/src/libfsntfs/libfsntfs/libfsntfs_mft_entry_header.c

Source (jump to first uncovered line)
/*
 * Master File Table (MFT) entry header functions
 *
 * Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <common.h>
#include <byte_stream.h>
#include <memory.h>
#include <types.h>

#include "libfsntfs_debug.h"
#include "libfsntfs_libcerror.h"
#include "libfsntfs_libcnotify.h"
#include "libfsntfs_mft_entry_header.h"

#include "fsntfs_mft_entry.h"

/* Creates MFT entry header
 * Make sure the value mft_entry_header is referencing, is set to NULL
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_initialize(
     libfsntfs_mft_entry_header_t **mft_entry_header,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_initialize";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( *mft_entry_header != NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
     "%s: invalid MFT entry header value already set.",
     function );

    return( -1 );
  }
  *mft_entry_header = memory_allocate_structure(
                       libfsntfs_mft_entry_header_t );

  if( *mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
     "%s: unable to create MFT entry header.",
     function );

    goto on_error;
  }
  if( memory_set(
       *mft_entry_header,
       0,
       sizeof( libfsntfs_mft_entry_header_t ) ) == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_MEMORY,
     LIBCERROR_MEMORY_ERROR_SET_FAILED,
     "%s: unable to clear MFT entry header.",
     function );

    goto on_error;
  }
  return( 1 );

on_error:
  if( *mft_entry_header != NULL )
  {
    memory_free(
     *mft_entry_header );

    *mft_entry_header = NULL;
  }
  return( -1 );
}

/* Frees MFT entry header
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_free(
     libfsntfs_mft_entry_header_t **mft_entry_header,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_free";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( *mft_entry_header != NULL )
  {
    memory_free(
     *mft_entry_header );

    *mft_entry_header = NULL;
  }
  return( 1 );
}

/* Reads the MFT entry header
 * Returns 1 if successful, 0 if FILE signature is not present or -1 on error
 */
int libfsntfs_mft_entry_header_read_data(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     const uint8_t *data,
     size_t data_size,
     libcerror_error_t **error )
{
  static char *function   = "libfsntfs_mft_entry_header_read_data";
  size_t header_data_size = 0;

#if defined( HAVE_DEBUG_OUTPUT )
  uint16_t value_16bit    = 0;
#endif

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( data == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
     "%s: invalid data.",
     function );

    return( -1 );
  }
  if( ( data_size < 2 )
   || ( data_size > (size_t) SSIZE_MAX ) )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data size value out of bounds.",
     function );

    return( -1 );
  }
  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->fixup_values_offset,
   mft_entry_header->fixup_values_offset );

  if( mft_entry_header->fixup_values_offset > 42 )
  {
    header_data_size = sizeof( fsntfs_mft_entry_header_t );
  }
  else
  {
    header_data_size = 42;
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: MFT entry header data:\n",
     function );
    libcnotify_print_data(
     data,
     header_data_size,
     0 );
  }
#endif
  if( data_size < header_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid data size value out of bounds.",
     function );

    return( -1 );
  }
  if( memory_compare(
       ( (fsntfs_mft_entry_header_t *) data )->signature,
       "BAAD",
       4 ) == 0 )
  {
    mft_entry_header->is_bad = 1;

    return( 0 );
  }
  mft_entry_header->is_bad = 0;

  if( memory_compare(
       ( (fsntfs_mft_entry_header_t *) data )->signature,
       "FILE",
       4 ) != 0 )
  {
    return( 0 );
  }
  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->number_of_fixup_values,
   mft_entry_header->number_of_fixup_values );

  byte_stream_copy_to_uint64_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->journal_sequence_number,
   mft_entry_header->journal_sequence_number );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->sequence,
   mft_entry_header->sequence );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->reference_count,
   mft_entry_header->reference_count );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->attributes_offset,
   mft_entry_header->attributes_offset );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->flags,
   mft_entry_header->flags );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->used_entry_size,
   mft_entry_header->used_entry_size );

  byte_stream_copy_to_uint16_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->total_entry_size,
   mft_entry_header->total_entry_size );

  byte_stream_copy_to_uint64_little_endian(
   ( (fsntfs_mft_entry_header_t *) data )->base_record_file_reference,
   mft_entry_header->base_record_file_reference );

  if( header_data_size > 42 )
  {
    byte_stream_copy_to_uint32_little_endian(
     ( (fsntfs_mft_entry_header_t *) data )->index,
     mft_entry_header->index );
  }
#if defined( HAVE_DEBUG_OUTPUT )
  if( libcnotify_verbose != 0 )
  {
    libcnotify_printf(
     "%s: signature\t\t\t\t\t: %c%c%c%c\n",
     function,
     ( (fsntfs_mft_entry_header_t *) data )->signature[ 0 ],
     ( (fsntfs_mft_entry_header_t *) data )->signature[ 1 ],
     ( (fsntfs_mft_entry_header_t *) data )->signature[ 2 ],
     ( (fsntfs_mft_entry_header_t *) data )->signature[ 3 ] );

    libcnotify_printf(
     "%s: fix-up values offset\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->fixup_values_offset );

    libcnotify_printf(
     "%s: number of fix-up values\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->number_of_fixup_values );

    libcnotify_printf(
     "%s: journal sequence number\t\t\t: %" PRIu64 "\n",
     function,
     mft_entry_header->journal_sequence_number );

    libcnotify_printf(
     "%s: sequence\t\t\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->sequence );

    libcnotify_printf(
     "%s: reference count\t\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->reference_count );

    libcnotify_printf(
     "%s: attributes offset\t\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->attributes_offset );

    libcnotify_printf(
     "%s: flags\t\t\t\t\t: 0x%04" PRIx16 "\n",
     function,
     mft_entry_header->flags );
    libfsntfs_debug_print_mft_entry_flags(
     mft_entry_header->flags );
    libcnotify_printf(
     "\n" );

    libcnotify_printf(
     "%s: used entry size\t\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->used_entry_size );

    libcnotify_printf(
     "%s: total entry size\t\t\t\t: %" PRIu16 "\n",
     function,
     mft_entry_header->total_entry_size );

    libcnotify_printf(
     "%s: base record file reference\t\t: %" PRIu64 "-%" PRIu64 "\n",
     function,
     mft_entry_header->base_record_file_reference & 0xffffffffffffUL,
     mft_entry_header->base_record_file_reference >> 48 );

    byte_stream_copy_to_uint16_little_endian(
     ( (fsntfs_mft_entry_header_t *) data )->first_available_attribute_identifier,
     value_16bit );
    libcnotify_printf(
     "%s: first available attribute identifier\t: %" PRIu16 "\n",
     function,
     value_16bit );

    if( header_data_size > 42 )
    {
      byte_stream_copy_to_uint16_little_endian(
       ( (fsntfs_mft_entry_header_t *) data )->unknown1,
       value_16bit );
      libcnotify_printf(
       "%s: unknown1\t\t\t\t\t: 0x%04" PRIu16 "\n",
       function,
       value_16bit );

      libcnotify_printf(
       "%s: index\t\t\t\t\t: %" PRIu32 "\n",
       function,
       mft_entry_header->index );
    }
    libcnotify_printf(
     "\n" );
  }
#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  if( mft_entry_header->fixup_values_offset < header_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid fix-up values offset value out of bounds.",
     function );

    return( -1 );
  }
  if( mft_entry_header->attributes_offset < header_data_size )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_RUNTIME,
     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
     "%s: invalid attributes offset value out of bounds.",
     function );

    return( -1 );
  }
  return( 1 );
}

/* Retrieves the fix-up values offset
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_fixup_values_offset(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *fixup_values_offset,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_fixup_values_offset";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( fixup_values_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid fix-up values offset.",
     function );

    return( -1 );
  }
  *fixup_values_offset = mft_entry_header->fixup_values_offset;

  return( 1 );
}

/* Retrieves the number of fix-up values
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_number_of_fixup_values(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *number_of_fixup_values,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_number_of_fixup_values";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( number_of_fixup_values == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid number of fix-up values.",
     function );

    return( -1 );
  }
  *number_of_fixup_values = mft_entry_header->number_of_fixup_values;

  return( 1 );
}

/* Retrieves the journal sequence number
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_journal_sequence_number(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint64_t *journal_sequence_number,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_journal_sequence_number";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( journal_sequence_number == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid journal sequence number.",
     function );

    return( -1 );
  }
  *journal_sequence_number = mft_entry_header->journal_sequence_number;

  return( 1 );
}

/* Retrieves the reference count
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_reference_count(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *reference_count,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_reference_count";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( reference_count == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid reference count.",
     function );

    return( -1 );
  }
  *reference_count = mft_entry_header->reference_count;

  return( 1 );
}

/* Retrieves the attributes offset
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_attributes_offset(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *attributes_offset,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_attributes_offset";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( attributes_offset == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid attributes offset.",
     function );

    return( -1 );
  }
  *attributes_offset = mft_entry_header->attributes_offset;

  return( 1 );
}

/* Retrieves the used entry size
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_used_entry_size(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *used_entry_size,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_used_entry_size";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( used_entry_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid used entry size.",
     function );

    return( -1 );
  }
  *used_entry_size = mft_entry_header->used_entry_size;

  return( 1 );
}

/* Retrieves the total entry size
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_total_entry_size(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint16_t *total_entry_size,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_total_entry_size";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( total_entry_size == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid total entry size.",
     function );

    return( -1 );
  }
  *total_entry_size = mft_entry_header->total_entry_size;

  return( 1 );
}

/* Retrieves the base record file reference
 * Returns 1 if successful or -1 on error
 */
int libfsntfs_mft_entry_header_get_base_record_file_reference(
     libfsntfs_mft_entry_header_t *mft_entry_header,
     uint64_t *base_record_file_reference,
     libcerror_error_t **error )
{
  static char *function = "libfsntfs_mft_entry_header_get_base_record_file_reference";

  if( mft_entry_header == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid MFT entry header.",
     function );

    return( -1 );
  }
  if( base_record_file_reference == NULL )
  {
    libcerror_error_set(
     error,
     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
     "%s: invalid base record file reference.",
     function );

    return( -1 );
  }
  *base_record_file_reference = mft_entry_header->base_record_file_reference;

  return( 1 );
}


Coverage Report

Created: 2025-06-13 07:22

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Master File Table (MFT) entry header functions
3		*
4		* Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>
5		*
6		* Refer to AUTHORS for acknowledgements.
7		*
8		* This program is free software: you can redistribute it and/or modify
9		* it under the terms of the GNU Lesser General Public License as published by
10		* the Free Software Foundation, either version 3 of the License, or
11		* (at your option) any later version.
12		*
13		* This program is distributed in the hope that it will be useful,
14		* but WITHOUT ANY WARRANTY; without even the implied warranty of
15		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		* GNU General Public License for more details.
17		*
18		* You should have received a copy of the GNU Lesser General Public License
19		* along with this program. If not, see <https://www.gnu.org/licenses/>.
20		*/
21
22		#include <common.h>
23		#include <byte_stream.h>
24		#include <memory.h>
25		#include <types.h>
26
27		#include "libfsntfs_debug.h"
28		#include "libfsntfs_libcerror.h"
29		#include "libfsntfs_libcnotify.h"
30		#include "libfsntfs_mft_entry_header.h"
31
32		#include "fsntfs_mft_entry.h"
33
34		/* Creates MFT entry header
35		* Make sure the value mft_entry_header is referencing, is set to NULL
36		* Returns 1 if successful or -1 on error
37		*/
38		int libfsntfs_mft_entry_header_initialize(
39		libfsntfs_mft_entry_header_t **mft_entry_header,
40		libcerror_error_t **error )
41	36.4k	{
42	36.4k	static char *function = "libfsntfs_mft_entry_header_initialize";
43
44	36.4k	if( mft_entry_header == NULL )
45	0	{
46	0	libcerror_error_set(
47	0	error,
48	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
49	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
50	0	"%s: invalid MFT entry header.",
51	0	function );
52
53	0	return( -1 );
54	0	}
55	36.4k	if( *mft_entry_header != NULL )
56	0	{
57	0	libcerror_error_set(
58	0	error,
59	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
60	0	LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,
61	0	"%s: invalid MFT entry header value already set.",
62	0	function );
63
64	0	return( -1 );
65	0	}
66	36.4k	*mft_entry_header = memory_allocate_structure(
67	36.4k	libfsntfs_mft_entry_header_t );
68
69	36.4k	if( *mft_entry_header == NULL )
70	0	{
71	0	libcerror_error_set(
72	0	error,
73	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
74	0	LIBCERROR_MEMORY_ERROR_INSUFFICIENT,
75	0	"%s: unable to create MFT entry header.",
76	0	function );
77
78	0	goto on_error;
79	0	}
80	36.4k	if( memory_set(
81	36.4k	*mft_entry_header,
82	36.4k	0,
83	36.4k	sizeof( libfsntfs_mft_entry_header_t ) ) == NULL )
84	0	{
85	0	libcerror_error_set(
86	0	error,
87	0	LIBCERROR_ERROR_DOMAIN_MEMORY,
88	0	LIBCERROR_MEMORY_ERROR_SET_FAILED,
89	0	"%s: unable to clear MFT entry header.",
90	0	function );
91
92	0	goto on_error;
93	0	}
94	36.4k	return( 1 );
95
96	0	on_error:
97	0	if( *mft_entry_header != NULL )
98	0	{
99	0	memory_free(
100	0	*mft_entry_header );
101
102	0	*mft_entry_header = NULL;
103	0	}
104	0	return( -1 );
105	36.4k	}
106
107		/* Frees MFT entry header
108		* Returns 1 if successful or -1 on error
109		*/
110		int libfsntfs_mft_entry_header_free(
111		libfsntfs_mft_entry_header_t **mft_entry_header,
112		libcerror_error_t **error )
113	36.4k	{
114	36.4k	static char *function = "libfsntfs_mft_entry_header_free";
115
116	36.4k	if( mft_entry_header == NULL )
117	0	{
118	0	libcerror_error_set(
119	0	error,
120	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
121	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
122	0	"%s: invalid MFT entry header.",
123	0	function );
124
125	0	return( -1 );
126	0	}
127	36.4k	if( *mft_entry_header != NULL )
128	36.4k	{
129	36.4k	memory_free(
130	36.4k	*mft_entry_header );
131
132	36.4k	*mft_entry_header = NULL;
133	36.4k	}
134	36.4k	return( 1 );
135	36.4k	}
136
137		/* Reads the MFT entry header
138		* Returns 1 if successful, 0 if FILE signature is not present or -1 on error
139		*/
140		int libfsntfs_mft_entry_header_read_data(
141		libfsntfs_mft_entry_header_t *mft_entry_header,
142		const uint8_t *data,
143		size_t data_size,
144		libcerror_error_t **error )
145	36.4k	{
146	36.4k	static char *function = "libfsntfs_mft_entry_header_read_data";
147	36.4k	size_t header_data_size = 0;
148
149		#if defined( HAVE_DEBUG_OUTPUT )
150		uint16_t value_16bit = 0;
151		#endif
152
153	36.4k	if( mft_entry_header == NULL )
154	0	{
155	0	libcerror_error_set(
156	0	error,
157	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
158	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
159	0	"%s: invalid MFT entry header.",
160	0	function );
161
162	0	return( -1 );
163	0	}
164	36.4k	if( data == NULL )
165	0	{
166	0	libcerror_error_set(
167	0	error,
168	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
169	0	LIBCERROR_RUNTIME_ERROR_VALUE_MISSING,
170	0	"%s: invalid data.",
171	0	function );
172
173	0	return( -1 );
174	0	}
175	36.4k	if( ( data_size < 2 )
176	36.4k	\|\| ( data_size > (size_t) SSIZE_MAX ) )
177	0	{
178	0	libcerror_error_set(
179	0	error,
180	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
181	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
182	0	"%s: invalid data size value out of bounds.",
183	0	function );
184
185	0	return( -1 );
186	0	}
187	36.4k	byte_stream_copy_to_uint16_little_endian(
188	36.4k	( (fsntfs_mft_entry_header_t *) data )->fixup_values_offset,
189	36.4k	mft_entry_header->fixup_values_offset );
190
191	36.4k	if( mft_entry_header->fixup_values_offset > 42 )
192	27.4k	{
193	27.4k	header_data_size = sizeof( fsntfs_mft_entry_header_t );
194	27.4k	}
195	8.95k	else
196	8.95k	{
197	8.95k	header_data_size = 42;
198	8.95k	}
199		#if defined( HAVE_DEBUG_OUTPUT )
200		if( libcnotify_verbose != 0 )
201		{
202		libcnotify_printf(
203		"%s: MFT entry header data:\n",
204		function );
205		libcnotify_print_data(
206		data,
207		header_data_size,
208		0 );
209		}
210		#endif
211	36.4k	if( data_size < header_data_size )
212	0	{
213	0	libcerror_error_set(
214	0	error,
215	0	LIBCERROR_ERROR_DOMAIN_RUNTIME,
216	0	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
217	0	"%s: invalid data size value out of bounds.",
218	0	function );
219
220	0	return( -1 );
221	0	}
222	36.4k	if( memory_compare(
223	36.4k	( (fsntfs_mft_entry_header_t *) data )->signature,
224	36.4k	"BAAD",
225	36.4k	4 ) == 0 )
226	93	{
227	93	mft_entry_header->is_bad = 1;
228
229	93	return( 0 );
230	93	}
231	36.3k	mft_entry_header->is_bad = 0;
232
233	36.3k	if( memory_compare(
234	36.3k	( (fsntfs_mft_entry_header_t *) data )->signature,
235	36.3k	"FILE",
236	36.3k	4 ) != 0 )
237	15.3k	{
238	15.3k	return( 0 );
239	15.3k	}
240	20.9k	byte_stream_copy_to_uint16_little_endian(
241	20.9k	( (fsntfs_mft_entry_header_t *) data )->number_of_fixup_values,
242	20.9k	mft_entry_header->number_of_fixup_values );
243
244	20.9k	byte_stream_copy_to_uint64_little_endian(
245	20.9k	( (fsntfs_mft_entry_header_t *) data )->journal_sequence_number,
246	20.9k	mft_entry_header->journal_sequence_number );
247
248	20.9k	byte_stream_copy_to_uint16_little_endian(
249	20.9k	( (fsntfs_mft_entry_header_t *) data )->sequence,
250	20.9k	mft_entry_header->sequence );
251
252	20.9k	byte_stream_copy_to_uint16_little_endian(
253	20.9k	( (fsntfs_mft_entry_header_t *) data )->reference_count,
254	20.9k	mft_entry_header->reference_count );
255
256	20.9k	byte_stream_copy_to_uint16_little_endian(
257	20.9k	( (fsntfs_mft_entry_header_t *) data )->attributes_offset,
258	20.9k	mft_entry_header->attributes_offset );
259
260	20.9k	byte_stream_copy_to_uint16_little_endian(
261	20.9k	( (fsntfs_mft_entry_header_t *) data )->flags,
262	20.9k	mft_entry_header->flags );
263
264	20.9k	byte_stream_copy_to_uint16_little_endian(
265	20.9k	( (fsntfs_mft_entry_header_t *) data )->used_entry_size,
266	20.9k	mft_entry_header->used_entry_size );
267
268	20.9k	byte_stream_copy_to_uint16_little_endian(
269	20.9k	( (fsntfs_mft_entry_header_t *) data )->total_entry_size,
270	20.9k	mft_entry_header->total_entry_size );
271
272	20.9k	byte_stream_copy_to_uint64_little_endian(
273	20.9k	( (fsntfs_mft_entry_header_t *) data )->base_record_file_reference,
274	20.9k	mft_entry_header->base_record_file_reference );
275
276	20.9k	if( header_data_size > 42 )
277	18.8k	{
278	18.8k	byte_stream_copy_to_uint32_little_endian(
279	18.8k	( (fsntfs_mft_entry_header_t *) data )->index,
280	18.8k	mft_entry_header->index );
281	18.8k	}
282		#if defined( HAVE_DEBUG_OUTPUT )
283		if( libcnotify_verbose != 0 )
284		{
285		libcnotify_printf(
286		"%s: signature\t\t\t\t\t: %c%c%c%c\n",
287		function,
288		( (fsntfs_mft_entry_header_t *) data )->signature[ 0 ],
289		( (fsntfs_mft_entry_header_t *) data )->signature[ 1 ],
290		( (fsntfs_mft_entry_header_t *) data )->signature[ 2 ],
291		( (fsntfs_mft_entry_header_t *) data )->signature[ 3 ] );
292
293		libcnotify_printf(
294		"%s: fix-up values offset\t\t\t: %" PRIu16 "\n",
295		function,
296		mft_entry_header->fixup_values_offset );
297
298		libcnotify_printf(
299		"%s: number of fix-up values\t\t\t: %" PRIu16 "\n",
300		function,
301		mft_entry_header->number_of_fixup_values );
302
303		libcnotify_printf(
304		"%s: journal sequence number\t\t\t: %" PRIu64 "\n",
305		function,
306		mft_entry_header->journal_sequence_number );
307
308		libcnotify_printf(
309		"%s: sequence\t\t\t\t\t: %" PRIu16 "\n",
310		function,
311		mft_entry_header->sequence );
312
313		libcnotify_printf(
314		"%s: reference count\t\t\t\t: %" PRIu16 "\n",
315		function,
316		mft_entry_header->reference_count );
317
318		libcnotify_printf(
319		"%s: attributes offset\t\t\t\t: %" PRIu16 "\n",
320		function,
321		mft_entry_header->attributes_offset );
322
323		libcnotify_printf(
324		"%s: flags\t\t\t\t\t: 0x%04" PRIx16 "\n",
325		function,
326		mft_entry_header->flags );
327		libfsntfs_debug_print_mft_entry_flags(
328		mft_entry_header->flags );
329		libcnotify_printf(
330		"\n" );
331
332		libcnotify_printf(
333		"%s: used entry size\t\t\t\t: %" PRIu16 "\n",
334		function,
335		mft_entry_header->used_entry_size );
336
337		libcnotify_printf(
338		"%s: total entry size\t\t\t\t: %" PRIu16 "\n",
339		function,
340		mft_entry_header->total_entry_size );
341
342		libcnotify_printf(
343		"%s: base record file reference\t\t: %" PRIu64 "-%" PRIu64 "\n",
344		function,
345		mft_entry_header->base_record_file_reference & 0xffffffffffffUL,
346		mft_entry_header->base_record_file_reference >> 48 );
347
348		byte_stream_copy_to_uint16_little_endian(
349		( (fsntfs_mft_entry_header_t *) data )->first_available_attribute_identifier,
350		value_16bit );
351		libcnotify_printf(
352		"%s: first available attribute identifier\t: %" PRIu16 "\n",
353		function,
354		value_16bit );
355
356		if( header_data_size > 42 )
357		{
358		byte_stream_copy_to_uint16_little_endian(
359		( (fsntfs_mft_entry_header_t *) data )->unknown1,
360		value_16bit );
361		libcnotify_printf(
362		"%s: unknown1\t\t\t\t\t: 0x%04" PRIu16 "\n",
363		function,
364		value_16bit );
365
366		libcnotify_printf(
367		"%s: index\t\t\t\t\t: %" PRIu32 "\n",
368		function,
369		mft_entry_header->index );
370		}
371		libcnotify_printf(
372		"\n" );
373		}
374		#endif /* defined( HAVE_DEBUG_OUTPUT ) */
375
376	20.9k	if( mft_entry_header->fixup_values_offset < header_data_size )
377	16	{
378	16	libcerror_error_set(
379	16	error,
380	16	LIBCERROR_ERROR_DOMAIN_RUNTIME,
381	16	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
382	16	"%s: invalid fix-up values offset value out of bounds.",
383	16	function );
384
385	16	return( -1 );
386	16	}
387	20.9k	if( mft_entry_header->attributes_offset < header_data_size )
388	18	{
389	18	libcerror_error_set(
390	18	error,
391	18	LIBCERROR_ERROR_DOMAIN_RUNTIME,
392	18	LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
393	18	"%s: invalid attributes offset value out of bounds.",
394	18	function );
395
396	18	return( -1 );
397	18	}
398	20.9k	return( 1 );
399	20.9k	}
400
401		/* Retrieves the fix-up values offset
402		* Returns 1 if successful or -1 on error
403		*/
404		int libfsntfs_mft_entry_header_get_fixup_values_offset(
405		libfsntfs_mft_entry_header_t *mft_entry_header,
406		uint16_t *fixup_values_offset,
407		libcerror_error_t **error )
408	20.8k	{
409	20.8k	static char *function = "libfsntfs_mft_entry_header_get_fixup_values_offset";
410
411	20.8k	if( mft_entry_header == NULL )
412	0	{
413	0	libcerror_error_set(
414	0	error,
415	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
416	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
417	0	"%s: invalid MFT entry header.",
418	0	function );
419
420	0	return( -1 );
421	0	}
422	20.8k	if( fixup_values_offset == NULL )
423	0	{
424	0	libcerror_error_set(
425	0	error,
426	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
427	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
428	0	"%s: invalid fix-up values offset.",
429	0	function );
430
431	0	return( -1 );
432	0	}
433	20.8k	*fixup_values_offset = mft_entry_header->fixup_values_offset;
434
435	20.8k	return( 1 );
436	20.8k	}
437
438		/* Retrieves the number of fix-up values
439		* Returns 1 if successful or -1 on error
440		*/
441		int libfsntfs_mft_entry_header_get_number_of_fixup_values(
442		libfsntfs_mft_entry_header_t *mft_entry_header,
443		uint16_t *number_of_fixup_values,
444		libcerror_error_t **error )
445	20.7k	{
446	20.7k	static char *function = "libfsntfs_mft_entry_header_get_number_of_fixup_values";
447
448	20.7k	if( mft_entry_header == NULL )
449	0	{
450	0	libcerror_error_set(
451	0	error,
452	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
453	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
454	0	"%s: invalid MFT entry header.",
455	0	function );
456
457	0	return( -1 );
458	0	}
459	20.7k	if( number_of_fixup_values == NULL )
460	0	{
461	0	libcerror_error_set(
462	0	error,
463	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
464	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
465	0	"%s: invalid number of fix-up values.",
466	0	function );
467
468	0	return( -1 );
469	0	}
470	20.7k	*number_of_fixup_values = mft_entry_header->number_of_fixup_values;
471
472	20.7k	return( 1 );
473	20.7k	}
474
475		/* Retrieves the journal sequence number
476		* Returns 1 if successful or -1 on error
477		*/
478		int libfsntfs_mft_entry_header_get_journal_sequence_number(
479		libfsntfs_mft_entry_header_t *mft_entry_header,
480		uint64_t *journal_sequence_number,
481		libcerror_error_t **error )
482	0	{
483	0	static char *function = "libfsntfs_mft_entry_header_get_journal_sequence_number";
484
485	0	if( mft_entry_header == NULL )
486	0	{
487	0	libcerror_error_set(
488	0	error,
489	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
490	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
491	0	"%s: invalid MFT entry header.",
492	0	function );
493
494	0	return( -1 );
495	0	}
496	0	if( journal_sequence_number == NULL )
497	0	{
498	0	libcerror_error_set(
499	0	error,
500	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
501	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
502	0	"%s: invalid journal sequence number.",
503	0	function );
504
505	0	return( -1 );
506	0	}
507	0	*journal_sequence_number = mft_entry_header->journal_sequence_number;
508
509	0	return( 1 );
510	0	}
511
512		/* Retrieves the reference count
513		* Returns 1 if successful or -1 on error
514		*/
515		int libfsntfs_mft_entry_header_get_reference_count(
516		libfsntfs_mft_entry_header_t *mft_entry_header,
517		uint16_t *reference_count,
518		libcerror_error_t **error )
519	0	{
520	0	static char *function = "libfsntfs_mft_entry_header_get_reference_count";
521
522	0	if( mft_entry_header == NULL )
523	0	{
524	0	libcerror_error_set(
525	0	error,
526	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
527	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
528	0	"%s: invalid MFT entry header.",
529	0	function );
530
531	0	return( -1 );
532	0	}
533	0	if( reference_count == NULL )
534	0	{
535	0	libcerror_error_set(
536	0	error,
537	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
538	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
539	0	"%s: invalid reference count.",
540	0	function );
541
542	0	return( -1 );
543	0	}
544	0	*reference_count = mft_entry_header->reference_count;
545
546	0	return( 1 );
547	0	}
548
549		/* Retrieves the attributes offset
550		* Returns 1 if successful or -1 on error
551		*/
552		int libfsntfs_mft_entry_header_get_attributes_offset(
553		libfsntfs_mft_entry_header_t *mft_entry_header,
554		uint16_t *attributes_offset,
555		libcerror_error_t **error )
556	35.5k	{
557	35.5k	static char *function = "libfsntfs_mft_entry_header_get_attributes_offset";
558
559	35.5k	if( mft_entry_header == NULL )
560	0	{
561	0	libcerror_error_set(
562	0	error,
563	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
564	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
565	0	"%s: invalid MFT entry header.",
566	0	function );
567
568	0	return( -1 );
569	0	}
570	35.5k	if( attributes_offset == NULL )
571	0	{
572	0	libcerror_error_set(
573	0	error,
574	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
575	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
576	0	"%s: invalid attributes offset.",
577	0	function );
578
579	0	return( -1 );
580	0	}
581	35.5k	*attributes_offset = mft_entry_header->attributes_offset;
582
583	35.5k	return( 1 );
584	35.5k	}
585
586		/* Retrieves the used entry size
587		* Returns 1 if successful or -1 on error
588		*/
589		int libfsntfs_mft_entry_header_get_used_entry_size(
590		libfsntfs_mft_entry_header_t *mft_entry_header,
591		uint16_t *used_entry_size,
592		libcerror_error_t **error )
593	0	{
594	0	static char *function = "libfsntfs_mft_entry_header_get_used_entry_size";
595
596	0	if( mft_entry_header == NULL )
597	0	{
598	0	libcerror_error_set(
599	0	error,
600	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
601	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
602	0	"%s: invalid MFT entry header.",
603	0	function );
604
605	0	return( -1 );
606	0	}
607	0	if( used_entry_size == NULL )
608	0	{
609	0	libcerror_error_set(
610	0	error,
611	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
612	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
613	0	"%s: invalid used entry size.",
614	0	function );
615
616	0	return( -1 );
617	0	}
618	0	*used_entry_size = mft_entry_header->used_entry_size;
619
620	0	return( 1 );
621	0	}
622
623		/* Retrieves the total entry size
624		* Returns 1 if successful or -1 on error
625		*/
626		int libfsntfs_mft_entry_header_get_total_entry_size(
627		libfsntfs_mft_entry_header_t *mft_entry_header,
628		uint16_t *total_entry_size,
629		libcerror_error_t **error )
630	0	{
631	0	static char *function = "libfsntfs_mft_entry_header_get_total_entry_size";
632
633	0	if( mft_entry_header == NULL )
634	0	{
635	0	libcerror_error_set(
636	0	error,
637	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
638	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
639	0	"%s: invalid MFT entry header.",
640	0	function );
641
642	0	return( -1 );
643	0	}
644	0	if( total_entry_size == NULL )
645	0	{
646	0	libcerror_error_set(
647	0	error,
648	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
649	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
650	0	"%s: invalid total entry size.",
651	0	function );
652
653	0	return( -1 );
654	0	}
655	0	*total_entry_size = mft_entry_header->total_entry_size;
656
657	0	return( 1 );
658	0	}
659
660		/* Retrieves the base record file reference
661		* Returns 1 if successful or -1 on error
662		*/
663		int libfsntfs_mft_entry_header_get_base_record_file_reference(
664		libfsntfs_mft_entry_header_t *mft_entry_header,
665		uint64_t *base_record_file_reference,
666		libcerror_error_t **error )
667	24.2k	{
668	24.2k	static char *function = "libfsntfs_mft_entry_header_get_base_record_file_reference";
669
670	24.2k	if( mft_entry_header == NULL )
671	0	{
672	0	libcerror_error_set(
673	0	error,
674	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
675	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
676	0	"%s: invalid MFT entry header.",
677	0	function );
678
679	0	return( -1 );
680	0	}
681	24.2k	if( base_record_file_reference == NULL )
682	0	{
683	0	libcerror_error_set(
684	0	error,
685	0	LIBCERROR_ERROR_DOMAIN_ARGUMENTS,
686	0	LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,
687	0	"%s: invalid base record file reference.",
688	0	function );
689
690	0	return( -1 );
691	0	}
692	24.2k	*base_record_file_reference = mft_entry_header->base_record_file_reference;
693
694	24.2k	return( 1 );
695	24.2k	}
696