summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStef Walter <stef@thewalter.net>2004-05-20 01:30:03 +0000
committerStef Walter <stef@thewalter.net>2004-05-20 01:30:03 +0000
commitf2927861c56167c8e8ca633b38ba5e703228e4c3 (patch)
tree01ef06e648a10889beb36b9fca1d1ba87996e6ba
parent5077703809c6ab8781e2b796678ee98b3212c45d (diff)
Partition search comments.
-rw-r--r--src/search.c14
1 files changed, 12 insertions, 2 deletions
diff --git a/src/search.c b/src/search.c
index 2d9ee35..834bd32 100644
--- a/src/search.c
+++ b/src/search.c
@@ -26,7 +26,17 @@ void scroungeSearch(partitioninfo* pi)
fprintf(stderr, "[Performing NTFS partition search...]");
errx(1, "search functionality not implemented yet.");
- /* go through all sectors until we find an MFT record */
- /* that isn't the MFT mirror */
+ /*
+ * go through and look for an $MFTMirr file record. First of all
+ * these should be exactly 4096 bytes long. This allows us
+ * to discover the length of a cluster, using both the data
+ * runs in the $MFTMirr and the cbAllocated.
+ *
+ * Determine if it's the $MFTMirr or $MFT we're looking at
+ *
+ * Next using this cluster information we can discover the
+ * beginning of the partition,
+ */
+
}