Module: NTFS::Utils

Defined in:
lib/fs/ntfs/utils.rb

Class Method Summary collapse

Class Method Details

.gotBit?(flags, bit) ⇒ Boolean

Returns:

  • (Boolean) 


10
11
12
 
# File 'lib/fs/ntfs/utils.rb', line 10

def self.gotBit?(flags, bit)
  (flags & bit) == bit
end

.MkRef(ref) ⇒ Object

Make a reference (upper two bytes are seq num, lower six are entry).



6
7
8
 
# File 'lib/fs/ntfs/utils.rb', line 6

def self.MkRef(ref)
  ref.divmod(2**48)
end

.process_fixups(buf, fixup_offset, usa_offset, usa_count) ⇒ Object

Process per-sector “fixups” that NTFS uses to detect corruption of multi-sector data structures, like MFT records.



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/fs/ntfs/utils.rb', line 16

def self.process_fixups(buf, fixup_offset, usa_offset, usa_count)
  #
  # The signature value we must look for is stored just before the fix-up array.
  #
  fu_sig = buf[usa_offset, 2].unpack('S')[0]

  #
  # For each end-of-sector, check that the last two bytes equal the fixup signature.
  # If so, replace them with original data stored in the update sequence array.
  #
  1.upto(usa_count - 1) do |i|
    sig = buf[i * fixup_offset - 2, 2].unpack('S')[0]
    raise "NTFS Fixup Error: fixup signature:<#{fu_sig}> does not match signature[#{i}]=<#{sig}> - consider running chkdsk" if sig != fu_sig
    buf[i * fixup_offset - 2, 2] = buf[i * 2 + usa_offset, 2]
  end

  buf
end

.validate_signature(signature, expected) ⇒ Object 



35
36
37
38
39
40
41
 
# File 'lib/fs/ntfs/utils.rb', line 35

def self.validate_signature(signature, expected)
  if signature != expected
    raise "Uninitialized"   if signature == "\000\000\000\000"
    raise "Bad Sector"      if signature == 'BAAD'
    raise "Invalid Signature <#{signature}>"
  end
end