implemented simple file recovery (#8)

Author: NikolaMilosa

Diff for: src/cli.rs

@@ -61,12 +61,12 @@ impl CliParsed {
 
     pub fn parse_and_validate(args: Cli) -> Result<Self, UndeleteError> {
         if args.volume.is_none() && args.image.is_none() {
-            return Err(UndeleteError::ParseError(
+            return Err(UndeleteError::Parse(
                 "Either volume or image must be specified".to_string(),
             ));
         }
         if args.volume.is_some() && args.image.is_some() {
-            return Err(UndeleteError::ParseError(
+            return Err(UndeleteError::Parse(
                 "Only one of volume or image must be specified".to_string(),
             ));
         }

Diff for: src/errors.rs

@@ -1,5 +1,6 @@
 #[derive(Debug)]
 pub enum UndeleteError {
-    ParseError(String),
-    InitializationError(String),
+    Parse(String),
+    Initialization(String),
+    Write(String),
 }

Diff for: src/main.rs

@@ -1,3 +1,5 @@
+use std::path::PathBuf;
+
 use clap::Parser;
 use cli::Cli;
 use errors::UndeleteError;
@@ -24,8 +26,27 @@ fn main() -> Result<(), UndeleteError> {
         }
     };
 
-    for entry in parser.get_all_entry_names() {
-        info!("Entry: {:?}", entry);
+    let message = match args.dry_run {
+        true => "Dry run mode enabled, no files will be written to disk",
+        false => "Dry run mode disabled, files will be written to disk",
+    };
+    info!("{}", message);
+
+    for entry in parser.get_all_entries().iter().filter(|e| !e.is_allocated) {
+        let calculated_path = PathBuf::from(&args.output_dir).join(&entry.filename);
+        info!(
+            "Found deleted entry '{}' with {}B of data, will write it to {}",
+            entry.filename,
+            entry.data.len(),
+            calculated_path.display()
+        );
+        if !args.dry_run {
+            match std::fs::write(calculated_path.clone(), &entry.data) {
+                Ok(_) => info!("Successfully wrote '{}' to disk", calculated_path.display()),
+                Err(e) => return Err(UndeleteError::Write(e.to_string())),
+            }
+        }
     }
+
     Ok(())
 }

Diff for: src/parser_wrapper.rs

@@ -13,7 +13,7 @@ impl ParserWrapper {
     pub fn new(path: PathBuf) -> Result<Self, UndeleteError> {
         let parser = match MftParser::from_path(path) {
             Ok(p) => p,
-            Err(e) => return Err(UndeleteError::InitializationError(e.to_string())),
+            Err(e) => return Err(UndeleteError::Initialization(e.to_string())),
         };
         Ok(Self { parser })
     }
@@ -80,7 +80,7 @@ impl ParserWrapper {
         }
     }
 
-    pub fn get_all_entry_names(&mut self) -> Vec<UndeleteFileEntry> {
+    pub fn get_all_entries(&mut self) -> Vec<UndeleteFileEntry> {
         let found = self
             .parser
             .iter_entries()
@@ -123,7 +123,7 @@ mod tests {
     fn parser_get_entry_names() {
         let entries = ParserWrapper::new(PathBuf::from("test_data/MFT_TEST"))
             .unwrap()
-            .get_all_entry_names();
+            .get_all_entries();
 
         assert!(!entries.is_empty());
     }

Diff for: src/undelete_entry.rs

@@ -8,6 +8,7 @@ pub struct UndeleteFileEntry {
     pub filename: String,
     pub is_allocated: bool,
     pub record_number: u64,
+    pub data: Vec<u8>,
 }
 
 impl From<MftEntry> for UndeleteFileEntry {
@@ -23,13 +24,28 @@ impl From<MftEntry> for UndeleteFileEntry {
             })
             .next();
 
+        let data = value
+            .iter_attributes_matching(Some(vec![MftAttributeType::DATA]))
+            .filter_map(|attr| match attr {
+                Ok(attribute) => match attribute.data {
+                    MftAttributeContent::AttrX80(data) => Some(data),
+                    _ => None,
+                },
+                Err(_) => None,
+            })
+            .next();
+
         UndeleteFileEntry {
             filename: match file_attribute {
                 Some(attr) => attr.name,
                 None => "".to_string(),
             },
             is_allocated: value.is_allocated(),
             record_number: value.header.record_number,
+            data: match data {
+                Some(d) => d.data().to_vec(),
+                None => vec![],
+            },
         }
     }
 }