diff options
| -rw-r--r-- | .gitignore | 5 | ||||
| -rw-r--r-- | EXAMPLE | 7 | ||||
| -rw-r--r-- | Makefile | 2 | ||||
| -rw-r--r-- | config.h | 84 | ||||
| -rw-r--r-- | main.c | 427 |
5 files changed, 525 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fc40a45 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +*.swp +*~ +*.o +/ntfsfree + @@ -0,0 +1,7 @@ +# Get all free ranges that are at least 500MB, +# pagefile.sys will be ignored (considered free space) +# Then sort them by size, descending +./ntfsfree -m 50000000 -p /tmp/test.ntfs | sort -r -k 4,4 -n -b + +# Human readable listing of all free ranges of at least 1MB +./ntfsfree -m 1000000 -h /dev/sda5 diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..399a370 --- /dev/null +++ b/Makefile @@ -0,0 +1,2 @@ +all: + gcc -Wall -Wextra -pedantic -o ntfsfree main.c -lntfs-3g diff --git a/config.h b/config.h new file mode 100644 index 0000000..c35518a --- /dev/null +++ b/config.h @@ -0,0 +1,84 @@ +#define HAVE_ATEXIT 1 +#define HAVE_BASENAME 1 +#define HAVE_BYTESWAP_H 1 +#define HAVE_CLOCK_GETTIME 1 +#define HAVE_CTYPE_H 1 +#define HAVE_DAEMON 1 +#define HAVE_DLFCN_H 1 +#define HAVE_DUP2 1 +#define HAVE_ENDIAN_H 1 +#define HAVE_ERRNO_H 1 +#define HAVE_FCNTL_H 1 +#define HAVE_FDATASYNC 1 +#define HAVE_FEATURES_H 1 +#define HAVE_FFS 1 +#define HAVE_FORK 1 +#define HAVE_GETMNTENT 1 +#define HAVE_GETOPT_H 1 +#define HAVE_GETOPT_LONG 1 +#define HAVE_GETTIMEOFDAY 1 +#define HAVE_HASMNTOPT 1 +#define HAVE_INTTYPES_H 1 +#define HAVE_LIBGEN_H 1 +#define HAVE_LIBINTL_H 1 +#define HAVE_LIMITS_H 1 +#define HAVE_LINUX_FD_H 1 +#define HAVE_LINUX_FS_H 1 +#define HAVE_LINUX_HDREG_H 1 +#define HAVE_LINUX_MAJOR_H 1 +#define HAVE_LOCALE_H 1 +#define HAVE_MALLOC_H 1 +#define HAVE_MBRTOWC 1 +#define HAVE_MBSINIT 1 +#define HAVE_MEMCPY 1 +#define HAVE_MEMMOVE 1 +#define HAVE_MEMORY_H 1 +#define HAVE_MEMSET 1 +#define HAVE_MNTENT_H 1 +#define HAVE_PWD_H 1 +#define HAVE_RANDOM 1 +#define HAVE_REALPATH 1 +#define HAVE_REGCOMP 1 +#define HAVE_REGEX_H 1 +#define HAVE_SETLOCALE 1 +#define HAVE_SETXATTR 1 +#define HAVE_SNPRINTF 1 +#define HAVE_STDARG_H 1 +#define HAVE_STDBOOL_H 1 +#define HAVE_STDDEF_H 1 +#define HAVE_STDINT_H 1 +#define HAVE_STDIO_H 1 +#define HAVE_STDLIB_H 1 +#define HAVE_STRCASECMP 1 +#define HAVE_STRCHR 1 +#define HAVE_STRDUP 1 +#define HAVE_STRERROR 1 +#define HAVE_STRFTIME 1 +#define HAVE_STRINGS_H 1 +#define HAVE_STRING_H 1 +#define HAVE_STRNLEN 1 +#define HAVE_STRSEP 1 +#define HAVE_STRTOL 1 +#define HAVE_STRTOUL 1 +#define HAVE_STRUCT_STAT_ST_ATIM 1 +#define HAVE_STRUCT_STAT_ST_BLOCKS 1 +#define HAVE_STRUCT_STAT_ST_RDEV 1 +#define HAVE_ST_BLOCKS 1 +#define HAVE_SYSCONF 1 +#define HAVE_SYSLOG_H 1 +#define HAVE_SYS_IOCTL_H 1 +#define HAVE_SYS_MOUNT_H 1 +#define HAVE_SYS_PARAM_H 1 +#define HAVE_SYS_STATVFS_H 1 +#define HAVE_SYS_STAT_H 1 +#define HAVE_SYS_TYPES_H 1 +#define HAVE_SYS_VFS_H 1 +#define HAVE_TIME_H 1 +#define HAVE_UNISTD_H 1 +#define HAVE_UTIME 1 +#define HAVE_UTIMENSAT 1 +#define HAVE_UTIME_H 1 +#define HAVE_UTIME_NULL 1 +#define HAVE_VPRINTF 1 +#define HAVE_WCHAR_H 1 +#define HAVE__BOOL 1 @@ -0,0 +1,427 @@ +#include <stdio.h> +#include <stdarg.h> +#include <stdlib.h> +#include <errno.h> +#include <string.h> +#include <getopt.h> + +#include "config.h" +#include <ntfs-3g/volume.h> +#include <ntfs-3g/dir.h> + +#define PFMAX (10) +static struct { + s64 from; + s64 to; +} pagefile[PFMAX]; +static int pfcount = 0; + +static struct { + s64 min_size; + int human; + int brief; + int force; + int pagefile; + char *device; +} options; + +static int utils_valid_device(const char *name, int force); +static ntfs_volume * utils_mount_volume(const char *device, unsigned long flags); +ATTR_RECORD * find_attribute(const ATTR_TYPES type, ntfs_attr_search_ctx *ctx); +static int utils_cluster_in_use(ntfs_volume *vol, long long lcn); +static int scan_free_space(ntfs_volume *vol); +static int get_pagefile_clusters(ntfs_volume *vol); + +// Params +// +// +static int parse_options(int argc, char **argv) +{ + static const char *sopt = "-m:hbfp"; + static const struct option lopt[] = { + { "min-size", required_argument, NULL, 'm' }, + { "human-readable", no_argument, NULL, 'h' }, + { "brief", no_argument, NULL, 'b' }, + { "force", no_argument, NULL, 'f' }, + { "pagefile", no_argument, NULL, 'p' }, + { NULL, 0, NULL, 0 } + }; + + int c = -1; + int help = 0; + char *end = NULL; + + opterr = 0; /* We'll handle the errors, thank you. */ + + options.min_size = 500000000; + options.human = 0; + options.brief = 0; + options.force = 0; + options.pagefile = 0; + options.device = NULL; + + while ((c = getopt_long(argc, argv, sopt, lopt, NULL)) != -1) { + switch (c) { + case 1: /* A non-option argument */ + if (options.device == NULL) { + options.device = argv[optind-1]; + } else { + options.device = NULL; + help = 1; + } + break; + + case 'b': + options.brief = 1; + break; + case 'h': + options.human = 1; + break; + case 'm': + options.min_size = strtol(optarg, &end, 0); + break; + case 'f': + options.force = 1; + break; + case 'p': + options.pagefile = 1; + break; + default: + ntfs_log_error("Unknown option '%s'.\n", argv[optind-1]); + help = 1; + break; + } + if (help) break; + } + + if (help || options.min_size < 0) { + ntfs_log_error("Usage: %s [-m|--min-size <bytes>] [-h|--human-readable] [-b|--brief] [-p|--pagefile] <device>\n", argv[0]); + } + + return help; +} + +// Main +// +// + +int main(int argc, char **argv) +{ + ntfs_volume *vol; + int flags = NTFS_MNT_RDONLY; + int ret = 0; + // + ntfs_log_set_handler(ntfs_log_handler_outerr); + if (parse_options(argc, argv) != 0) { + return 1; + } + if (options.force) { + flags |= NTFS_MNT_RECOVER; + } + // + vol = utils_mount_volume(options.device, flags); + if (vol == NULL) { + ntfs_log_error("Device '%s' not found.\n", options.device); + return 1; + } + options.min_size /= vol->cluster_size; + if (options.pagefile) { + ret = get_pagefile_clusters(vol); + } + if (ret >= 0) { + ret = scan_free_space(vol); + } + ntfs_umount(vol, FALSE); + return ret > 0 ? 0 : 2; +} + +// Helpers +// +// + +// Based on ntfsprogs/utils.* +static int utils_valid_device(const char *name, int force) +{ + unsigned long mnt_flags = 0; + struct stat st; + + if (!name) { + errno = EINVAL; + return 0; + } + + if (stat(name, &st) == -1) { + if (errno == ENOENT) + ntfs_log_error("The device %s doesn't exist\n", name); + else + ntfs_log_perror("Error getting information about %s", + name); + return 0; + } + + /* Make sure the file system is not mounted. */ + if (ntfs_check_if_mounted(name, &mnt_flags)) { + ntfs_log_perror("Failed to determine whether %s is mounted", + name); + if (!force) { + ntfs_log_error("Use the force option to ignore this " + "error.\n"); + return 0; + } + ntfs_log_warning("Forced to continue.\n"); + } else if (mnt_flags & NTFS_MF_MOUNTED) { + if (!force) { + ntfs_log_error("Volume already mounted or in use otherwise.\n"); + ntfs_log_error("You can use force option to avoid this " + "check, but this is not recommended\n" + "and may lead to data corruption.\n"); + return 0; + } + ntfs_log_warning("Forced to continue.\n"); + } + + return 1; +} + +/** + * utils_mount_volume - Mount an NTFS volume + * Based on ntfsprogs/utils.* + */ +static ntfs_volume * utils_mount_volume(const char *device, unsigned long flags) +{ + ntfs_volume *vol; + + if (!device) { + errno = EINVAL; + return NULL; + } + + if (!utils_valid_device(device, flags & NTFS_MNT_RECOVER)) + return NULL; + + vol = ntfs_mount(device, flags); + if (!vol) { + ntfs_log_perror("Failed to mount '%s'", device); + if (errno == EINVAL) + ntfs_log_error("%s: Not an NTFS device.\n", device); + else if (errno == EIO) + ntfs_log_error("Corrupted volume. Run chkdsk /f.\n"); + else if (errno == EPERM) + ntfs_log_error("This volume is hibernated. Please shut down Windows properly.\n"); + else if (errno == EOPNOTSUPP) + ntfs_log_error("NTFS journal is unclean.\n"); + else if (errno == EBUSY) + ntfs_log_error("%s", "Busy: Volume already in use.\n"); + else if (errno == ENXIO) + ntfs_log_error("SoftRAID/FakeRAID is not supported.\n"); + return NULL; + } + + if (vol->flags & VOLUME_IS_DIRTY) { + if (!(flags & NTFS_MNT_RECOVER)) { + ntfs_log_error("Volume is marked dirty, plase boot windows first.\n"); + ntfs_umount(vol, FALSE); + return NULL; + } + ntfs_log_error("WARNING: Dirty volume mount was forced by the " + "'force' mount option.\n"); + } + return vol; +} + +ATTR_RECORD * find_attribute(const ATTR_TYPES type, ntfs_attr_search_ctx *ctx) +{ + if (!ctx) { + errno = EINVAL; + return NULL; + } + + if (ntfs_attr_lookup(type, NULL, 0, 0, 0, NULL, 0, ctx) != 0) { + ntfs_log_debug("find_attribute didn't find an attribute of type: 0x%02x.\n", le32_to_cpu(type)); + return NULL; /* None / no more of that type */ + } + + ntfs_log_debug("find_attribute found an attribute of type: 0x%02x.\n", le32_to_cpu(type)); + return ctx->attr; +} + +// Taken from ntfsprogs/utils.c +static int utils_cluster_in_use(ntfs_volume *vol, long long lcn) +{ + static unsigned char buffer[512]; + static long long bmplcn = -(sizeof(buffer) << 3); + int byte, bit; + ntfs_attr *attr; + + if (!vol) { + errno = EINVAL; + return -1; + } + + /* Does lcn lie in the section of $Bitmap we already have cached? */ + if ((lcn < bmplcn) + || (lcn >= (long long)(bmplcn + (sizeof(buffer) << 3)))) { + ntfs_log_debug("Bit lies outside cache.\n"); + attr = ntfs_attr_open(vol->lcnbmp_ni, AT_DATA, AT_UNNAMED, 0); + if (!attr) { + ntfs_log_perror("Couldn't open $Bitmap"); + return -1; + } + + /* Mark the buffer as in use, in case the read is shorter. */ + memset(buffer, 0xFF, sizeof(buffer)); + bmplcn = lcn & (~((sizeof(buffer) << 3) - 1)); + + if (ntfs_attr_pread(attr, (bmplcn >> 3), sizeof(buffer), + buffer) < 0) { + ntfs_log_perror("Couldn't read $Bitmap"); + ntfs_attr_close(attr); + return -1; + } + + ntfs_log_debug("Reloaded bitmap buffer.\n"); + ntfs_attr_close(attr); + } + + bit = 1 << (lcn & 7); + byte = (lcn >> 3) & (sizeof(buffer) - 1); + ntfs_log_debug("cluster = %lld, bmplcn = %lld, byte = %d, bit = %d, " + "in use %d\n", lcn, bmplcn, byte, bit, buffer[byte] & + bit); + + return (buffer[byte] & bit); +} + +static int scan_free_space(ntfs_volume *vol) +{ + s64 i, j; + s64 curStart = -1; + s64 start = 0; + s64 end = 0; + int pf; + const char *message = NULL; + const char *summary = NULL; + + if (!vol) + return -1; + + if (options.brief) { + if (options.human) { + summary = "Biggest range from %lld to %lld, %lldMiB\n"; + } else { + summary = "Biggest %lld %lld %lld\n"; + } + } else { + if (options.human) { + message = "Range from %lld to %lld, %lldMiB\n"; + } else { + message = "Range %lld %lld %lld\n"; + } + } + + for (i = 0; i <= vol->nr_clusters; i++) { + pf = 0; + for (j = 0; j < pfcount; ++j) { + if (i >= pagefile[j].from && i <= pagefile[j].to) { + pf = 1; + break; + } + } + if (i == vol->nr_clusters || (!pf && utils_cluster_in_use(vol, i))) { + if (curStart != -1) { + if (i - curStart > options.min_size) { + if (message != NULL) { + ntfs_log_info(message, (long long)curStart, (long long)i, (long long)((i - curStart) / (1024ll * 1024ll / vol->cluster_size))); + } + if (i - curStart > end - start) { + start = curStart; + end = i; + } + } + } + curStart = -1; + } else if (curStart == -1) { + curStart = i; + } + } + + if (summary != NULL) { + ntfs_log_info("Biggest range from %lld to %lld, %lldMiB\n", (long long)start, (long long)end, (long long)((end - start) / (1024ll * 1024ll / vol->cluster_size))); + } + return 1; +} + +static int get_pagefile_clusters(ntfs_volume *vol) +{ + ntfs_inode *ni = NULL; + ntfs_attr *na = NULL; + ntfs_attr_search_ctx *ctx; + int returnCode = 0; + ATTR_RECORD *rec; + int i, clusters; + runlist *runs; + + ni = ntfs_pathname_to_inode(vol, NULL, "pagefile.sys"); + if (!ni) { + ntfs_log_debug("Failed to open inode of pagefile.sys.\n"); + return 0; + } + + if ((na = ntfs_attr_open(ni, AT_DATA, AT_UNNAMED, 0)) == NULL) { + ntfs_log_debug("Failed to open pagefile.sys/$DATA.\n"); + goto error_exit; + } + + /* The $DATA attribute of the pagefile.sys has to be non-resident. */ + if (!NAttrNonResident(na)) { + ntfs_log_debug("pagefile.sys $DATA attribute is resident!?!\n"); + goto error_exit; + } + + /* Get length of pagefile.sys contents. */ + clusters = (na->data_size + (vol->cluster_size - 1)) / vol->cluster_size; + if (clusters == 0) { + ntfs_log_debug("pagefile.sys has zero length.\n"); + goto real_exit; + } + + if ((na->data_flags & ATTR_COMPRESSION_MASK) != const_cpu_to_le16(0)) { + ntfs_log_debug("pagefile.sys is compressed!?\n"); + goto real_exit; + } + ntfs_attr_close(na); + na = NULL; + + // Get complete runlist + ctx = ntfs_attr_get_search_ctx(ni, NULL); + + while (pfcount < PFMAX && (rec = find_attribute(AT_DATA, ctx))) { + if (rec->non_resident) { + runs = ntfs_mapping_pairs_decompress(vol, rec, NULL); + if (runs) { + for (i = 0; runs[i].length > 0; i++) { + pagefile[pfcount].from = runs[i].lcn; + pagefile[pfcount].to = runs[i].lcn + (runs[i].length - 1); + pfcount++; + } + free(runs); + } + } + } + ntfs_attr_put_search_ctx(ctx); + + // All done + goto real_exit; +error_exit: + returnCode = -1; +real_exit: + if (na != NULL) { + ntfs_attr_close(na); + } + if (ni != NULL) { + ntfs_inode_close(ni); + } + return returnCode; + +} + |