Recover cmd (#21)

* Log loaded plugins

* README extensions

* Implement recover command

Author: ostafen

README.md

@@ -17,7 +17,7 @@
 
 While many data recovery tools exist, few offer a combination of simplicity, flexibility, and modern design focused on deep disk analysis and effective file carving.
 
-Digler was created to fill this gap by providing a streamlined, reliable command-line tool that makes data recovery easier and more efficient—without the complexity of heavyweight GUIs or fragmented workflows.
+Digler was created to fill this gap by providing a streamlined, plugin-extensible command-line tool that makes data recovery easier and more efficient without the complexity of heavyweight GUIs or fragmented workflows.
 
 Built in Go, Digler leverages the language’s strengths in performance, cross-platform support, and maintainability to deliver a fast and dependable solution for today’s data recovery challenges.
 
@@ -28,9 +28,11 @@ Built in Go, Digler leverages the language’s strengths in performance, cross-p
 
 * **File System Agnostic Analysis**: Recover deleted files regardless of the underlying file system (e.g., NTFS, FAT32, ext4), even when metadata is lost.
 
+* **Plugin-Based Extensibility**: Support for custom file scanners through plugins, simplifying integration with new file formats.
+
 * **Reporting Capabilities**: Generate detailed reports, compliant with the `Digital Forensics XML (DFXML)` format, of recovered data and analysis findings.
 
-* **Post-Scan Data Recovery**: Utilize the generated DFXML reports to precisely recover deleted or fragmented files.
+* **Post-Scan Data Recovery**: Utilize the generated DFXML reports to precisely recover specific files.
 
 * **Intuitive Command-Line Interface**:  A user-friendly CLI designed for efficiency and ease of use.
 

cmd/cmd/recover.go

@@ -0,0 +1,101 @@
+// Copyright (c) 2025 Stefano Scafiti
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+package cmd
+
+import (
+	"bufio"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/ostafen/digler/internal/fs"
+	"github.com/ostafen/digler/internal/logger"
+	"github.com/ostafen/digler/internal/scan"
+	"github.com/ostafen/digler/pkg/dfxml"
+	osutils "github.com/ostafen/digler/pkg/util/os"
+	"github.com/spf13/cobra"
+)
+
+func DefineRecoverCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "recover <image_path> <report_file>",
+		Short: "Recover files from a disk image using a scan report",
+		Long: `The 'recover' command extracts files from a disk image or device based on the information provided in a scan report.
+The scan report contains metadata and file information needed for recovery.
+You must provide the full path to the image file and the report file.
+Recovered files will be saved to the specified output directory.`,
+		Args:         cobra.ExactArgs(2),
+		SilenceUsage: true,
+		RunE:         RunRecover,
+	}
+	cmd.Flags().StringP("output-dir", "i", "", "Absolute path to the directory where recovered data will be placed.")
+	return cmd
+}
+
+func RunRecover(cmd *cobra.Command, args []string) error {
+	f, err := fs.Open(args[0])
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	reportFile, err := os.Open(args[1])
+	if err != nil {
+		return err
+	}
+
+	objects, err := dfxml.ReadFileObjects(bufio.NewReader(reportFile))
+	if err != nil {
+		return err
+	}
+
+	outDir, _ := cmd.Flags().GetString("output-dir")
+	if outDir == "" {
+		wdir, err := os.Getwd()
+		if err != nil {
+			return err
+		}
+
+		base := filepath.Base(reportFile.Name())
+		name := strings.TrimSuffix(base, filepath.Ext(base))
+		outDir = filepath.Join(wdir, name+"-dump")
+	}
+
+	_, err = osutils.EnsureDir(outDir, true)
+	if err != nil {
+		return err
+	}
+
+	finfos, err := fileObjectsToFileInfo(objects)
+	if err != nil {
+		return err
+	}
+
+	logger := logger.New(os.Stdout, logger.InfoLevel)
+
+	for _, finfo := range finfos {
+		logger.Infof("recovering file %s", filepath.Join(outDir, finfo.Name))
+
+		if err := scan.DumpFile(f, outDir, &finfo); err != nil {
+			logger.Errorf("unable to dump file %s: %s", finfo.Name, err)
+		}
+	}
+	return nil
+}

cmd/cmd/root.go

@@ -31,6 +31,7 @@ func Execute() error {
 	}
 
 	rootCmd.AddCommand(DefineScanCommand())
+	rootCmd.AddCommand(DefineRecoverCommand())
 	rootCmd.AddCommand(DefineMountCommand())
 	rootCmd.AddCommand(DefineFormatsCommand())
 

internal/disk/mbr.go

@@ -22,6 +22,8 @@ package disk
 import (
 	"encoding/binary"
 	"fmt"
+
+	fmtutils "github.com/ostafen/digler/pkg/util/format"
 )
 
 // MBRPartitionEntry represents a single 16-byte entry in the MBR's partition table.
@@ -62,7 +64,7 @@ func (p *MBRPartitionEntry) String() string {
 		p.ReadStartLBA(),
 		p.ReadTotalSectors(),
 		p.ReadTotalSectors()*512, // Assuming 512 bytes per sector
-		formatBytes(uint64(p.ReadTotalSectors())*512))
+		fmtutils.FormatBytes(int64(p.ReadTotalSectors())*512))
 }
 
 // MBR represents the Master Boot Record structure.
@@ -202,25 +204,3 @@ func getPartitionTypeName(id MBRPartition) string {
 		return "Unknown"
 	}
 }
-
-func formatBytes(b uint64) string {
-	const (
-		_  = iota             // 0
-		KB = 1 << (10 * iota) // 1 << 10 (1024)
-		MB = 1 << (10 * iota) // 1 << 20 (1024 * 1024)
-		GB = 1 << (10 * iota) // 1 << 30 (1024 * 1024 * 1024)
-		TB = 1 << (10 * iota) // 1 << 40 (1024 * 1024 * 1024 * 1024)
-	)
-	switch {
-	case b >= TB:
-		return fmt.Sprintf("%.2f TB", float64(b)/float64(TB))
-	case b >= GB:
-		return fmt.Sprintf("%.2f GB", float64(b)/float64(GB))
-	case b >= MB:
-		return fmt.Sprintf("%.2f MB", float64(b)/float64(MB))
-	case b >= KB:
-		return fmt.Sprintf("%.2f KB", float64(b)/float64(KB))
-	default: // Handle bytes less than 1KB
-		return fmt.Sprintf("%d B", b)
-	}
-}

internal/format/header.go

@@ -22,7 +22,6 @@ package format
 import (
 	"fmt"
 	"plugin"
-	"reflect"
 )
 
 type ScanResult struct {
@@ -117,7 +116,6 @@ func loadPlugin(path string) (FileScanner, error) {
 		return nil, fmt.Errorf("plugin %s does not export FileScanner symbol: %w", path, err)
 	}
 
-	fmt.Println(reflect.TypeOf(symScanner))
 	getScanner, ok := symScanner.(func() (FileScanner, error))
 	if !ok {
 		return nil, fmt.Errorf("plugin %s GetScanner has wrong type", path)

internal/fuse/mount_linux.go

@@ -23,8 +23,6 @@
 package fuse
 
 import (
-	"errors"
-	"fmt"
 	"io"
 	"log"
 	"os"
@@ -34,10 +32,11 @@ import (
 	"bazil.org/fuse"
 	fusefs "bazil.org/fuse/fs"
 	"github.com/ostafen/digler/internal/format"
+	osutils "github.com/ostafen/digler/pkg/util/os"
 )
 
 func Mount(mountpoint string, r io.ReaderAt, finfos []format.FileInfo) error {
-	created, err := PrepareMountpoint(mountpoint)
+	created, err := osutils.EnsureDir(mountpoint, true)
 	if err != nil {
 		return err
 	}
@@ -104,57 +103,3 @@ func waitForUmount(mountpoint string) error {
 	}
 	return nil
 }
-
-// PrepareMountpoint ensures the given path is a valid, empty directory suitable for FUSE mounting.
-// It creates the directory if it doesn't exist. Returns `true` if created, `false` otherwise,
-// or an error if the path exists but isn't an empty directory.
-func PrepareMountpoint(mountpoint string) (bool, error) {
-	finfo, err := os.Stat(mountpoint)
-	if errors.Is(err, os.ErrNotExist) {
-		err := os.Mkdir(mountpoint, 0755)
-		if err != nil {
-			return false, fmt.Errorf("failed to create mountpoint %s: %w", mountpoint, err)
-		}
-		return true, nil
-	}
-	if err != nil {
-		return false, fmt.Errorf("failed to stat mountpoint %s: %w", mountpoint, err)
-	}
-
-	if !finfo.IsDir() {
-		return false, fmt.Errorf("mountpoint %s is not a directory", mountpoint)
-	}
-
-	empty, err := IsDirEmpty(mountpoint)
-	if err != nil {
-		return false, fmt.Errorf("failed to check if mountpoint %s is empty: %w", mountpoint, err)
-	}
-
-	if !empty {
-		return false, fmt.Errorf("mountpoint %s is not empty", mountpoint)
-	}
-	return false, nil
-}
-
-// IsDirEmpty returns true if the directory at path is empty, false otherwise.
-// Returns an error if the path does not exist or is not a directory.
-func IsDirEmpty(path string) (bool, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return false, err
-	}
-	defer f.Close()
-
-	entries, err := f.Readdir(1)
-	if err != nil {
-		if err == io.EOF {
-			return true, nil
-		}
-		return false, err
-	}
-
-	if len(entries) > 0 {
-		return false, nil
-	}
-	return true, nil
-}

internal/scan/scan.go

@@ -90,11 +90,11 @@ func ScanPartition(p *disk.Partition, filePath string, opts Options) error {
 		return err
 	}
 
-	session := GenSessionID()
+	scanID := GetScanID()
 
 	var reportFileName string
 	if opts.ReportFile == "" {
-		reportFileName = fmt.Sprintf("report_%s.xml", session)
+		reportFileName = fmt.Sprintf("report_%s.xml", scanID)
 	}
 
 	outFile, err := os.Create(reportFileName)
@@ -131,16 +131,17 @@ func ScanPartition(p *disk.Partition, filePath string, opts Options) error {
 
 	var logFilePath string
 	if !opts.DisableLog {
-		logFilePath = absPath(filepath.Join(opts.DumpDir, session) + ".log")
+		logFilePath = absPath(filepath.Join(opts.DumpDir, scanID) + ".log")
 	}
 
 	scanners, err := format.GetFileScanners(opts.FileExt...)
 	if err != nil {
 		return err
 	}
 
+	var pluginScanners []format.FileScanner
 	if len(opts.Plugins) > 0 {
-		pluginScanners, err := format.LoadPlugins(opts.Plugins...)
+		pluginScanners, err = format.LoadPlugins(opts.Plugins...)
 		if err != nil {
 			return err
 		}
@@ -166,6 +167,12 @@ func ScanPartition(p *disk.Partition, filePath string, opts Options) error {
 	logger.Infof("Source: \t%s", absPath(filePath))
 	logger.Infof("File Types: \t%s", strings.Join(fileExts, ","))
 
+	if len(pluginScanners) > 0 {
+		logger.Infof("Loaded %d plugins(s): \t%s", len(pluginScanners), strings.Join(opts.Plugins, ","))
+	} else {
+		logger.Infof("No plugin loaded")
+	}
+
 	if opts.DumpDir != "" {
 		logger.Infof("Destination: \t%s", absPath(opts.DumpDir))
 	}
@@ -202,11 +209,8 @@ func ScanPartition(p *disk.Partition, filePath string, opts Options) error {
 		totalDataSize += finfo.Size
 
 		if opts.DumpDir != "" {
-			fileReader := io.NewSectionReader(r, int64(finfo.Offset), int64(finfo.Size))
-
-			err := ioutil.CopyFile(filepath.Join(opts.DumpDir, finfo.Name), fileReader)
-			if err != nil {
-				return err
+			if err := DumpFile(r, opts.DumpDir, &finfo); err != nil {
+				logger.Errorf("unable to dump file %s: %s", finfo.Name, err)
 			}
 		}
 
@@ -238,6 +242,12 @@ func ScanPartition(p *disk.Partition, filePath string, opts Options) error {
 	return nil
 }
 
+func DumpFile(r io.ReaderAt, outDir string, finfo *format.FileInfo) error {
+	fileReader := io.NewSectionReader(r, int64(finfo.Offset), int64(finfo.Size))
+
+	return ioutil.CopyFile(filepath.Join(outDir, finfo.Name), fileReader)
+}
+
 func DiscoverPartitions(path string) ([]disk.Partition, error) {
 	imgFile, err := fs.Open(path)
 	if err != nil {
@@ -263,9 +273,6 @@ func DiscoverPartitions(path string) ([]disk.Partition, error) {
 		}
 	}
 
-	// TODO: if was unable to determine the partitions,
-	// Maybe, try to locate partition boundaries using FAT signature, etc?
-
 	finfo, err := imgFile.Stat()
 	if err != nil {
 		return nil, err
@@ -337,9 +344,9 @@ func GetMBRPartitions(imgFile fs.File, mbr *disk.MBR) ([]disk.Partition, error)
 	return partitions, nil
 }
 
-// GenSessionID creates a unique file name for a scan session.
+// GetScanID creates a unique file name for a scan session.
 // The format is "scan_YYYYMMDD_HHMMSS".
-func GenSessionID() string {
+func GetScanID() string {
 	now := time.Now()
 
 	// Format the time as YYYYMMDD_HHMMSS