[ros-diffs] [weiden] 18384: add a not yet complete tool to dump the
recycle bin databases
weiden at svn.reactos.com
weiden at svn.reactos.com
Sun Oct 9 22:56:28 CEST 2005
add a not yet complete tool to dump the recycle bin databases
Added: trunk/reactos/apps/utils/dumprecbin/
Added: trunk/reactos/apps/utils/dumprecbin/dumprecbin.c
Added: trunk/reactos/apps/utils/dumprecbin/dumprecbin.xml
Property changes on: trunk/reactos/apps/utils/dumprecbin
___________________________________________________________________
Name: svn:ignore
+ *.o
*.a
*.d
*.exe
*.coff
*.sym
*.map
GNUmakefile
_____
Added: trunk/reactos/apps/utils/dumprecbin/dumprecbin.c
--- trunk/reactos/apps/utils/dumprecbin/dumprecbin.c 2005-10-09
20:24:00 UTC (rev 18383)
+++ trunk/reactos/apps/utils/dumprecbin/dumprecbin.c 2005-10-09
20:56:17 UTC (rev 18384)
@@ -0,0 +1,733 @@
+/*
+ *
+ * dumprecbin - dumps a recycle bin database
+ *
+ * Copyright (c) 2005 by Thomas Weidenmueller <w3seek at reactos.com>
+ *
+ * This program is free software; you can redistribute it and/or
modify
+ * it under the terms of the GNU General Public License as published
by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * TODO: - Support for Vista recycle bins (read the DeleteInfo NTFS
streams, also NT 5.x)
+ * - Support for INFO databases (win95)
+ */
+#include <windows.h>
+#include <winternl.h>
+#include <sddl.h>
+#include <ntsecapi.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <tchar.h>
+
+#ifndef NT_SUCCESS
+#define NT_SUCCESS(status) ((LONG)(status) >= 0)
+#endif
+
+typedef struct _RECYCLE_BIN
+{
+ struct _RECYCLE_BIN *Next;
+ PSID Sid;
+ WCHAR User[255];
+ WCHAR Path[MAX_PATH + 1];
+} RECYCLE_BIN, *PRECYCLE_BIN;
+
+typedef enum
+{
+ ivUnknown = 0,
+ ivINFO2
+} INFO_VERSION, *PINFO_VERSION;
+
+typedef struct _INFO2_HEADER
+{
+ DWORD Version;
+ DWORD Zero1;
+ DWORD Zero2;
+ DWORD RecordSize;
+} INFO2_HEADER, *PINFO2_HEADER;
+
+typedef struct _INFO2_RECORD
+{
+ DWORD Unknown;
+ CHAR AnsiFileName[MAX_PATH];
+ DWORD RecordNumber;
+ DWORD DriveLetter;
+ FILETIME DeletionTime;
+ DWORD DeletedPhysicalSize;
+ WCHAR FileName[MAX_PATH - 2];
+} INFO2_RECORD, *PINFO2_RECORD;
+
+static HANDLE
+OpenAndMapInfoDatabase(IN LPTSTR szFileName,
+ OUT PVOID *MappingBasePtr,
+ OUT PLARGE_INTEGER FileSize)
+{
+ HANDLE hFile, hMapping = INVALID_HANDLE_VALUE;
+
+ hFile = CreateFile(szFileName,
+ FILE_READ_DATA,
+ FILE_SHARE_READ,
+ NULL,
+ OPEN_EXISTING,
+ FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM,
+ NULL);
+ if (hFile != INVALID_HANDLE_VALUE)
+ {
+ if (GetFileSizeEx(hFile,
+ FileSize) &&
+ FileSize->QuadPart >= 0xF)
+ {
+ hMapping = CreateFileMapping(hFile,
+ NULL,
+ PAGE_READONLY,
+ 0,
+ 0,
+ NULL);
+ if (hMapping == NULL ||
+ !(*MappingBasePtr = MapViewOfFile(hMapping,
+ FILE_MAP_READ,
+ 0,
+ 0,
+ 0)))
+ {
+ if (hMapping != NULL)
+ {
+ CloseHandle(hMapping);
+ }
+ hMapping = INVALID_HANDLE_VALUE;
+ }
+ }
+ CloseHandle(hFile);
+ }
+
+ return hMapping;
+}
+
+static VOID
+UnmapAndCloseDatabase(IN HANDLE hMapping,
+ IN PVOID MappingBasePtr)
+{
+ UnmapViewOfFile(MappingBasePtr);
+ CloseHandle(hMapping);
+}
+
+static INFO_VERSION
+DetectDatabaseVersion(PVOID Header)
+{
+ PINFO2_HEADER Info2 = (PINFO2_HEADER)Header;
+ INFO_VERSION Version = ivUnknown;
+
+ if (Info2->Version == 5 &&
+ Info2->Zero1 == 0 &&
+ Info2->Zero2 == 0 &&
+ Info2->RecordSize == 0x320)
+ {
+ Version = ivINFO2;
+ }
+
+ return Version;
+}
+
+static BOOL
+IsValidRecycleBin(IN LPTSTR szPath)
+{
+ TCHAR szFile[MAX_PATH + 1];
+ TCHAR szClsId[48];
+ INFO_VERSION DbVersion = ivUnknown;
+
+ _stprintf(szFile,
+ _T("%s\\desktop.ini"),
+ szPath);
+
+ /* check if directory contains a valid desktop.ini for the recycle
bin */
+ if (GetPrivateProfileString(TEXT(".ShellClassInfo"),
+ TEXT("CLSID"),
+ NULL,
+ szClsId,
+ sizeof(szClsId) / sizeof(szClsId[0]),
+ szFile) &&
+ !_tcsicmp(_T("{645FF040-5081-101B-9F08-00AA002F954E}"),
+ szClsId))
+ {
+ HANDLE hDb;
+ LARGE_INTEGER FileSize;
+ PVOID pDbBase = NULL;
+
+ /* open the database and check the signature */
+ _stprintf(szFile,
+ _T("%s\\INFO2"),
+ szPath);
+ hDb = OpenAndMapInfoDatabase(szFile,
+ &pDbBase,
+ &FileSize);
+ if (hDb != INVALID_HANDLE_VALUE)
+ {
+ DbVersion = DetectDatabaseVersion(pDbBase);
+ UnmapAndCloseDatabase(hDb,
+ pDbBase);
+ }
+ }
+
+ return DbVersion != ivUnknown;
+}
+
+static BOOL
+OpenLocalLSAPolicyHandle(IN ACCESS_MASK DesiredAccess,
+ OUT PLSA_HANDLE PolicyHandle)
+{
+ LSA_OBJECT_ATTRIBUTES LsaObjectAttributes = {0};
+ NTSTATUS Status;
+
+ Status = LsaOpenPolicy(NULL,
+ &LsaObjectAttributes,
+ DesiredAccess,
+ PolicyHandle);
+ if (!NT_SUCCESS(Status))
+ {
+ SetLastError(LsaNtStatusToWinError(Status));
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+static BOOL
+ConvertSIDToAccountName(IN PSID Sid,
+ OUT LPWSTR User)
+{
+ DWORD AccountNameLen = 0;
+ DWORD DomainNameLen = 0;
+ SID_NAME_USE NameUse;
+ DWORD Error = ERROR_SUCCESS;
+ LPWSTR AccountName, DomainName;
+ BOOL Ret = FALSE;
+
+ if (!LookupAccountSidW(NULL,
+ Sid,
+ NULL,
+ &AccountNameLen,
+ NULL,
+ &DomainNameLen,
+ &NameUse))
+ {
+ Error = GetLastError();
+ if (Error == ERROR_NONE_MAPPED ||
+ Error != ERROR_INSUFFICIENT_BUFFER)
+ {
+ /* some unexpected error occured! */
+ goto ConvertSID;
+ }
+ }
+
+ AccountName = (LPWSTR)HeapAlloc(GetProcessHeap(),
+ 0,
+ (AccountNameLen + DomainNameLen) *
sizeof(WCHAR));
+ if (AccountName != NULL)
+ {
+ LSA_HANDLE PolicyHandle;
+ DomainName = AccountName + AccountNameLen;
+
+ if (!LookupAccountSidW(NULL,
+ Sid,
+ AccountName,
+ &AccountNameLen,
+ DomainName,
+ &DomainNameLen,
+ &NameUse))
+ {
+ goto BailFreeAccountName;
+ }
+
+ wcscpy(User,
+ AccountName);
+ Ret = TRUE;
+
+ if (OpenLocalLSAPolicyHandle(POLICY_LOOKUP_NAMES |
POLICY_VIEW_LOCAL_INFORMATION,
+ &PolicyHandle))
+ {
+ PLSA_REFERENCED_DOMAIN_LIST ReferencedDomain;
+ PLSA_TRANSLATED_NAME Names;
+ PLSA_TRUST_INFORMATION Domain;
+ PLSA_UNICODE_STRING DomainName;
+ PPOLICY_ACCOUNT_DOMAIN_INFO PolicyAccountDomainInfo = NULL;
+ NTSTATUS Status;
+
+ Status = LsaLookupSids(PolicyHandle,
+ 1,
+ &Sid,
+ &ReferencedDomain,
+ &Names);
+ if (NT_SUCCESS(Status))
+ {
+ if (ReferencedDomain != NULL &&
+ Names->DomainIndex >= 0)
+ {
+ Domain =
&ReferencedDomain->Domains[Names->DomainIndex];
+ DomainName = &Domain->Name;
+ }
+ else
+ {
+ Domain = NULL;
+ DomainName = NULL;
+ }
+
+ switch (Names->Use)
+ {
+ case SidTypeAlias:
+ if (Domain != NULL)
+ {
+ /* query the domain name for BUILTIN
accounts */
+ Status =
LsaQueryInformationPolicy(PolicyHandle,
+
PolicyAccountDomainInformation,
+
(PVOID*)&PolicyAccountDomainInfo);
+ if (NT_SUCCESS(Status))
+ {
+ DomainName =
&PolicyAccountDomainInfo->DomainName;
+ }
+ }
+ /* fall through */
+
+ case SidTypeUser:
+ {
+ if (Domain != NULL)
+ {
+ WCHAR *s;
+
+ /* NOTE: LSA_UNICODE_STRINGs are not always
NULL-terminated! */
+
+ wcscpy(User,
+ AccountName);
+ wcscat(User,
+ L" (");
+ s = User + wcslen(User);
+ CopyMemory(s,
+ DomainName->Buffer,
+ DomainName->Length);
+ s += DomainName->Length / sizeof(WCHAR);
+ *(s++) = L'\\';
+ CopyMemory(s,
+ Names->Name.Buffer,
+ Names->Name.Length);
+ s += Names->Name.Length / sizeof(WCHAR);
+ *(s++) = L')';
+ *s = L'\0';
+ }
+ break;
+ }
+
+ case SidTypeWellKnownGroup:
+ {
+ break;
+ }
+
+ default:
+ {
+ _ftprintf(stderr,
+ _T("Unhandled SID type: 0x%x\n"),
+ Names->Use);
+ break;
+ }
+ }
+
+ if (PolicyAccountDomainInfo != NULL)
+ {
+ LsaFreeMemory(PolicyAccountDomainInfo);
+ }
+
+ LsaFreeMemory(ReferencedDomain);
+ LsaFreeMemory(Names);
+ }
+
+ LsaClose(PolicyHandle);
+
+ if (!NT_SUCCESS(Status))
+ {
+ Ret = FALSE;
+ goto BailFreeAccountName;
+ }
+ }
+ else
+ {
+BailFreeAccountName:
+ HeapFree(GetProcessHeap(),
+ 0,
+ AccountName);
+ goto ConvertSID;
+ }
+ }
+
+ConvertSID:
+ if (!Ret)
+ {
+ LPWSTR StrSid;
+ Ret = ConvertSidToStringSidW(Sid,
+ &StrSid);
+ if (Ret)
+ {
+ wcscpy(User,
+ StrSid);
+ LocalFree((HLOCAL)StrSid);
+ }
+ }
+
+ return Ret;
+}
+
+static VOID
+FreeRecycleBinsList(IN OUT PRECYCLE_BIN *RecycleBinsListHead)
+{
+ PRECYCLE_BIN CurrentBin, NextBin;
+
+ CurrentBin = *RecycleBinsListHead;
+ while (CurrentBin != NULL)
+ {
+ NextBin = CurrentBin->Next;
+ LocalFree((HLOCAL)CurrentBin->Sid);
+ HeapFree(GetProcessHeap(),
+ 0,
+ CurrentBin);
+ CurrentBin = NextBin;
+ }
+
+ *RecycleBinsListHead = NULL;
+}
+
+static BOOL
+LocateRecycleBins(IN LPWSTR szDrive,
+ OUT PRECYCLE_BIN *RecycleBinsListHead)
+{
+ TCHAR szRecBinPath[MAX_PATH + 1];
+ HANDLE FindResult;
+ WIN32_FIND_DATA FindData;
+ PRECYCLE_BIN NewBin;
+ BOOL Ret = FALSE;
+
+ FreeRecycleBinsList(RecycleBinsListHead);
+
+ /*
+ * search for recycle bins on volumes that support file security
(NTFS)
+ */
+ _stprintf(szRecBinPath,
+ _T("%lS\\RECYCLER\\*"),
+ szDrive);
+ FindResult = FindFirstFile(szRecBinPath,
+ &FindData);
+ if (FindResult != INVALID_HANDLE_VALUE)
+ {
+ do
+ {
+ if (FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY &&
+ _tcscmp(FindData.cFileName,
+ _T("..")) &&
+ _tcscmp(FindData.cFileName,
+ _T(".")))
+ {
+ PSID Sid;
+
+ if (ConvertStringSidToSid(FindData.cFileName,
+ &Sid))
+ {
+ _stprintf(szRecBinPath,
+ _T("%s\\RECYCLER\\%s"),
+ szDrive,
+ FindData.cFileName);
+ if (IsValidRecycleBin(szRecBinPath))
+ {
+ NewBin =
(PRECYCLE_BIN)HeapAlloc(GetProcessHeap(),
+
HEAP_ZERO_MEMORY,
+
sizeof(RECYCLE_BIN));
+ if (NewBin != NULL)
+ {
+ _tcscpy(NewBin->Path,
+ szRecBinPath);
+
+ /* convert the SID to an account name */
+ ConvertSIDToAccountName(Sid,
+ NewBin->User);
+
+ /* append the recycle bin */
+ *RecycleBinsListHead = NewBin;
+ RecycleBinsListHead = &NewBin->Next;
+
+ Ret = TRUE;
+ }
+ else
+ goto ContinueFreeSid;
+ }
+ else
+ {
+ContinueFreeSid:
+ LocalFree((HLOCAL)Sid);
+ }
+ }
+ }
+ } while (FindNextFile(FindResult,
+ &FindData));
+
+ FindClose(FindResult);
+ }
+
+ /*
+ * search for recycle bins on volumes that don't support file
security (FAT)
+ */
+ _stprintf(szRecBinPath,
+ _T("%s\\Recycled"),
+ szDrive);
+ FindResult = FindFirstFile(szRecBinPath,
+ &FindData);
+ if (FindResult != INVALID_HANDLE_VALUE)
+ {
+ if (IsValidRecycleBin(szRecBinPath))
+ {
+ SID_IDENTIFIER_AUTHORITY WorldSia =
{SECURITY_WORLD_SID_AUTHORITY};
+ PSID EveryoneSid;
+
+ /* create an Everyone SID */
+ if (AllocateAndInitializeSid(&WorldSia,
+ 1,
+ SECURITY_WORLD_RID,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ &EveryoneSid))
+ {
+ NewBin = (PRECYCLE_BIN)HeapAlloc(GetProcessHeap(),
+ HEAP_ZERO_MEMORY,
+ sizeof(RECYCLE_BIN));
+ if (NewBin != NULL)
+ {
+ _tcscpy(NewBin->Path,
+ szRecBinPath);
+
+ /* convert the SID to an account name */
+ ConvertSIDToAccountName(EveryoneSid,
+ NewBin->User);
+
+ /* append the recycle bin */
+ *RecycleBinsListHead = NewBin;
+ RecycleBinsListHead = &NewBin->Next;
+
+ Ret = TRUE;
+ }
+ else
+ FreeSid(EveryoneSid);
+ }
+ }
+ FindClose(FindResult);
+ }
+
+ return Ret;
+}
+
+static VOID
+DiskFileNameFromRecord(OUT LPTSTR szShortFileName,
+ IN DWORD RecordNumber,
+ IN WCHAR cDriveLetter,
+ IN LPWSTR szFileName)
+{
+ LPWSTR FileExt;
+
+ FileExt = wcsrchr(szFileName,
+ L'.');
+ if (FileExt != NULL)
+ {
+ _stprintf(szShortFileName,
+ _T("D%lC%d%lS"),
+ cDriveLetter,
+ RecordNumber,
+ FileExt);
+ }
+ else
+ {
+ _stprintf(szShortFileName,
+ _T("D%lC%d"),
+ cDriveLetter,
+ RecordNumber);
+ }
+}
+
+static BOOL
+DumpRecycleBin(IN PRECYCLE_BIN RecycleBin)
+{
+ WCHAR szFile[MAX_PATH + 1];
+ HANDLE hDb;
+ LARGE_INTEGER FileSize;
+ PVOID pDbBase = NULL;
+ INFO_VERSION Version = ivUnknown;
+
+ _tprintf(_T("Dumping recycle bin of \"%lS\":\n"),
+ RecycleBin->User);
+ _tprintf(_T("Directory: %lS\n\n"),
+ RecycleBin->Path);
+
+ _stprintf(szFile,
+ _T("%s\\INFO2"),
+ RecycleBin->Path);
+ hDb = OpenAndMapInfoDatabase(szFile,
+ &pDbBase,
+ &FileSize);
+ if (hDb != INVALID_HANDLE_VALUE)
+ {
+ Version = DetectDatabaseVersion(pDbBase);
+
+ /* dump the INFO2 database */
+ switch (Version)
+ {
+ case ivINFO2:
+ {
+ DWORD nRecords;
+ PINFO2_HEADER Info2Header = (PINFO2_HEADER)pDbBase;
+ PINFO2_RECORD Info2 = (PINFO2_RECORD)(Info2Header + 1);
+ int i = 0;
+
+ nRecords = (FileSize.QuadPart - sizeof(INFO2_HEADER)) /
Info2Header->RecordSize;
+
+ while (nRecords != 0)
+ {
+ /* if the first character of the AnsiFileName is
zero, the record
+ is considered deleted */
+ if (Info2->AnsiFileName[0] != '\0')
+ {
+ _tprintf(_T(" [%d] Record: #%d \"%lS\"\n"),
+ ++i,
+ Info2->RecordNumber,
+ Info2->FileName);
+
+ DiskFileNameFromRecord(szFile,
+ Info2->RecordNumber,
+
(WCHAR)Info2->DriveLetter + L'a',
+ Info2->FileName);
+ _tprintf(_T(" Name on disk: \"%s\"\n"),
+ szFile);
+ _tprintf(_T(" Deleted size on disk: %d
KB\n"),
+ Info2->DeletedPhysicalSize / 1024);
+ }
+ nRecords--;
+ Info2++;
+ }
+
+ break;
+ }
+
+ default:
+ break;
+ }
+
+ UnmapAndCloseDatabase(hDb,
+ pDbBase);
+ }
+
+ return FALSE;
+}
+
+static BOOL
+SelectRecycleBin(IN LPWSTR szDrive)
+{
+ BOOL Ret;
+ PRECYCLE_BIN RecycleBinsList = NULL;
+
+ Ret = LocateRecycleBins(szDrive,
+ &RecycleBinsList);
+ if (Ret)
+ {
+ if (RecycleBinsList->Next != NULL)
+ {
+ PRECYCLE_BIN CurrentBin = RecycleBinsList;
+ int n = 0, i = 0;
+
+ /* if there are multiple recycle bins ask the user which
one to dump */
+ _tprintf(_T("There are several recycle bins on this drive.
Select one:\n"));
+
+ while (CurrentBin != NULL)
+ {
+ _tprintf(_T(" [%d] %lS\n"),
+ ++i,
+ CurrentBin->User);
+ CurrentBin = CurrentBin->Next;
+ n++;
+ }
+
+ _tprintf(_T("Enter the number: "));
+DisplayPrompt:
+ _tscanf(_T("%d"),
+ &i);
+ if (i > n || i < 1)
+ {
+ _tprintf(_T("Please enter a number between 1 and %d:
"),
+ n);
+ goto DisplayPrompt;
+ }
+
+ /* walk to the selected recycle bin */
+ CurrentBin = RecycleBinsList;
+ while (CurrentBin != NULL && i != 1)
+ {
+ CurrentBin = CurrentBin->Next;
+ i--;
+ }
+
+ /* dump it */
+ Ret = DumpRecycleBin(CurrentBin);
+ }
+ else
+ {
+ /* dump the first (and only) recycle bin */
+ Ret = DumpRecycleBin(RecycleBinsList);
+ }
+ }
+ else
+ {
+ _ftprintf(stderr,
+ _T("No recycle bins on this volume!\n"));
+ }
+
+ FreeRecycleBinsList(&RecycleBinsList);
+
+ return Ret;
+}
+
+static VOID
+PrintHelp(VOID)
+{
+ _ftprintf(stderr,
+ _T("Usage: dumprecbin C:\n"));
+}
+
+int
+main(int argc,
+ char *argv[])
+{
+ if (argc != 2 ||
+ strlen(argv[1]) != 2 || argv[1][1] != ':' ||
+ toupper(argv[1][0]) < 'A' || toupper(argv[1][0]) > 'Z')
+ {
+ PrintHelp();
+ return 1;
+ }
+ else
+ {
+ WCHAR szDrive[3];
+ _stprintf(szDrive,
+ _T("%lC:"),
+ argv[1][0]);
+
+ if (!SelectRecycleBin(szDrive))
+ return 1;
+ else
+ return 0;
+ }
+}
+
Property changes on: trunk/reactos/apps/utils/dumprecbin/dumprecbin.c
___________________________________________________________________
Name: svn:keywords
+ author date revision
Name: svn:eol-style
+ native
_____
Added: trunk/reactos/apps/utils/dumprecbin/dumprecbin.xml
--- trunk/reactos/apps/utils/dumprecbin/dumprecbin.xml 2005-10-09
20:24:00 UTC (rev 18383)
+++ trunk/reactos/apps/utils/dumprecbin/dumprecbin.xml 2005-10-09
20:56:17 UTC (rev 18384)
@@ -0,0 +1,13 @@
+<module name="dumprecbin" type="win32cui" installbase="bin"
installname="dumprecbin.exe">
+ <include base="dumprecbin">.</include>
+ <define name="__USE_W32API" />
+ <define name="UNICODE" />
+ <define name="_UNICODE" />
+ <define name="_WIN32_IE">0x0500</define>
+ <define name="_WIN32_WINNT">0x0600</define>
+ <define name="WINVER">0x0600</define>
+ <library>advapi32</library>
+ <library>kernel32</library>
+ <library>ntdll</library>
+ <file>dumprecbin.c</file>
+</module>
\ No newline at end of file
Property changes on: trunk/reactos/apps/utils/dumprecbin/dumprecbin.xml
___________________________________________________________________
Name: svn:eol-style
+ native
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.reactos.org/pipermail/ros-diffs/attachments/20051009/0545aff0/attachment.html
More information about the Ros-diffs
mailing list