private bool WasModifiedLast(DatabaseFile databaseFile, List <uint> collisions)
{
var dirent = databaseFile.GetDirent();
foreach (var cluster in collisions)
{
var clusterEnts = clusterMap[(uint)cluster];
foreach (var ent in clusterEnts)
{
var entDirent = ent.GetDirent();
// Skip when we encounter the same dirent
if (dirent.Offset == entDirent.Offset)
{
continue;
}
if (dirent.LastAccessTime.AsDateTime() < entDirent.LastAccessTime.AsDateTime())
{
return(false);
}
}
}
return(true);
}
private void DoRanking(DatabaseFile databaseFile)
{
var dirent = databaseFile.GetDirent();
// Rank 1
// - Part of active file system
// - Not deleted
// Rank 2
// - Recovered
// - No conflicting clusters detected
// Rank 3
// - Recovered
// - Some conflicting clusters
// - Most recent data written
// Rank 4
// - Recovered
// - Some conflicting clusters
// - Not most recent data written
// Rank 5
// - Recovered
// - All clusters overwritten
if (!databaseFile.IsDeleted)
{
if (!dirent.IsDeleted())
{
databaseFile.SetRanking((0));
}
}
else
{
// File was deleted
var collisions = databaseFile.GetCollisions();
if (collisions.Count == 0)
{
databaseFile.SetRanking((1));
}
else
{
// File has colliding clusters
if (WasModifiedLast(databaseFile, collisions))
{
// This file appears to have been written most recently.
databaseFile.SetRanking((2));
}
else
{
// File was predicted to be overwritten
var numClusters = (int)(((dirent.FileSize + (this.volume.BytesPerCluster - 1)) &
~(this.volume.BytesPerCluster - 1)) / this.volume.BytesPerCluster);
if (collisions.Count != numClusters)
{
// Not every cluster was overwritten
databaseFile.SetRanking((3));
}
else
{
// Every cluster appears to have been overwritten
databaseFile.SetRanking((4));
}
}
}
}
}