path: root/ntfsprogs/ntfsck.c (plain)
blob: 278160190dc3345e8058467fccc59e0ddef14511

1	/**
2	* ntfsck - Part of the Linux-NTFS project.
3	*
4	* Copyright (c) 2006 Yuval Fledel
5	*
6	* This utility will check and fix errors on an NTFS volume.
7	*
8	* This program is free software; you can redistribute it and/or modify
9	* it under the terms of the GNU General Public License as published by
10	* the Free Software Foundation; either version 2 of the License, or
11	* (at your option) any later version.
12	*
13	* This program is distributed in the hope that it will be useful,
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	* GNU General Public License for more details.
17	*
18	* You should have received a copy of the GNU General Public License
19	* along with this program (in the main directory of the Linux-NTFS
20	* distribution in the file COPYING); if not, write to the Free Software
21	* Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22	*/
23
24
25	#include "config.h"
26
27	#ifdef HAVE_STDIO_H
28	#include <stdio.h>
29	#endif
30	#ifdef HAVE_STDLIB_H
31	#include <stdlib.h>
32	#endif
33	#ifdef HAVE_STRING_H
34	#include <string.h>
35	#endif
36	#ifdef HAVE_FCNTL_H
37	#include <fcntl.h>
38	#endif
39
40	#include <layout.h>
41	#include <bitmap.h>
42	#include <endians.h>
43	#include <bootsect.h>
44	#include <misc.h>
45
46	#include "cluster.h"
47	#include "utils.h"
48
49	#define RETURN_FS_ERRORS_CORRECTED (1)
50	#define RETURN_SYSTEM_NEEDS_REBOOT (2)
51	#define RETURN_FS_ERRORS_LEFT_UNCORRECTED (4)
52	#define RETURN_OPERATIONAL_ERROR (8)
53	#define RETURN_USAGE_OR_SYNTAX_ERROR (16)
54	#define RETURN_CANCELLED_BY_USER (32)
55	/* Where did 64 go? */
56	#define RETURN_SHARED_LIBRARY_ERROR (128)
57
58	/* todo: command line: (everything is optional)
59	* fsck-frontend options:
60	* -C [fd] : display progress bar (send it to the file descriptor if specified)
61	* -T : don't show the title on startup
62	* fsck-checker options:
63	* -a : auto-repair. no questions. (optional: if marked clean and -f not specified, just check if mounable)
64	* -p : auto-repair safe. no questions (optional: same)
65	* -n : only check. no repair.
66	* -r : interactively repair.
67	* -y : always yes.
68	* -v : verbose.
69	* -V : version.
70	* taken from fsck.ext2
71	* -b sb : use the superblock from sb. For corrupted volumes. (do we want separete boot/mft options?)
72	* -c : use badblocks(8) to find bad blocks (R/O mode) and add the findings to $Bad.
73	* -C fd : write competion info to fd. If 0, print a completion bar.
74	* -d : debugging output.
75	* -D : rebalance indices.
76	* -f : force checking even if marked clean.
77	* -F : flush buffers before beginning. (for time-benchmarking)
78	* -k : When used with -c, don't erase previous $Bad items.
79	* -n : Open fs as readonly. assume always no. (why is it needed if -r is not specified?)
80	* -t : Print time statistics.
81	* taken from fsck.reiserfs
82	* --rebuild-sb : try to find $MFT start and rebuild the boot sector.
83	* --rebuild-tree : scan for items and rebuild the indices that point to them (0x30, $SDS, etc.)
84	* --clean-reserved: zero rezerved fields. (use with care!)
85	* --adjust-size -z: insert a sparse hole if the data_size is larger than the size marked in the runlist.
86	* --logfile file : report corruptions (unlike other errors) to a file instead of stderr.
87	* --nolog : don't report corruptions at all.
88	* --quiet -q : no progress bar.
89	* taken from fsck.msdos
90	* -w : flush after every write.
91	* - do n passes. (only 2 in fsck.msdos. second should not report errors. Bonus: stop when error list does not change)
92	* taken from fsck.jfs
93	* --omit-journal-reply: self-descriptive (why would someone do that?)
94	* --replay-journal-only: self-descriptive. don't check otherwise.
95	* taken from fsck.xfs
96	* -s : only serious errors should be reported.
97	* -i ino : verbose behaviour only for inode ino.
98	* -b bno : verbose behaviour only for cluster bno.
99	* -L : zero log.
100	* inspired by others
101	* - don't do cluster accounting.
102	* - don't do mft record accounting.
103	* - don't do file names accounting.
104	* - don't do security_id accounting.
105	* - don't check acl inheritance problems.
106	* - undelete unused mft records. (bonus: different options for 100% salvagable and less)
107	* - error-level-report n: only report errors above this error level
108	* - error-level-repair n: only repair errors below this error level
109	* - don't fail on ntfsclone metadata pruning.
110	* signals:
111	* SIGUSR1 : start displaying progress bar
112	* SIGUSR2 : stop displaying progress bar.
113	*/
114
115	/* Assuming NO_NTFS_DEVICE_DEFAULT_IO_OPS is not set */
116
117	static int errors = 0;
118	static int unsupported = 0;
119
120	static short bytes_per_sector, sectors_per_cluster;
121	//static s64 mft_offset, mftmirr_offset;
122	static s64 current_mft_record;
123
124	/**
125	* This is just a preliminary volume.
126	* Filled while checking the boot sector and used in the preliminary MFT check.
127	*/
128	//static ntfs_volume vol;
129
130	static runlist_element *mft_rl, *mft_bitmap_rl;
131
132	#define check_failed(FORMAT, ARGS...) \
133	do { \
134	errors++; \
135	ntfs_log_redirect(__FUNCTION__,__FILE__,__LINE__, \
136	NTFS_LOG_LEVEL_ERROR,NULL,FORMAT,##ARGS); \
137	} while (0);
138
139	/**
140	* 0 success.
141	* 1 fail.
142	*/
143	static int assert_u32_equal(u32 val, u32 ok, const char *name)
144	{
145	if (val!=ok) {
146	check_failed("Assertion failed for '%lld:%s'. should be 0x%x, "
147	"was 0x%x.\n", (long long)current_mft_record, name,
148	(int)ok, (int)val);
149	//errors++;
150	return 1;
151	}
152	return 0;
153	}
154
155	static int assert_u32_noteq(u32 val, u32 wrong, const char *name)
156	{
157	if (val==wrong) {
158	check_failed("Assertion failed for '%lld:%s'. should not be "
159	"0x%x.\n", (long long)current_mft_record, name,
160	(int)wrong);
161	return 1;
162	}
163	return 0;
164	}
165
166	static int assert_u32_lesseq(u32 val1, u32 val2, const char *name)
167	{
168	if (val1 > val2) {
169	check_failed("Assertion failed for '%s'. 0x%x > 0x%x\n",
170	name, (int)val1, (int)val2);
171	//errors++;
172	return 1;
173	}
174	return 0;
175	}
176
177	static int assert_u32_less(u32 val1, u32 val2, const char *name)
178	{
179	if (val1 >= val2) {
180	check_failed("Assertion failed for '%s'. 0x%x >= 0x%x\n",
181	name, (int)val1, (int)val2);
182	//errors++;
183	return 1;
184	}
185	return 0;
186	}
187
188	/**
189	* Return: 0 ok, 1 error.
190	*
191	* todo: may we use ntfs_boot_sector_is_ntfs() instead?
192	* It already does the checks but will not be able to fix anything.
193	*/
194	static BOOL verify_boot_sector(struct ntfs_device *dev, ntfs_volume *rawvol)
195	{
196	u8 buf[512];
197	NTFS_BOOT_SECTOR *ntfs_boot = (NTFS_BOOT_SECTOR *)&buf;
198	//u32 bytes_per_cluster;
199
200	current_mft_record = 9;
201
202	if (ntfs_pread(dev, 0, sizeof(buf), buf) != sizeof(buf)) {
203	check_failed("Failed to read boot sector.\n");
204	return 1;
205	}
206
207	if ((buf[0]!=0xeb) ||
208	((buf[1]!=0x52) && (buf[1]!=0x5b)) ||
209	(buf[2]!=0x90)) {
210	check_failed("Boot sector: Bad jump.\n");
211	}
212	if (ntfs_boot->oem_id != magicNTFS) {
213	check_failed("Boot sector: Bad NTFS magic.\n");
214	}
215	bytes_per_sector = le16_to_cpu(ntfs_boot->bpb.bytes_per_sector);
216	if (!bytes_per_sector) {
217	check_failed("Boot sector: Bytes per sector is 0.\n");
218	}
219	if (bytes_per_sector%512) {
220	check_failed("Boot sector: Bytes per sector is not a multiple"
221	" of 512.\n");
222	}
223	sectors_per_cluster = ntfs_boot->bpb.sectors_per_cluster;
224
225	// todo: if partition, query bios and match heads/tracks? */
226
227	// Initialize some values into rawvol. We will need those later.
228	rawvol->dev = dev;
229	ntfs_boot_sector_parse(rawvol, (NTFS_BOOT_SECTOR *)buf);
230
231	return 0;
232	}
233
234	/**
235	* Load the runlist of the <attr_type> attribute.
236	*
237	* Return NULL if an error.
238	* The caller is responsible on freeing the allocated memory if the result is not NULL.
239	*
240	* Set size_of_file_record to some reasonable size when in doubt (the Windows default is 1024.)
241	*
242	* attr_type must be little endian.
243	*
244	* This function has code duplication with check_file_record() and
245	* check_attr_record() but its goal is to be less strict. Thus the
246	* duplicated checks are the minimal required for not crashing.
247	*
248	* Assumes dev is open.
249	*/
250	static runlist *load_runlist(ntfs_volume *rawvol, s64 offset_to_file_record, u32 attr_type, u32 size_of_file_record)
251	{
252	u8 *buf;
253	u16 attrs_offset;
254	u32 length;
255	ATTR_RECORD *attr_rec;
256
257	if (size_of_file_record<22) // offset to attrs_offset
258	return NULL;
259
260	buf = (u8*)ntfs_malloc(size_of_file_record);
261	if (!buf)
262	return NULL;
263
264	if (ntfs_pread(rawvol->dev, offset_to_file_record, size_of_file_record, buf) !=
265	size_of_file_record) {
266	check_failed("Failed to read file record at offset %lld (0x%llx).\n",
267	(long long)offset_to_file_record,
268	(long long)offset_to_file_record);
269	return NULL;
270	}
271
272	attrs_offset = le16_to_cpu(((MFT_RECORD*)buf)->attrs_offset);
273	// first attribute must be after the header.
274	if (attrs_offset<42) {
275	check_failed("First attribute must be after the header (%u).\n", (int)attrs_offset);
276	}
277	attr_rec = (ATTR_RECORD *)(buf + attrs_offset);
278	//printf("uv1.\n");
279
280	while ((u8*)attr_rec<=buf+size_of_file_record-4) {
281
282	//printf("Attr type: 0x%x.\n", attr_rec->type);
283	// Check attribute record. (Only what is in the buffer)
284	if (attr_rec->type==AT_END) {
285	check_failed("Attribute 0x%x not found in file record at offset %lld (0x%llx).\n", (int)le32_to_cpu(attr_rec->type),
286	(long long)offset_to_file_record,
287	(long long)offset_to_file_record);
288	return NULL;
289	}
290	if ((u8*)attr_rec>buf+size_of_file_record-8) {
291	// not AT_END yet no room for the length field.
292	check_failed("Attribute 0x%x is not AT_END, yet no "
293	"room for the length field.\n",
294	(int)le32_to_cpu(attr_rec->type));
295	return NULL;
296	}
297
298	length = le32_to_cpu(attr_rec->length);
299
300	// Check that this attribute does not overflow the mft_record
301	if ((u8*)attr_rec+length >= buf+size_of_file_record) {
302	check_failed("Attribute (0x%x) is larger than FILE record at offset %lld (0x%llx).\n",
303	(int)le32_to_cpu(attr_rec->type),
304	(long long)offset_to_file_record,
305	(long long)offset_to_file_record);
306	return NULL;
307	}
308	// todo: what ATTRIBUTE_LIST (0x20)?
309
310	if (attr_rec->type==attr_type) {
311	// Eurika!
312
313	// ntfs_mapping_pairs_decompress only use two values from vol. Just fake it.
314	// todo: it will also use vol->major_ver if defined(DEBUG). But only for printing purposes.
315
316	// Assume ntfs_boot_sector_parse() was called.
317	return ntfs_mapping_pairs_decompress(rawvol, attr_rec, NULL);
318	}
319
320	attr_rec = (ATTR_RECORD*)((u8*)attr_rec+length);
321	}
322	// If we got here, there was an overflow.
323	check_failed("file record corrupted at offset %lld (0x%llx).\n",
324	(long long)offset_to_file_record,
325	(long long)offset_to_file_record);
326	return NULL;
327	}
328
329	/**
330	* Return: >=0 last VCN
331	* LCN_EINVAL error.
332	*/
333	static VCN get_last_vcn(runlist *rl)
334	{
335	VCN res;
336
337	if (!rl)
338	return LCN_EINVAL;
339
340	res = LCN_EINVAL;
341	while (rl->length) {
342	ntfs_log_verbose("vcn: %lld, length: %lld.\n",
343	(long long)rl->vcn, (long long)rl->length);
344	if (rl->vcn<0)
345	res = rl->vcn;
346	else
347	res = rl->vcn + rl->length;
348	rl++;
349	}
350
351	return res;
352	}
353
354	static u32 mft_bitmap_records;
355	static u8 *mft_bitmap_buf;
356
357	/**
358	* Assumes mft_bitmap_rl is initialized.
359	* return: 0 ok.
360	* RETURN_OPERATIONAL_ERROR on error.
361	*/
362	static int mft_bitmap_load(ntfs_volume *rawvol)
363	{
364	VCN vcn;
365	u32 mft_bitmap_length;
366
367	vcn = get_last_vcn(mft_bitmap_rl);
368	if (vcn<=LCN_EINVAL) {
369	mft_bitmap_buf = NULL;
370	/* This case should not happen, not even with on-disk errors */
371	goto error;
372	}
373
374	mft_bitmap_length = vcn * rawvol->cluster_size;
375	mft_bitmap_records = 8 * mft_bitmap_length * rawvol->cluster_size /
376	rawvol->mft_record_size;
377
378	//printf("sizes: %d, %d.\n", mft_bitmap_length, mft_bitmap_records);
379
380	mft_bitmap_buf = (u8*)ntfs_malloc(mft_bitmap_length);
381	if (!mft_bitmap_buf)
382	goto error;
383	if (ntfs_rl_pread(rawvol, mft_bitmap_rl, 0, mft_bitmap_length,
384	mft_bitmap_buf)!=mft_bitmap_length)
385	goto error;
386	return 0;
387	error:
388	mft_bitmap_records = 0;
389	ntfs_log_error("Could not load $MFT/Bitmap.\n");
390	return RETURN_OPERATIONAL_ERROR;
391	}
392
393	/**
394	* -1 Error.
395	* 0 Unused record
396	* 1 Used record
397	*
398	* Assumes mft_bitmap_rl was initialized.
399	*/
400	static int mft_bitmap_get_bit(s64 mft_no)
401	{
402	if (mft_no>=mft_bitmap_records)
403	return -1;
404	return ntfs_bit_get(mft_bitmap_buf, mft_no);
405	}
406
407	/**
408	* @attr_rec: The attribute record to check
409	* @mft_rec: The parent FILE record.
410	* @buflen: The size of the FILE record.
411	*
412	* Return:
413	* NULL: Fatal error occured. Not sure where is the next record.
414	* otherwise: pointer to the next attribute record.
415	*
416	* The function only check fields that are inside this attr record.
417	*
418	* Assumes mft_rec is current_mft_record.
419	*/
420	static ATTR_REC *check_attr_record(ATTR_REC *attr_rec, MFT_RECORD *mft_rec,
421	u16 buflen)
422	{
423	u16 name_offset;
424	u16 attrs_offset = le16_to_cpu(mft_rec->attrs_offset);
425	u32 attr_type = le32_to_cpu(attr_rec->type);
426	u32 length = le32_to_cpu(attr_rec->length);
427
428	// Check that this attribute does not overflow the mft_record
429	if ((u8*)attr_rec+length >= ((u8*)mft_rec)+buflen) {
430	check_failed("Attribute (0x%x) is larger than FILE record (%lld).\n",
431	(int)attr_type, (long long)current_mft_record);
432	return NULL;
433	}
434
435	// Attr type must be a multiple of 0x10 and 0x10<=x<=0x100.
436	if ((attr_type & ~0x0F0) && (attr_type != 0x100)) {
437	check_failed("Unknown attribute type 0x%x.\n",
438	(int)attr_type);
439	goto check_attr_record_next_attr;
440	}
441
442	if (length<24) {
443	check_failed("Attribute %lld:0x%x Length too short (%u).\n",
444	(long long)current_mft_record, (int)attr_type,
445	(int)length);
446	goto check_attr_record_next_attr;
447	}
448
449	// If this is the first attribute:
450	// todo: instance number must be smaller than next_instance.
451	if ((u8*)attr_rec == ((u8*)mft_rec) + attrs_offset) {
452	if (!mft_rec->base_mft_record)
453	assert_u32_equal(attr_type, 0x10,
454	"First attribute type");
455	// The following not always holds.
456	// attr 0x10 becomes instance 1 and attr 0x40 becomes 0.
457	//assert_u32_equal(attr_rec->instance, 0,
458	// "First attribute instance number");
459	} else {
460	assert_u32_noteq(attr_type, 0x10,
461	"Not-first attribute type");
462	// The following not always holds.
463	//assert_u32_noteq(attr_rec->instance, 0,
464	// "Not-first attribute instance number");
465	}
466	//if (current_mft_record==938 || current_mft_record==1683 || current_mft_record==3152 || current_mft_record==22410)
467	//printf("Attribute %lld:0x%x instance: %u isbase:%d.\n",
468	// current_mft_record, (int)attr_type, (int)le16_to_cpu(attr_rec->instance), (int)mft_rec->base_mft_record);
469	// todo: instance is unique.
470
471	// Check flags.
472	if (attr_rec->flags & ~(const_cpu_to_le16(0xc0ff))) {
473	check_failed("Attribute %lld:0x%x Unknown flags (0x%x).\n",
474	(long long)current_mft_record, (int)attr_type,
475	(int)le16_to_cpu(attr_rec->flags));
476	}
477
478	if (attr_rec->non_resident>1) {
479	check_failed("Attribute %lld:0x%x Unknown non-resident "
480	"flag (0x%x).\n", (long long)current_mft_record,
481	(int)attr_type, (int)attr_rec->non_resident);
482	goto check_attr_record_next_attr;
483	}
484
485	name_offset = le16_to_cpu(attr_rec->name_offset);
486	/*
487	* todo: name must be legal unicode.
488	* Not really, information below in urls is about filenames, but I
489	* believe it also applies to attribute names. (Yura)
490	* http://blogs.msdn.com/michkap/archive/2006/09/24/769540.aspx
491	* http://blogs.msdn.com/michkap/archive/2006/09/10/748699.aspx
492	*/
493
494	if (attr_rec->non_resident) {
495	// Non-Resident
496
497	// Make sure all the fields exist.
498	if (length<64) {
499	check_failed("Non-resident attribute %lld:0x%x too short (%u).\n",
500	(long long)current_mft_record, (int)attr_type,
501	(int)length);
502	goto check_attr_record_next_attr;
503	}
504	if (attr_rec->compression_unit && (length<72)) {
505	check_failed("Compressed attribute %lld:0x%x too short (%u).\n",
506	(long long)current_mft_record, (int)attr_type,
507	(int)length);
508	goto check_attr_record_next_attr;
509	}
510
511	// todo: name comes before mapping pairs, and after the header.
512	// todo: length==mapping_pairs_offset+length of compressed mapping pairs.
513	// todo: mapping_pairs_offset is 8-byte aligned.
514
515	// todo: lowest vcn <= highest_vcn
516	// todo: if base record -> lowest vcn==0
517	// todo: lowest_vcn!=0 -> attribute list is used.
518	// todo: lowest_vcn & highest_vcn are in the drive (0<=x<total clusters)
519	// todo: mapping pairs agree with highest_vcn.
520	// todo: compression unit == 0 or 4.
521	// todo: reserved1 == 0.
522	// todo: if not compressed nor sparse, initialized_size <= allocated_size and data_size <= allocated_size.
523	// todo: if compressed or sparse, allocated_size <= initialized_size and allocated_size <= data_size
524	// todo: if mft_no!=0 and not compressed/sparse, data_size==initialized_size.
525	// todo: if mft_no!=0 and compressed/sparse, allocated_size==initialized_size.
526	// todo: what about compressed_size if compressed?
527	// todo: attribute must not be 0x10, 0x30, 0x40, 0x60, 0x70, 0x90, 0xd0 (not sure about 0xb0, 0xe0, 0xf0)
528	} else {
529	u16 value_offset = le16_to_cpu(attr_rec->value_offset);
530	u32 value_length = le32_to_cpu(attr_rec->value_length);
531	// Resident
532	if (attr_rec->name_length) {
533	if (name_offset < 24)
534	check_failed("Resident attribute with "
535	"name intersecting header.\n");
536	if (value_offset < name_offset +
537	attr_rec->name_length)
538	check_failed("Named resident attribute "
539	"with value before name.\n");
540	}
541	// if resident, length==value_length+value_offset
542	//assert_u32_equal(le32_to_cpu(attr_rec->value_length)+
543	// value_offset, length,
544	// "length==value_length+value_offset");
545	// if resident, length==value_length+value_offset
546	if (value_length+value_offset > length) {
547	check_failed("value_length(%d)+value_offset(%d)>length(%d) for attribute 0x%x.\n", (int)value_length, (int)value_offset, (int)length, (int)attr_type);
548	return NULL;
549	}
550
551	// Check resident_flags.
552	if (attr_rec->resident_flags>0x01) {
553	check_failed("Unknown resident flags (0x%x) for attribute 0x%x.\n", (int)attr_rec->resident_flags, (int)attr_type);
554	} else if (attr_rec->resident_flags && (attr_type!=0x30)) {
555	check_failed("Resident flags mark attribute 0x%x as indexed.\n", (int)attr_type);
556	}
557
558	// reservedR is 0.
559	assert_u32_equal(attr_rec->reservedR, 0, "Resident Reserved");
560
561	// todo: attribute must not be 0xa0 (not sure about 0xb0, 0xe0, 0xf0)
562	// todo: check content well-formness per attr_type.
563	}
564	return 0;
565	check_attr_record_next_attr:
566	return (ATTR_REC *)(((u8 *)attr_rec) + length);
567	}
568
569	/**
570	* All checks that can be satisfied only by data from the buffer.
571	* No other [MFT records/metadata files] are required.
572	*
573	* The buffer is changed by removing the Update Sequence.
574	*
575	* Return:
576	* 0 Everything's cool.
577	* else Consider this record as damaged.
578	*/
579	static BOOL check_file_record(u8 *buffer, u16 buflen)
580	{
581	u16 usa_count, usa_ofs, attrs_offset, usa;
582	u32 bytes_in_use, bytes_allocated, i;
583	MFT_RECORD *mft_rec = (MFT_RECORD *)buffer;
584	ATTR_REC *attr_rec;
585
586	// check record magic
587	assert_u32_equal(mft_rec->magic, magic_FILE, "FILE record magic");
588	// todo: records 16-23 must be filled in order.
589	// todo: what to do with magic_BAAD?
590
591	// check usa_count+offset to update seq <= attrs_offset <
592	// bytes_in_use <= bytes_allocated <= buflen.
593	usa_ofs = le16_to_cpu(mft_rec->usa_ofs);
594	usa_count = le16_to_cpu(mft_rec->usa_count);
595	attrs_offset = le16_to_cpu(mft_rec->attrs_offset);
596	bytes_in_use = le32_to_cpu(mft_rec->bytes_in_use);
597	bytes_allocated = le32_to_cpu(mft_rec->bytes_allocated);
598	if (assert_u32_lesseq(usa_ofs+usa_count, attrs_offset,
599	"usa_ofs+usa_count <= attrs_offset") ||
600	assert_u32_less(attrs_offset, bytes_in_use,
601	"attrs_offset < bytes_in_use") ||
602	assert_u32_lesseq(bytes_in_use, bytes_allocated,
603	"bytes_in_use <= bytes_allocated") ||
604	assert_u32_lesseq(bytes_allocated, buflen,
605	"bytes_allocated <= max_record_size")) {
606	return 1;
607	}
608
609
610	// We should know all the flags.
611	if (mft_rec->flags>0xf) {
612	check_failed("Unknown MFT record flags (0x%x).\n",
613	(unsigned int)mft_rec->flags);
614	}
615	// todo: flag in_use must be on.
616
617	// Remove update seq & check it.
618	usa = *(u16*)(buffer+usa_ofs); // The value that should be at the end of every sector.
619	assert_u32_equal(usa_count-1, buflen/NTFS_BLOCK_SIZE, "USA length");
620	for (i=1;i<usa_count;i++) {
621	u16 *fixup = (u16*)(buffer+NTFS_BLOCK_SIZE*i-2); // the value at the end of the sector.
622	u16 saved_val = *(u16*)(buffer+usa_ofs+2*i); // the actual data value that was saved in the us array.
623
624	assert_u32_equal(*fixup, usa, "fixup");
625	*fixup = saved_val; // remove it.
626	}
627
628	attr_rec = (ATTR_REC *)(buffer + attrs_offset);
629	while ((u8*)attr_rec<=buffer+buflen-4) {
630
631	// Check attribute record. (Only what is in the buffer)
632	if (attr_rec->type==AT_END) {
633	// Done.
634	return 0;
635	}
636	if ((u8*)attr_rec>buffer+buflen-8) {
637	// not AT_END yet no room for the length field.
638	check_failed("Attribute 0x%x is not AT_END, yet no "
639	"room for the length field.\n",
640	(int)le32_to_cpu(attr_rec->type));
641	return 1;
642	}
643
644	attr_rec = check_attr_record(attr_rec, mft_rec, buflen);
645	if (!attr_rec)
646	return 1;
647	}
648	// If we got here, there was an overflow.
649	return 1;
650
651	// todo: an attribute should be at the offset to first attribute, and the offset should be inside the buffer. It should have the value of "next attribute id".
652	// todo: if base record, it should start with attribute 0x10.
653
654	// Highlevel check of attributes.
655	// todo: Attributes are well-formed.
656	// todo: Room for next attribute in the end of the previous record.
657
658	return FALSE;
659	}
660
661	static void replay_log(ntfs_volume *vol __attribute__((unused)))
662	{
663	// At this time, only check that the log is fully replayed.
664	ntfs_log_warning("Unsupported: replay_log()\n");
665	// todo: if logfile is clean, return success.
666	unsupported++;
667	}
668
669	static void verify_mft_record(ntfs_volume *vol, s64 mft_num)
670	{
671	u8 *buffer;
672	int is_used;
673
674	current_mft_record = mft_num;
675
676	is_used = mft_bitmap_get_bit(mft_num);
677	if (is_used<0) {
678	ntfs_log_error("Error getting bit value for record %lld.\n",
679	(long long)mft_num);
680	} else if (!is_used) {
681	ntfs_log_verbose("Record %lld unused. Skipping.\n",
682	(long long)mft_num);
683	return;
684	}
685
686	buffer = ntfs_malloc(vol->mft_record_size);
687	if (!buffer)
688	goto verify_mft_record_error;
689
690	ntfs_log_verbose("MFT record %lld\n", (long long)mft_num);
691	if (ntfs_attr_pread(vol->mft_na, mft_num*vol->mft_record_size, vol->mft_record_size, buffer) < 0) {
692	ntfs_log_perror("Couldn't read $MFT record %lld", (long long)mft_num);
693	goto verify_mft_record_error;
694	}
695
696	check_file_record(buffer, vol->mft_record_size);
697	// todo: if offset to first attribute >= 0x30, number of mft record should match.
698	// todo: Match the "record is used" with the mft bitmap.
699	// todo: if this is not base, check that the parent is a base, and is in use, and pointing to this record.
700
701	// todo: if base record: for each extent record:
702	// todo: verify_file_record
703	// todo: hard link count should be the number of 0x30 attributes.
704	// todo: Order of attributes.
705	// todo: make sure compression_unit is the same.
706
707	return;
708	verify_mft_record_error:
709
710	if (buffer)
711	free(buffer);
712	errors++;
713	}
714
715	/**
716	* This function serves as bootstraping for the more comprehensive checks.
717	* It will load the MFT runlist and MFT/Bitmap runlist.
718	* It should not depend on other checks or we may have a circular dependancy.
719	* Also, this loadng must be forgiving, unlike the comprehensive checks.
720	*/
721	static int verify_mft_preliminary(ntfs_volume *rawvol)
722	{
723	current_mft_record = 0;
724	s64 mft_offset, mftmirr_offset;
725	int res;
726
727	ntfs_log_trace("Entering verify_mft_preliminary().\n");
728	// todo: get size_of_file_record from boot sector
729	// Load the first segment of the $MFT/DATA runlist.
730	mft_offset = rawvol->mft_lcn * rawvol->cluster_size;
731	mftmirr_offset = rawvol->mftmirr_lcn * rawvol->cluster_size;
732	mft_rl = load_runlist(rawvol, mft_offset, AT_DATA, 1024);
733	if (!mft_rl) {
734	check_failed("Loading $MFT runlist failed. Trying $MFTMirr.\n");
735	mft_rl = load_runlist(rawvol, mftmirr_offset, AT_DATA, 1024);
736	}
737	if (!mft_rl) {
738	check_failed("Loading $MFTMirr runlist failed too. Aborting.\n");
739	return RETURN_FS_ERRORS_LEFT_UNCORRECTED | RETURN_OPERATIONAL_ERROR;
740	}
741	// TODO: else { recover $MFT } // Use $MFTMirr to recover $MFT.
742	// todo: support loading the next runlist extents when ATTRIBUTE_LIST is used on $MFT.
743	// If attribute list: Gradually load mft runlist. (parse runlist from first file record, check all referenced file records, continue with the next file record). If no attribute list, just load it.
744
745	// Load the runlist of $MFT/Bitmap.
746	// todo: what about ATTRIBUTE_LIST? Can we reuse code?
747	mft_bitmap_rl = load_runlist(rawvol, mft_offset, AT_BITMAP, 1024);
748	if (!mft_bitmap_rl) {
749	check_failed("Loading $MFT/Bitmap runlist failed. Trying $MFTMirr.\n");
750	mft_bitmap_rl = load_runlist(rawvol, mftmirr_offset, AT_BITMAP, 1024);
751	}
752	if (!mft_bitmap_rl) {
753	check_failed("Loading $MFTMirr/Bitmap runlist failed too. Aborting.\n");
754	return RETURN_FS_ERRORS_LEFT_UNCORRECTED;
755	// todo: rebuild the bitmap by using the "in_use" file record flag or by filling it with 1's.
756	}
757
758	/* Load $MFT/Bitmap */
759	if ((res = mft_bitmap_load(rawvol)))
760	return res;
761	return -1; /* FIXME: Just added to fix compiler warning without
762	thinking about what should be here. (Yura) */
763	}
764
765	static void check_volume(ntfs_volume *vol)
766	{
767	s64 mft_num, nr_mft_records;
768
769	ntfs_log_warning("Unsupported: check_volume()\n");
770	unsupported++;
771
772	// For each mft record, verify that it contains a valid file record.
773	nr_mft_records = vol->mft_na->initialized_size >>
774	vol->mft_record_size_bits;
775	ntfs_log_info("Checking %lld MFT records.\n", (long long)nr_mft_records);
776
777	for (mft_num=0; mft_num < nr_mft_records; mft_num++) {
778	verify_mft_record(vol, mft_num);
779	}
780
781	// todo: Check metadata files.
782
783	// todo: Second pass on mft records. Now check the contents as well.
784	// todo: When going through runlists, build a bitmap.
785
786	// todo: cluster accounting.
787	return;
788	}
789
790	static int reset_dirty(ntfs_volume *vol)
791	{
792	u16 flags;
793
794	if (!(vol->flags | VOLUME_IS_DIRTY))
795	return 0;
796
797	ntfs_log_verbose("Resetting dirty flag.\n");
798
799	flags = vol->flags & ~VOLUME_IS_DIRTY;
800
801	if (ntfs_volume_write_flags(vol, flags)) {
802	ntfs_log_error("Error setting volume flags.\n");
803	return -1;
804	}
805	return 0;
806	}
807
808	/**
809	* main - Does just what C99 claim it does.
810	*
811	* For more details on arguments and results, check the man page.
812	*/
813	int main(int argc, char **argv)
814	{
815	struct ntfs_device *dev;
816	ntfs_volume rawvol;
817	ntfs_volume *vol;
818	const char *name;
819	int ret;
820
821	if (argc != 2)
822	return RETURN_USAGE_OR_SYNTAX_ERROR;
823	name = argv[1];
824
825	ntfs_log_set_handler(ntfs_log_handler_outerr);
826	//ntfs_log_set_levels(NTFS_LOG_LEVEL_DEBUG | NTFS_LOG_LEVEL_TRACE | NTFS_LOG_LEVEL_QUIET | NTFS_LOG_LEVEL_INFO | NTFS_LOG_LEVEL_VERBOSE | NTFS_LOG_LEVEL_PROGRESS);
827
828	/* Allocate an ntfs_device structure. */
829	dev = ntfs_device_alloc(name, 0, &ntfs_device_default_io_ops, NULL);
830	if (!dev)
831	return RETURN_OPERATIONAL_ERROR;
832	if (dev->d_ops->open(dev, O_RDONLY)) { //O_RDWR/O_RDONLY?
833	ntfs_log_perror("Error opening partition device");
834	ntfs_device_free(dev);
835	return RETURN_OPERATIONAL_ERROR;
836	}
837
838	if ((ret = verify_boot_sector(dev,&rawvol))) {
839	dev->d_ops->close(dev);
840	return ret;
841	}
842	ntfs_log_verbose("Boot sector verification complete. Proceeding to $MFT");
843
844	verify_mft_preliminary(&rawvol);
845
846	/* ntfs_device_mount() expects the device to be closed. */
847	if (dev->d_ops->close(dev))
848	ntfs_log_perror("Failed to close the device.");
849
850	// at this point we know that the volume is valid enough for mounting.
851
852	/* Call ntfs_device_mount() to do the actual mount. */
853	vol = ntfs_device_mount(dev, NTFS_MNT_RDONLY);
854	if (!vol) {
855	ntfs_device_free(dev);
856	return 2;
857	}
858
859	replay_log(vol);
860
861	if (vol->flags & VOLUME_IS_DIRTY)
862	ntfs_log_warning("Volume is dirty.\n");
863
864	check_volume(vol);
865
866	if (errors)
867	ntfs_log_info("Errors found.\n");
868	if (unsupported)
869	ntfs_log_info("Unsupported cases found.\n");
870
871	if (!errors && !unsupported) {
872	reset_dirty(vol);
873	}
874
875	ntfs_umount(vol, FALSE);
876
877	if (errors)
878	return 2;
879	if (unsupported)
880	return 1;
881	return 0;
882	}
883
884