endian(

     ( (bde_volume_header_windows_vista_t *) data )->sector_signature,

     value_16bit );

    libcnotify_printf(

     "%s: sector signature\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    libcnotify_printf(

     "\n" );

  }

#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  if( ( volume_header->bytes_per_sector != 512 )

   && ( volume_header->bytes_per_sector != 1024 )

   && ( volume_header->bytes_per_sector != 2048 )

   && ( volume_header->bytes_per_sector != 4096 ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid bytes per sector value out of bounds.",

     function );

    return( -1 );

  }

  if( total_number_of_sectors != 0 )

  {

    if( total_number_of_sectors > ( (uint64_t) INT64_MAX / volume_header->bytes_per_sector ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid volume size value out of bounds.",

       function );

      return( -1 );

    }

    volume_header->volume_size = total_number_of_sectors * volume_header->bytes_per_sector;

  }

  if( volume_header->version == LIBBDE_VERSION_WINDOWS_VISTA )

  {

    if( volume_header->sectors_per_cluster_block == 0 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid sectors per cluster block value out of bounds.",

       function );

      return( -1 );

    }

    cluster_block_size = (uint32_t) volume_header->sectors_per_cluster_block * volume_header->bytes_per_sector;

    if( safe_first_metadata_offset > ( (uint64_t) INT64_MAX / cluster_block_size ) )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid first metadata offset value out of bounds.",

       function );

      return( -1 );

    }

    volume_header->first_metadata_offset = (off64_t) ( safe_first_metadata_offset * cluster_block_size );

    volume_header->metadata_size         = 16384;

  }

  else if( ( volume_header->version == LIBBDE_VERSION_WINDOWS_7 )

        || ( volume_header->version == LIBBDE_VERSION_TO_GO ) )

  {

    if( safe_first_metadata_offset > (uint64_t) INT64_MAX )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid first metadata offset value out of bounds.",

       function );

      return( -1 );

    }

    if( safe_second_metadata_offset > (uint64_t) INT64_MAX )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid second metadata offset value out of bounds.",

       function );

      return( -1 );

    }

    if( safe_third_metadata_offset > (uint64_t) INT64_MAX )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

       "%s: invalid third metadata offset value out of bounds.",

       function );

      return( -1 );

    }

    volume_header->first_metadata_offset  = (off64_t) safe_first_metadata_offset;

    volume_header->second_metadata_offset = (off64_t) safe_second_metadata_offset;

    volume_header->third_metadata_offset  = (off64_t) safe_third_metadata_offset;

    volume_header->metadata_size          = 65536;

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    libcnotify_printf(

     "%s: volume size\t\t\t\t: %" PRIu64 "\n",

     function,

     volume_header->volume_size );

    libcnotify_printf(

     "\n" );

  }

#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  return( 1 );

}

/* Reads the volume header

 * Returns 1 if successful or -1 on error

 */

int libbde_volume_header_read_file_io_handle(

     libbde_volume_header_t *volume_header,

     libbfio_handle_t *file_io_handle,

     off64_t file_offset,

     libcerror_error_t **error )

{

  uint8_t volume_header_data[ 512 ];

  static char *function = "libbde_volume_header_read_file_io_handle";

  ssize_t read_count    = 0;

  if( volume_header == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid volume header.",

     function );

    return( -1 );

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    libcnotify_printf(

     "%s: reading volume header at offset: %" PRIi64 " (0x%08" PRIx64 ")\n",

     function,

     file_offset,

     file_offset );

  }

#endif

  read_count = libbfio_handle_read_buffer_at_offset(

                file_io_handle,

                (uint8_t *) &volume_header_data,

                512,

                file_offset,

                error );

  if( read_count != (ssize_t) 512 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_IO,

     LIBCERROR_IO_ERROR_READ_FAILED,

     "%s: unable to read volume header data at offset: %" PRIi64 " (0x%08" PRIx64 ").",

     function,

     file_offset,

     file_offset );

    return( -1 );

  }

  if( libbde_volume_header_read_data(

       volume_header,

       (uint8_t *) &volume_header_data,

       512,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_IO,

     LIBCERROR_IO_ERROR_READ_FAILED,

     "%s: unable to read volume header data.",

     function );

    return( -1 );

  }

  return( 1 );

}