Page 1 of 1

Having ntfs library

Posted: 29 Sep 2019, 19:52
by mesajflaviu
Hi. I have read inside config.h.in file a row:

Code: Select all

/* Define to 1 if you have the ntfs library (-lntfs). */
#undef HAVE_LIBNTFS
and inside source code, in ntfs_udl.cpp file an ifdefine:

Code: Select all

#ifdef HAVE_LIBNTFS
#include <ntfs/bootsect.h>
#include <ntfs/mft.h>
#include <ntfs/attrib.h>
#include <ntfs/layout.h>
#include <ntfs/inode.h>
#include <ntfs/device.h>
#include <ntfs/debug.h>
#include <ntfs/ntfstime.h>
#ifdef HAVE_NTFS_VERSION_H
#include <ntfs/version.h>
#endif
#endif
and I haven't found any ntfs folder inside source code ...my question is, what ntfs library or folder should I have in order to have that ntfs library available ? Thank you.

Re: Having ntfs library

Posted: 30 Sep 2019, 14:32
by mesajflaviu
After un-numbered searches on google, I fall into question: what "ntfs library" should be included into testdisk app ? I have found a few, but none of them seem to have all files from this list:

Code: Select all

#ifdef HAVE_LIBNTFS
#include <ntfs/bootsect.h>
#include <ntfs/mft.h>
#include <ntfs/attrib.h>
#include <ntfs/layout.h>
#include <ntfs/inode.h>
#include <ntfs/device.h>
#include <ntfs/debug.h>
#include <ntfs/ntfstime.h>
#ifdef HAVE_NTFS_VERSION_H
#include <ntfs/version.h>
#endif
#endif
Sorry for keep asking question here, the source code is huge and I met a lot of new things here ... Could you help me ?

Re: Having ntfs library

Posted: 30 Sep 2019, 16:05
by recuperation
After reading about the #IFDEF directive in the internet I recommend you checking if HAVE_LIBNTFS is defined at all.
Maybe it is simply not needed to compile the most recent version.

I would try to compile the EXE-file to see I am able to replicate the original EXE file.

As you are still hiding the location of of your source code I think about hiding my voice.

Re: Having ntfs library

Posted: 30 Sep 2019, 19:38
by mesajflaviu
Kindly thank you @recuperation for your interest ! I am glad to talk with you.

I have checked, HAVE_LIBNTFS is not defined at all. But without this HAVE_LIBNTFS, the function ntfs_undelete_part from ntfs_udl.cpp is not called at all.

The same situation was with __CYGWIN__, without define this, I were not compiled a lot of functional code. That is why I had need to define __CYGWIN__ in order to have needed code. I guess it will be the same for HAVE_LIBNTFS ... but in this case, I need ntfs library. See a little code from testdisk-7.1 code, from github, file: ntfs_inc.h

Code: Select all

#if defined(HAVE_LIBNTFS) || defined(HAVE_LIBNTFS3G)
struct ntfs_dir_struct {
	file_info_t* dir_list;
	ntfs_volume* vol;
	my_data_t *my_data;
	dir_data_t* dir_data;
	unsigned long int inode;
#ifdef HAVE_ICONV
	iconv_t cd;
#endif
};
#endif
from this code I understand that without HAVE_LIBNTFS defined I would not have ntfs_dir_struct, and so ntfs_volume*, and so on ...

But these defined values are somehow defined in config.h.in file (from testdisk-7.1 project, taken from github.)

Code: Select all

/* Define to 1 if you have the ntfs library (-lntfs). */
#undef HAVE_LIBNTFS
And please do not hide your voice, I am not hide anything ! I have downloaded source code from github, testdisk-7.1, and inside src folder, I have found all source code from where I am trying to figure out how to read deleted files from HDD as source code mechanism. I also read documentation from https://www.ntfs.com/index.html, but there is no source code ... What else should I show or reveal ? I am not hiding anything ! Please tell me what I should show.

Re: Having ntfs library

Posted: 01 Oct 2019, 08:36
by mesajflaviu
I have not used cygwin by now, as far I read (I might be wrong), cygwin doesn't has a GUI with I could made debugging. So, I made debugging statically :), with my eyes :D that is why I put here questions ...

Re: Having ntfs library

Posted: 01 Oct 2019, 09:49
by recuperation
mesajflaviu wrote: 30 Sep 2019, 19:38 I have downloaded source code from github, testdisk-7.1, and inside src folder, I have found all source code from where I am trying to figure out how to read deleted files from HDD as source code mechanism. I also read documentation from https://www.ntfs.com/index.html, but there is no source code ... What else should I show or reveal ? I am not hiding anything ! Please tell me what I should show.
Perfect. Now others and I what you are exactly referring to. There is nothing now that is left to disclose.
Initially you spoke about EXFAT, but now you are mentioning NTFS.com?
Microsoft did not publicly disclose the source code for NTFS. Linux people have reverse engineered parts of NTFS. You can find this code with them.

Re: Having ntfs library

Posted: 01 Oct 2019, 10:39
by mesajflaviu
After I studied about exFAT, now I have read about NTFS, and I have found some functions from source code, for instance, ntfs_undelete_part function, from ntfs_udl.c file, or or dir_partition_ntfs_init function, from ntfs_dir.c. These functions uses some struct data:

Code: Select all

dir_partition_t dir_partition_ntfs_init(disk_t *disk_car, const partition_t *partition, dir_data_t *dir_data, const int verbose, const int expert)
{
#if defined(HAVE_LIBNTFS) || defined(HAVE_LIBNTFS3G)
	struct ntfs_device *dev;
	my_data_t *my_data = NULL;
	ntfs_volume *vol = NULL;
	....
which are part of NTFS library, but this library I didn't identified (yet) on internet ...

Re: Having ntfs library

Posted: 01 Oct 2019, 10:50
by mesajflaviu
I have read inside https://www.cgsecurity.org/testdisk.pdf:

Code: Select all

NTFS library - Optional, used by TestDisk to list files from NTFS partition
where can I find this NTFS library ? And can I use it for windows OS ?

Re: Having ntfs library

Posted: 01 Oct 2019, 11:44
by recuperation
I don't know.

Re: Having ntfs library

Posted: 01 Oct 2019, 12:24
by mesajflaviu
Thank you @recuperation.