From 59c90f039db71241e2019e68b6e541c8c4c05752 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= Date: Thu, 12 Nov 2015 15:31:24 +0100 Subject: [PATCH] Defined the last logfile block as preceding block 4 in ntfsrecover When block 2 or block 3 points backward to block 4, it is not clear whether the log file only consists of block 2 or block 3 or the log file has just wrapped around. The latter is now assumed. --- ntfsprogs/ntfsrecover.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ntfsprogs/ntfsrecover.c b/ntfsprogs/ntfsrecover.c index ae92c896..97a87e8d 100644 --- a/ntfsprogs/ntfsrecover.c +++ b/ntfsprogs/ntfsrecover.c @@ -1102,6 +1102,14 @@ static const struct BUFFER *findprevious(CONTEXT *ctx, const struct BUFFER *buf) rph = &buf->block.record; prevblk = (le32_to_cpu(rph->copy.file_offset) >> blockbits) - 1; + /* + * If an initial block leads to block 4, it + * can mean the last block or no previous + * block at all. Using the last block is safer, + * its lsn will indicate whether it is stale. + */ + if (prevblk < BASEBLKS) + prevblk = (logfilesz >> blockbits) - 1; } /* No previous block if the log only consists of block 2 or 3 */ if (prevblk < BASEBLKS) {