diff --git a/FileSystemIDandChk/FileSystemIDandChk.csproj b/FileSystemIDandChk/FileSystemIDandChk.csproj index c72f91b6..04b74f9a 100644 --- a/FileSystemIDandChk/FileSystemIDandChk.csproj +++ b/FileSystemIDandChk/FileSystemIDandChk.csproj @@ -56,6 +56,7 @@ + diff --git a/FileSystemIDandChk/Plugins/ODS.cs b/FileSystemIDandChk/Plugins/ODS.cs new file mode 100644 index 00000000..f00a24b8 --- /dev/null +++ b/FileSystemIDandChk/Plugins/ODS.cs @@ -0,0 +1,294 @@ +using System; +using System.IO; +using System.Text; +using FileSystemIDandChk; + +// Information from VMS File System Internals by Kirby McCoy +// ISBN: 1-55558-056-4 +// With some hints from http://www.decuslib.com/DECUS/vmslt97b/gnusoftware/gccaxp/7_1/vms/hm2def.h + +// Expects the home block to be always in sector #1 (does not check deltas) +// Assumes a sector size of 512 bytes (VMS does on HDDs and optical drives, dunno about M.O.) +// Book only describes ODS-2. Need to test ODS-1 and OSD-5 +// There is an ODS with signature "DECFILES11A", yet to be seen + +// Time is a 64 bit unsigned integer, tenths of microseconds since 1858/11/17 00:00:00. + +namespace FileSystemIDandChk.Plugins +{ + class ODS : Plugin + { + public ODS(PluginBase Core) + { + base.Name = "Files-11 On-Disk Structure"; + base.PluginUUID = new Guid("de20633c-8021-4384-aeb0-83b0df14491f"); + } + + public override bool Identify(FileStream stream, long offset) + { + byte[] magic_b = new byte[12]; + string magic; + + BinaryReader br = new BinaryReader(stream); + + br.BaseStream.Seek(0x200 + offset, SeekOrigin.Begin); // Seek to home block + br.BaseStream.Seek(0x1F0, SeekOrigin.Current); // Seek to format + + br.BaseStream.Read(magic_b, 0, 12); + magic = Encoding.ASCII.GetString(magic_b); + + if(magic == "DECFILE11A " || magic == "DECFILE11B ") + return true; + else + return false; + } + + public override void GetInformation (FileStream stream, long offset, out string information) + { + information = ""; + + StringBuilder sb = new StringBuilder(); + BinaryReader br = new BinaryReader(stream); + ODSHomeBlock homeblock = new ODSHomeBlock(); + byte[] temp_string = new byte[12]; + homeblock.min_class = new byte[20]; + homeblock.max_class = new byte[20]; + homeblock.reserved1 = new byte[302]; + + br.BaseStream.Seek(0x200 + offset, SeekOrigin.Begin); + + homeblock.homelbn = br.ReadUInt32(); + homeblock.alhomelbn = br.ReadUInt32(); + homeblock.altidxlbn = br.ReadUInt32(); + homeblock.struclev = br.ReadUInt16(); + homeblock.cluster = br.ReadUInt16(); + homeblock.homevbn = br.ReadUInt16(); + homeblock.alhomevbn = br.ReadUInt16(); + homeblock.altidxvbn = br.ReadUInt16(); + homeblock.ibmapvbn = br.ReadUInt16(); + homeblock.ibmaplbn = br.ReadUInt32(); + homeblock.maxfiles = br.ReadUInt32(); + homeblock.ibmapsize = br.ReadUInt16(); + homeblock.resfiles = br.ReadUInt16(); + homeblock.devtype = br.ReadUInt16(); + homeblock.rvn = br.ReadUInt16(); + homeblock.setcount = br.ReadUInt16(); + homeblock.volchar = br.ReadUInt16(); + homeblock.volowner = br.ReadUInt32(); + homeblock.sec_mask = br.ReadUInt32(); + homeblock.protect = br.ReadUInt16(); + homeblock.fileprot = br.ReadUInt16(); + homeblock.recprot = br.ReadUInt16(); + homeblock.checksum1 = br.ReadUInt16(); + homeblock.credate = br.ReadUInt64(); + homeblock.window = br.ReadByte(); + homeblock.lru_lim = br.ReadByte(); + homeblock.extend = br.ReadUInt16(); + homeblock.retainmin = br.ReadUInt64(); + homeblock.retainmax = br.ReadUInt64(); + homeblock.revdate = br.ReadUInt64(); + homeblock.min_class = br.ReadBytes(20); + homeblock.max_class = br.ReadBytes(20); + homeblock.filetab_fid1 = br.ReadUInt16(); + homeblock.filetab_fid2 = br.ReadUInt16(); + homeblock.filetab_fid3 = br.ReadUInt16(); + homeblock.lowstruclev = br.ReadUInt16(); + homeblock.highstruclev = br.ReadUInt16(); + homeblock.copydate = br.ReadUInt64(); + homeblock.reserved1 = br.ReadBytes(302); + homeblock.serialnum = br.ReadUInt32(); + temp_string = br.ReadBytes(12); + homeblock.strucname = Encoding.ASCII.GetString(temp_string); + temp_string = br.ReadBytes(12); + homeblock.volname = Encoding.ASCII.GetString(temp_string); + temp_string = br.ReadBytes(12); + homeblock.ownername = Encoding.ASCII.GetString(temp_string); + temp_string = br.ReadBytes(12); + homeblock.format = Encoding.ASCII.GetString(temp_string); + homeblock.reserved2 = br.ReadUInt16(); + homeblock.checksum2 = br.ReadUInt16(); + + if((homeblock.struclev & 0xFF00) != 0x0200 || (homeblock.struclev & 0xFF) != 1 || homeblock.format != "DECFILE11B ") + sb.AppendLine("The following information may be incorrect for this volume."); + if(homeblock.resfiles < 5 || homeblock.devtype != 0) + sb.AppendLine("This volume may be corrupted."); + + sb.AppendFormat("Volume format is {0}", homeblock.format).AppendLine(); + sb.AppendFormat("Volume is Level {0} revision {1}", (homeblock.struclev&0xFF00)>>8, homeblock.struclev&0xFF).AppendLine(); + sb.AppendFormat("Lowest structure in the volume is Level {0}, revision {1}", (homeblock.lowstruclev&0xFF00)>>8, homeblock.lowstruclev&0xFF).AppendLine(); + sb.AppendFormat("Highest structure in the volume is Level {0}, revision {1}", (homeblock.highstruclev&0xFF00)>>8, homeblock.highstruclev&0xFF).AppendLine(); + sb.AppendFormat("{0} sectors per cluster ({1} bytes)", homeblock.cluster, homeblock.cluster*512).AppendLine(); + sb.AppendFormat("This home block is on sector {0} (cluster {1})", homeblock.homelbn, homeblock.homevbn).AppendLine(); + sb.AppendFormat("Secondary home block is on sector {0} (cluster {1})", homeblock.alhomelbn, homeblock.alhomevbn).AppendLine(); + sb.AppendFormat("Volume bitmap starts in sector {0} (cluster {1})", homeblock.ibmaplbn, homeblock.ibmapvbn).AppendLine(); + sb.AppendFormat("Volume bitmap runs for {0} sectors ({1} bytes)", homeblock.ibmapsize, homeblock.ibmapsize*512).AppendLine(); + sb.AppendFormat("Backup INDEXF.SYS;1 is in sector {0} (cluster {1})", homeblock.altidxlbn, homeblock.altidxvbn).AppendLine(); + sb.AppendFormat("{0} maximum files on the volume", homeblock.maxfiles).AppendLine(); + sb.AppendFormat("{0} reserved files", homeblock.resfiles).AppendLine(); + if(homeblock.rvn > 0 && homeblock.setcount > 0 && homeblock.strucname != " ") + sb.AppendFormat("Volume is {0} of {1} in set \"{2}\".", homeblock.rvn, homeblock.setcount, homeblock.strucname).AppendLine(); + sb.AppendFormat("Volume owner is \"{0}\" (ID 0x{1:X8})", homeblock.ownername, homeblock.volowner).AppendLine(); + sb.AppendFormat("Volume label: \"{0}\"", homeblock.volname).AppendLine(); + sb.AppendFormat("Drive serial number: 0x{0:X8}", homeblock.serialnum).AppendLine(); + sb.AppendFormat("Volume was created on {0}", VMSDateToDateTime(homeblock.credate).ToString()).AppendLine(); + if(homeblock.revdate > 0) + sb.AppendFormat("Volume was last modified on {0}", VMSDateToDateTime(homeblock.revdate).ToString()).AppendLine(); + if(homeblock.copydate > 0) + sb.AppendFormat("Volume copied on {0}", VMSDateToDateTime(homeblock.copydate).ToString()).AppendLine(); + sb.AppendFormat("Checksums: 0x{0:X4} and 0x{1:X4}", homeblock.checksum1, homeblock.checksum2).AppendLine(); + sb.AppendLine("Flags:"); + sb.AppendFormat("Window: {0}", homeblock.window).AppendLine(); + sb.AppendFormat("Cached directores: {0}", homeblock.lru_lim).AppendLine(); + sb.AppendFormat("Default allocation: {0} blocks", homeblock.extend).AppendLine(); + if((homeblock.volchar & 0x01) == 0x01) + sb.AppendLine("Readings should be verified"); + if((homeblock.volchar & 0x02) == 0x02) + sb.AppendLine("Writings should be verified"); + if((homeblock.volchar & 0x04) == 0x04) + sb.AppendLine("Files should be erased or overwritten when deleted"); + if((homeblock.volchar & 0x08) == 0x08) + sb.AppendLine("Highwater mark is to be disabled"); + if((homeblock.volchar & 0x10) == 0x10) + sb.AppendLine("Classification checks are enabled"); + sb.AppendLine("Volume permissions (r = read, w = write, c = create, d = delete)"); + sb.AppendLine("System, owner, group, world"); + // System + if((homeblock.protect & 0x1000) == 0x1000) + sb.Append("-"); + else + sb.Append("r"); + if((homeblock.protect & 0x2000) == 0x2000) + sb.Append("-"); + else + sb.Append("w"); + if((homeblock.protect & 0x4000) == 0x4000) + sb.Append("-"); + else + sb.Append("c"); + if((homeblock.protect & 0x8000) == 0x8000) + sb.Append("-"); + else + sb.Append("d"); + // Owner + if((homeblock.protect & 0x100) == 0x100) + sb.Append("-"); + else + sb.Append("r"); + if((homeblock.protect & 0x200) == 0x200) + sb.Append("-"); + else + sb.Append("w"); + if((homeblock.protect & 0x400) == 0x400) + sb.Append("-"); + else + sb.Append("c"); + if((homeblock.protect & 0x800) == 0x800) + sb.Append("-"); + else + sb.Append("d"); + // Group + if((homeblock.protect & 0x10) == 0x10) + sb.Append("-"); + else + sb.Append("r"); + if((homeblock.protect & 0x20) == 0x20) + sb.Append("-"); + else + sb.Append("w"); + if((homeblock.protect & 0x40) == 0x40) + sb.Append("-"); + else + sb.Append("c"); + if((homeblock.protect & 0x80) == 0x80) + sb.Append("-"); + else + sb.Append("d"); + // World (other) + if((homeblock.protect & 0x1) == 0x1) + sb.Append("-"); + else + sb.Append("r"); + if((homeblock.protect & 0x2) == 0x2) + sb.Append("-"); + else + sb.Append("w"); + if((homeblock.protect & 0x4) == 0x4) + sb.Append("-"); + else + sb.Append("c"); + if((homeblock.protect & 0x8) == 0x8) + sb.Append("-"); + else + sb.Append("d"); + + sb.AppendLine(); + + sb.AppendLine("Unknown structures:"); + sb.AppendFormat("Security mask: 0x{0:X8}", homeblock.sec_mask).AppendLine(); + sb.AppendFormat("File protection: 0x{0:X4}", homeblock.fileprot).AppendLine(); + sb.AppendFormat("Record protection: 0x{0:X4}", homeblock.recprot).AppendLine(); + + information = sb.ToString(); + } + + private struct ODSHomeBlock + { + public UInt32 homelbn; // LBN of THIS home block + public UInt32 alhomelbn; // LBN of the secondary home block + public UInt32 altidxlbn; // LBN of backup INDEXF.SYS;1 + public UInt16 struclev; // High byte contains filesystem version (1, 2 or 5), low byte contains revision (1) + public UInt16 cluster; // Number of blocks each bit of the volume bitmap represents + public UInt16 homevbn; // VBN of THIS home block + public UInt16 alhomevbn; // VBN of the secondary home block + public UInt16 altidxvbn; // VBN of backup INDEXF.SYS;1 + public UInt16 ibmapvbn; // VBN of the bitmap + public UInt32 ibmaplbn; // LBN of the bitmap + public UInt32 maxfiles; // Max files on volume + public UInt16 ibmapsize; // Bitmap size in sectors + public UInt16 resfiles; // Reserved files, 5 at minimum + public UInt16 devtype; // Device type, ODS-2 defines it as always 0 + public UInt16 rvn; // Relative volume number (number of the volume in a set) + public UInt16 setcount; // Total number of volumes in the set this volume is + public UInt16 volchar; // Flags + public UInt32 volowner; // User ID of the volume owner + public UInt32 sec_mask; // Security mask (??) + public UInt16 protect; // Volume permissions (system, owner, group and other) + public UInt16 fileprot; // Default file protection, unsupported in ODS-2 + public UInt16 recprot; // Default file record protection + public UInt16 checksum1; // Checksum of all preceding entries + public UInt64 credate; // Creation date + public byte window; // Window size (pointers for the window) + public byte lru_lim; // Directories to be stored in cache + public UInt16 extend; // Default allocation size in blocks + public UInt64 retainmin; // Minimum file retention period + public UInt64 retainmax; // Maximum file retention period + public UInt64 revdate; // Last modification date + public byte[] min_class; // Minimum security class, 20 bytes + public byte[] max_class; // Maximum security class, 20 bytes + public UInt16 filetab_fid1; // File lookup table FID + public UInt16 filetab_fid2; // File lookup table FID + public UInt16 filetab_fid3; // File lookup table FID + public UInt16 lowstruclev; // Lowest structure level on the volume + public UInt16 highstruclev; // Highest structure level on the volume + public UInt64 copydate; // Volume copy date (??) + public byte[] reserved1; // 302 bytes + public UInt32 serialnum; // Physical drive serial number + public string strucname; // Name of the volume set, 12 bytes + public string volname; // Volume label, 12 bytes + public string ownername; // Name of the volume owner, 12 bytes + public string format; // ODS-2 defines it as "DECFILE11B", 12 bytes + public UInt16 reserved2; // Reserved + public UInt16 checksum2; // Checksum of preceding 255 words (16 bit units) + } + + // C# works in UTC, VMS on Julian Date, some displacement may occur on disks created outside UTC + private DateTime VMSDateToDateTime(UInt64 vmsDate) + { + DateTime date = new DateTime(1858, 11, 17, 0, 0, 0); // Epoch, day 0 of Julian Date system + double delta = vmsDate * 0.0001; // Tenths of microseconds to milliseconds, will lose some detail + date = date.AddMilliseconds(delta); + return date; + } + } +} +