diff options
author | Stef Walter <stef@thewalter.net> | 2004-05-20 01:30:03 +0000 |
---|---|---|
committer | Stef Walter <stef@thewalter.net> | 2004-05-20 01:30:03 +0000 |
commit | f2927861c56167c8e8ca633b38ba5e703228e4c3 (patch) | |
tree | 01ef06e648a10889beb36b9fca1d1ba87996e6ba | |
parent | 5077703809c6ab8781e2b796678ee98b3212c45d (diff) |
Partition search comments.
-rw-r--r-- | src/search.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/search.c b/src/search.c index 2d9ee35..834bd32 100644 --- a/src/search.c +++ b/src/search.c @@ -26,7 +26,17 @@ void scroungeSearch(partitioninfo* pi) fprintf(stderr, "[Performing NTFS partition search...]"); errx(1, "search functionality not implemented yet."); - /* go through all sectors until we find an MFT record */ - /* that isn't the MFT mirror */ + /* + * go through and look for an $MFTMirr file record. First of all + * these should be exactly 4096 bytes long. This allows us + * to discover the length of a cluster, using both the data + * runs in the $MFTMirr and the cbAllocated. + * + * Determine if it's the $MFTMirr or $MFT we're looking at + * + * Next using this cluster information we can discover the + * beginning of the partition, + */ + } |