magic functions part2 (inactiv)

12 files changed, 519 insertions, 45 deletions

diff --git a/README b/README
index 26534b0..3bfb725 100644
--- a/README
+++ b/README
@@ -1,12 +1,25 @@
-FIXME:

-so far only draft

+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

+             !!!!  Important Warning  !!!!

+If you see this note in the README, then you've probably downloaded an 

+unstable version of the source code via CVS.

+There are many new features in development. These functions are not

+activated and still do not work correctly. You'll also get problems 

+if you try to compile this source code.

 

+Please use instead the source code of release 0.1.4

 

+Thank you for your interest! The next release will include a lot of

+new features. I work hard on it.

 

+robi@users.berlios.de

+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 

+--------------------------------------------------------------------

 

 

 

+FIXME:

+so far only draft

 

 What is, and what can ext4magic ?

 =================================

diff --git a/src/Makefile.am b/src/Makefile.am
index 77e1a61..60cd839 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,6 +1,7 @@
 sbin_PROGRAMS = ext4magic
 ext4magic_SOURCES = block.c dir_list.c ext4magic.c hard_link_stack.c \
-	imap_search.c inode.c journal.c lookup_local.c recover.c ring_buf.c util.c
+	imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c recover.c \
+	ring_buf.c util.c
 
 # set the include path found by configure
 INCLUDES= $(all_includes)
@@ -9,6 +10,7 @@ man_MANS = ext4magic.8
 
 # the library search path.
 ext4magic_CFLAGS = -O2 -g -D_FILE_OFFSET_BITS=64
-ext4magic_LDFLAGS = -lext2fs -le2p -luuid -lblkid
-noinst_HEADERS = block.h dir_list.h ext2fsP.h kernel-list.h ext4magic.h hard_link_stack.h \
-	inode.h jfs_compat.h jfs_user.h journal.h kernel-jbd.h ring_buf.h util.h ext4magic.8
+ext4magic_LDFLAGS = -lext2fs -le2p -luuid -lblkid -lmagic
+noinst_HEADERS = block.h dir_list.h ext2fsP.h ext4magic.8 ext4magic.h \
+	hard_link_stack.h inode.h jfs_compat.h jfs_user.h journal.h kernel-jbd.h kernel-list.h \
+	magic.h ring_buf.h util.h
diff --git a/src/Makefile.in b/src/Makefile.in
index fdf3af9..082720a 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -54,6 +54,7 @@ am_ext4magic_OBJECTS = ext4magic-block.$(OBJEXT) \
 	ext4magic-hard_link_stack.$(OBJEXT) \
 	ext4magic-imap_search.$(OBJEXT) ext4magic-inode.$(OBJEXT) \
 	ext4magic-journal.$(OBJEXT) ext4magic-lookup_local.$(OBJEXT) \
+	ext4magic-magic_block_scan.$(OBJEXT) \
 	ext4magic-recover.$(OBJEXT) ext4magic-ring_buf.$(OBJEXT) \
 	ext4magic-util.$(OBJEXT)
 ext4magic_OBJECTS = $(am_ext4magic_OBJECTS)
@@ -215,7 +216,8 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 ext4magic_SOURCES = block.c dir_list.c ext4magic.c hard_link_stack.c \
-	imap_search.c inode.c journal.c lookup_local.c recover.c ring_buf.c util.c
+	imap_search.c inode.c journal.c lookup_local.c magic_block_scan.c recover.c \
+	ring_buf.c util.c
 
 
 # set the include path found by configure
@@ -224,9 +226,10 @@ man_MANS = ext4magic.8
 
 # the library search path.
 ext4magic_CFLAGS = -O2 -g -D_FILE_OFFSET_BITS=64
-ext4magic_LDFLAGS = -lext2fs -le2p -luuid -lblkid
-noinst_HEADERS = block.h dir_list.h ext2fsP.h kernel-list.h ext4magic.h hard_link_stack.h \
-	inode.h jfs_compat.h jfs_user.h journal.h kernel-jbd.h ring_buf.h util.h ext4magic.8
+ext4magic_LDFLAGS = -lext2fs -le2p -luuid -lblkid -lmagic
+noinst_HEADERS = block.h dir_list.h ext2fsP.h ext4magic.8 ext4magic.h \
+	hard_link_stack.h inode.h jfs_compat.h jfs_user.h journal.h kernel-jbd.h kernel-list.h \
+	magic.h ring_buf.h util.h
 
 all: all-am
 
@@ -323,6 +326,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-inode.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-journal.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-lookup_local.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-magic_block_scan.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-recover.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-ring_buf.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ext4magic-util.Po@am__quote@
@@ -460,6 +464,20 @@ ext4magic-lookup_local.obj: lookup_local.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-lookup_local.obj `if test -f 'lookup_local.c'; then $(CYGPATH_W) 'lookup_local.c'; else $(CYGPATH_W) '$(srcdir)/lookup_local.c'; fi`
 
+ext4magic-magic_block_scan.o: magic_block_scan.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-magic_block_scan.o -MD -MP -MF $(DEPDIR)/ext4magic-magic_block_scan.Tpo -c -o ext4magic-magic_block_scan.o `test -f 'magic_block_scan.c' || echo '$(srcdir)/'`magic_block_scan.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ext4magic-magic_block_scan.Tpo $(DEPDIR)/ext4magic-magic_block_scan.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='magic_block_scan.c' object='ext4magic-magic_block_scan.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-magic_block_scan.o `test -f 'magic_block_scan.c' || echo '$(srcdir)/'`magic_block_scan.c
+
+ext4magic-magic_block_scan.obj: magic_block_scan.c
+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-magic_block_scan.obj -MD -MP -MF $(DEPDIR)/ext4magic-magic_block_scan.Tpo -c -o ext4magic-magic_block_scan.obj `if test -f 'magic_block_scan.c'; then $(CYGPATH_W) 'magic_block_scan.c'; else $(CYGPATH_W) '$(srcdir)/magic_block_scan.c'; fi`
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ext4magic-magic_block_scan.Tpo $(DEPDIR)/ext4magic-magic_block_scan.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='magic_block_scan.c' object='ext4magic-magic_block_scan.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -c -o ext4magic-magic_block_scan.obj `if test -f 'magic_block_scan.c'; then $(CYGPATH_W) 'magic_block_scan.c'; else $(CYGPATH_W) '$(srcdir)/magic_block_scan.c'; fi`
+
 ext4magic-recover.o: recover.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(ext4magic_CFLAGS) $(CFLAGS) -MT ext4magic-recover.o -MD -MP -MF $(DEPDIR)/ext4magic-recover.Tpo -c -o ext4magic-recover.o `test -f 'recover.c' || echo '$(srcdir)/'`recover.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/ext4magic-recover.Tpo $(DEPDIR)/ext4magic-recover.Po
diff --git a/src/block.c b/src/block.c
index 28a43fd..b80c1d2 100644
--- a/src/block.c
+++ b/src/block.c
@@ -30,7 +30,7 @@
 //#include <ext2fs/ext2fs.h>
 #include "ext2fsP.h"
 #include "block.h"
-
+#include "journal.h"
 
 extern ext2fs_block_bitmap 	  	bmap ; 
 
@@ -692,3 +692,17 @@ errout:
 	return (ret & BLOCK_ERROR) ? ctx.errcode : 0;
 }
 //___________________________________________________________________________________________________
+
+#include "magic.h"
+//FIXME in work 
+int magic_check_block(char* buf,magic_t cookie, __u32 size, blk_t blk){
+	char	msg_buf[200];
+	int	count = size;
+ 	
+	strncpy(msg_buf,magic_buffer(cookie,buf,size),199);
+	while (*(buf+count) == 0) count-- ;
+	printf("Scan Result :  %s    %d\n", msg_buf , count+1) ;
+	
+	blockhex(stdout,buf,0,(count < (size -5)) ? count + 5 : size );
+	return count+1;
+}
\ No newline at end of file
diff --git a/src/ext4magic.c b/src/ext4magic.c
index 607f6bd..34b3c24 100644
--- a/src/ext4magic.c
+++ b/src/ext4magic.c
@@ -63,7 +63,6 @@ ext2_ino_t      		root, cwd;
 ext2fs_inode_bitmap 		imap = NULL ;
 ext2fs_block_bitmap 	  	bmap = NULL ; 
 
-
 //print Versions an CPU-endian-type
 void print_version ( void )
 {
@@ -572,6 +571,11 @@ while ((c = getopt (argc, argv, "TJRLlrQSxi:t:j:f:Vd:B:b:a:I:H")) != EOF) {
 //--------------------------------------------------------------------------------------------
 // check any parameter an options
 // check time option
+if (magicscan){
+	printf("Warning: Activate magic scan,  may be some command line options ignored\n");
+	}
+
+
 if (mode & INPUT_TIME){
 	if (! ((t_after > 315601200) && (t_after < t_before))) // 315601200 = "1980-01-01 20:00:00"
 		{
@@ -591,8 +595,9 @@ if (mode & INPUT_TIME){
 } 
 
 
+
 //check for the recoverdir
-if ((mode & RECOVER_INODE) && (recovermodus &  (REC_DIR_NEEDED)) || mode & RECOVER_LIST) {
+if ((mode & RECOVER_INODE) && (recovermodus &  (REC_DIR_NEEDED)) || mode & RECOVER_LIST || magicscan) {
 	struct stat     st_buf;
 	dev_t           file_rdev=0;
 	
@@ -755,6 +760,7 @@ if (mode & READ_JOURNAL){
 	}
 
 
+
 //recover from inputlist
 	if(mode & RECOVER_LIST){
 		recover_list(des_dir, input_filename,t_after,t_before,(recovermodus & RECOV_ALL )? 0 : 1);
@@ -876,16 +882,18 @@ if ((mode & COMMAND_INODE) && (mode & RECOVER_INODE))
 					lookup_local(des_dir, dir,t_after,t_before, recoverquality | recovermodus );
 					if (recovermodus & HIST_DIR )
 						print_coll_list(t_after, t_before, format);
-//Magic step 1 + 2
+//Magic step 1 + 2 +3
 					if (imap){
-						search_imap_inode(des_dir, t_after, t_before, 1); //search for lost fragments of directorys
-						search_imap_inode(des_dir, t_after, t_before, 0); //search for lost files
+						imap_search(des_dir, t_after, t_before);
+// I think imap is no longer needed from here, free the allocated memory 
+						ext2fs_free_inode_bitmap(imap);
+						imap = NULL;
+						magic_block_scan(des_dir, t_after);
 					}
+					clear_dir_list(dir);
 				}
 				else
 					printf("Inode %lu is a directory but not found after %lu and before %lu\n",inode_nr,t_after,t_before);
-				
-				if (dir) clear_dir_list(dir);
 			}
 			else {
 				if (recovermodus & (RECOV_ALL | RECOV_DEL))
@@ -946,13 +954,12 @@ exitval = EXIT_SUCCESS;
 errout: 
   if (current_fs)    {
 //FIXME in development	
-	if (bmap){
-	//	struct ext2fs_struct_loc_generic_bitmap *pmap;
-	//	pmap=bmap;
-	//	blockhex(stdout,(void*)pmap->bitmap,0,current_fs->super->s_blocks_count >> 3);
-		ext2fs_free_block_bitmap(bmap);
-	}
+/*	if (d_bmap){
+		struct ext2fs_struct_loc_generic_bitmap *d_bmap;
+		blockhex(stdout,(void*)d_bmap->bitmap,0,current_fs->super->s_blocks_count >> 3);
+	}*/
 	if (imap) ext2fs_free_inode_bitmap(imap);
+	if (bmap) ext2fs_free_inode_bitmap(bmap);
 	imap = NULL;
 	bmap = NULL;
         retval = ext2fs_close(current_fs);
diff --git a/src/imap_search.c b/src/imap_search.c
index 3446bec..b86ebb9 100644
--- a/src/imap_search.c
+++ b/src/imap_search.c
@@ -1,14 +1,25 @@
-/*
-*  C Implementation: imap_search
-*
-* Description: 
-*
-*
-* Author: Roberto Maar <robi@users.berlios.de>, (C) 2010
-*
-* Copyright: See COPYING file that comes with this distribution
-*
-*/
+/***************************************************************************
+ *   Copyright (C) 2010 by Roberto Maar                                    *
+ *   robi@users.berlios.de                                                 *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program; if not, write to the                         *
+ *   Free Software Foundation, Inc.,                                       *
+ *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                         *
+ *                                                                         * 
+ * C Implementation: imap_search                                           *
+ ***************************************************************************/
 
 //header  util.h
 
@@ -22,7 +33,7 @@ extern ext2_filsys current_fs;
 
 
 // search inode by use imap (step1: flag 1 = only directory ; step2: flag 0 = only file)
-void search_imap_inode(char* des_dir, __u32 t_after, __u32 t_before, int flag)
+static void search_imap_inode(char* des_dir, __u32 t_after, __u32 t_before, int flag)
 {
 struct ext2_group_desc 			*gdp;
 struct 	ext2_inode_large 		*inode;
@@ -184,3 +195,13 @@ return retval;
 }
 
 
+//2 step search for journalinode, will find some lost directory and files 
+void imap_search(char* des_dir, __u32 t_after, __u32 t_before){
+	printf("MAGIC-1 : start lost directory search\n"); 
+	search_imap_inode(des_dir, t_after, t_before, 1); //search for lost fragments of directorys
+	printf("MAGIC-2 : start lost file search\n");
+	search_imap_inode(des_dir, t_after, t_before, 0); //search for lost files
+return;
+}
+
+
diff --git a/src/journal.c b/src/journal.c
index 8781792..1d4330e 100644
--- a/src/journal.c
+++ b/src/journal.c
@@ -68,6 +68,7 @@ char					jsb_buffer[1024];  //buffer for journal-superblock (be_to_CPU)
 void*					pt_buff;  /*pointer of the privat descriptor Table */
 journal_descriptor_tag_t		*pt;	/*pointer for descriptor Table*/
 __u32					pt_count; /*counter for privat descriptor Table */
+struct j_bitmap_list_t			jbbm  ;  /* for Block Bitmaps of Journal */
 
 
 //print journal superblock
@@ -469,7 +470,7 @@ return journal_nr;
 }
 
 
-// get the last dir-block for transaction from journal or if not found the real block
+// get the last dir-block for transaction from journal or if not, found the real block
 //FIXME: blk64_t ????
 int get_last_block(char *buf,  blk_t *block, __u32 t_start, __u32 t_end){
 	int	retval = 0;
@@ -549,7 +550,7 @@ static int sort_block_list(journal_descriptor_tag_t *pointer, int counter ){
 	journal_descriptor_tag_t p1;
 	int c1,c2,flag=1;
 	c1 = 0;
-//FIXME : for the faster double-sided Bubblesort
+//FIXME : for faster sort
 	while (flag) {
 		flag = 0;
 		for (c2 = 0;c2 < (counter -c1 -1);c2++){
@@ -587,6 +588,7 @@ int get_block_list(journal_descriptor_tag_t *pointer, blk64_t block , int counte
 	return j;
 }
 
+
 //extract the journal in the local intern blocklist
 static void extract_descriptor_block(char *buf, journal_superblock_t *jsb,
 				  unsigned int *blockp, int blocksize,
@@ -797,3 +799,183 @@ errout:
 }
 
 
+
+//get a list of all copy of blockbitmap from journal
+int get_block_bitmap_list( journal_bitmap_tag_t **bitmap_list){
+	int 				count, sum, i, j;
+	char*				tag_buf = NULL;
+	journal_bitmap_tag_t 		*fill_pointer ;
+	journal_descriptor_tag_t 	*list_pointer = pt_buff ;
+	
+	count = sum = 0;
+	for (i = 0; i < pt_count ; i++, list_pointer++ )
+		for (j = 0 ; j < current_fs->group_desc_count; j++ )
+			if (list_pointer->f_blocknr == (blk64_t) current_fs->group_desc[j].bg_block_bitmap) count++ ;
+
+	if (count && (tag_buf = malloc((sizeof(journal_bitmap_tag_t) * count)))){
+		fill_pointer = (journal_bitmap_tag_t*)tag_buf ;
+		list_pointer = pt_buff ;
+		for ( i = 0 ; (i < pt_count && sum < count); i++ , list_pointer++ ) 
+			for ( j = 0; j < current_fs->group_desc_count; j++ )
+				if (list_pointer->f_blocknr == (blk64_t) current_fs->group_desc[j].bg_block_bitmap) {
+					fill_pointer->blockgroup = (blk64_t) j;
+					fill_pointer->j_blocknr = list_pointer->j_blocknr;
+					fill_pointer->transaction = list_pointer->transaction;
+					fill_pointer++ ;
+					sum++;
+				}
+
+	list_pointer = (journal_descriptor_tag_t*) tag_buf;
+	sort_block_list( list_pointer,sum );	
+	*bitmap_list = 	(journal_bitmap_tag_t*) tag_buf;
+	}
+return sum;
+}
+
+
+
+//create and init the the journal block bitmap
+//return the count of all blockbitmap copies or 0
+ int init_block_bitmap_list(ext2fs_block_bitmap *d_bmap, __u32 t_after){
+	__u32	t;  
+	jbbm.list = NULL;
+	jbbm.block_buf = NULL;
+
+	if (ext2fs_copy_bitmap(current_fs->block_map, d_bmap)){
+		fprintf(stderr,"Error: while duplicate bitmap\n");
+		return 0;
+	}
+	ext2fs_clear_block_bitmap(*d_bmap);
+
+	jbbm.count = get_block_bitmap_list( &jbbm.list);
+	jbbm.block_buf = malloc(current_fs->blocksize * 2);
+	if (! jbbm.block_buf){
+		fprintf(stderr,"Error: can't allocate Memory\n");
+		return 0;
+	}
+	if (jbbm.count){
+		jbbm.pointer = jbbm.list + jbbm.count - 1;
+//		jbbm.last_trans = jbbm.pointer->transaction;
+		jbbm.last_trans = 0;
+		jbbm.groups = current_fs->group_desc_count;	
+	
+		while ((jbbm.pointer > jbbm.list) && (get_trans_time(jbbm.pointer->transaction) >= t_after)) {
+			t = jbbm.pointer->transaction;
+			while (jbbm.pointer->transaction == t) 
+				jbbm.pointer-- ;
+		}
+		jbbm.pointer++;
+		jbbm.first_trans = jbbm.pointer->transaction ;
+		jbbm.pointer = jbbm.list + jbbm.count - 1;
+		jbbm.blocksize = current_fs->blocksize;
+		jbbm.blocklen = current_fs->super->s_blocks_per_group >> 3 ;
+		jbbm.last_blocklen = (current_fs->super->s_blocks_count >> 3) % jbbm.blocklen;
+		jbbm.last_blocklen += (current_fs->super->s_blocks_count % 8) ? 1 : 0 ;
+	}
+return jbbm.count;
+}
+
+
+
+//destroy the journal block bitmap 
+void clear_block_bitmap_list(ext2fs_block_bitmap d_bmap){
+	if (jbbm.list) 
+		free (jbbm.list);
+	if (jbbm.block_buf)
+		free (jbbm.block_buf);
+	jbbm.list = NULL;
+	jbbm.block_buf = NULL;
+	ext2fs_free_block_bitmap(d_bmap);
+}
+
+
+
+//produces a differential block bitmap for a transaction from the Journal
+//return 1 if bitmap is differenzial ; an 2 if bitmap is empty
+int next_block_bitmap(ext2fs_block_bitmap d_bmap){
+	struct ext2fs_struct_loc_generic_bitmap 	*fs_bitmap, *df_bitmap;
+	journal_bitmap_tag_t 				*p1;
+	journal_bitmap_tag_t 				*p2;
+	__u32						blockg, skip,i;
+	int						got,retval,len;
+	char						*diff_buf;
+
+	if (jbbm.pointer->transaction < jbbm.first_trans)
+		return 0;
+
+//	printf(" Transaction:  %u   ; Minimum ist %u \n", jbbm.pointer->transaction,jbbm.first_trans);
+
+	fs_bitmap = (struct ext2fs_struct_loc_generic_bitmap*) current_fs->block_map;
+	df_bitmap = (struct ext2fs_struct_loc_generic_bitmap*) d_bmap;
+	ext2fs_clear_block_bitmap(d_bmap);
+
+	if (jbbm.last_trans == 0 ){
+// last transaction compared with fs blockbitmap 
+		jbbm.last_trans = jbbm.pointer->transaction;
+		p2 = jbbm.pointer;
+		while ((p2 >= jbbm.list) && (p2->transaction == jbbm.pointer->transaction)){
+			blockg = (__u32)p2->blockgroup;
+			skip = (jbbm.blocklen * blockg);
+			len = ((blockg + 1) == jbbm.groups) ? jbbm.last_blocklen : jbbm.blocklen;
+
+			retval = read_journal_block((__u32)p2->j_blocknr * jbbm.blocksize, jbbm.block_buf, jbbm.blocksize, &got);
+			if (retval || got != jbbm.blocksize){
+				fprintf(stderr,"Error: while reading journal\n");
+				goto errout;
+			}
+
+			for (i = 0 ; i < len ; i++){
+				*((df_bitmap->bitmap)+skip+i) = *(jbbm.block_buf + i) ^ *((fs_bitmap->bitmap)+skip+i) ;
+			}
+		p2--;
+		}
+	}
+	else{
+
+//all other transactions compared with previous block copy
+		p1 = jbbm.pointer;
+		diff_buf = jbbm.block_buf + jbbm.blocksize ;
+
+		while ((p1->transaction >= jbbm.first_trans) && (p1->transaction == jbbm.pointer->transaction)){
+			p2 = p1 -1;
+			blockg = (__u32)p1->blockgroup;
+			skip = (jbbm.blocklen * blockg);
+			len = ((blockg + 1) == jbbm.groups) ? jbbm.last_blocklen : jbbm.blocklen;
+			while ((p2 > jbbm.list) && ((__u32)p2->blockgroup != blockg))
+				p2-- ;
+			retval = read_journal_block((__u32)p1->j_blocknr * jbbm.blocksize, jbbm.block_buf, jbbm.blocksize, &got);
+			if (retval || got != jbbm.blocksize){
+				fprintf(stderr,"Error: while reading journal\n");
+				goto errout;
+			}
+			if ((p2 == jbbm.list) && ((__u32)p2->blockgroup != blockg)){
+				//no previous block copy found, create difference to the entire block group
+				for (i = 0 ; i < len ; i++){
+					*((df_bitmap->bitmap)+skip+i) = *(jbbm.block_buf + i) ^ 0xFF ;
+				}
+			}
+			else{
+				retval = read_journal_block((__u32)p2->j_blocknr * jbbm.blocksize, diff_buf, jbbm.blocksize, &got);
+				if (retval || got != jbbm.blocksize){
+					fprintf(stderr,"Error: while reading journal\n");
+					goto errout;
+				}
+				//previous block copy is found, create difference to this copy
+				for (i = 0 ; i < len ; i++){
+					*((df_bitmap->bitmap)+skip+i) = *(jbbm.block_buf + i) ^ *(diff_buf + i ) ;
+				}
+			}
+			p1--;	
+		}
+		jbbm.pointer = p1;
+	}
+
+i = 0;
+while (! *((df_bitmap->bitmap)+i)) i++;
+return  ( i <= (fs_bitmap->real_end >> 3)) ? 1 : 2 ;
+
+errout:
+	return 0;
+}
+
+
diff --git a/src/journal.h b/src/journal.h
index c4bf5d3..9a05fbc 100644
--- a/src/journal.h
+++ b/src/journal.h
@@ -24,25 +24,53 @@
 //struct for cache the descriptor data
 typedef struct journal_descriptor_tag_s
 {
-	blk64_t		f_blocknr;	/* Tho od-disk block number */
+	blk64_t		f_blocknr;	/* The on-disk block number */
 	__u32		j_blocknr;	/* The on-journal block number */
 	__u32		transaction; 	/* Transaction Sequence*/
 } journal_descriptor_tag_t;
 
+//struct for cache the block bitmap data
+typedef struct journal_bitmap_tag_s
+{
+	blk64_t		blockgroup;	/* The blockgroup of bitmap */
+	__u32		j_blocknr;	/* The on-journal block number */
+	__u32		transaction;	/* Transaction Sequence*/
+} journal_bitmap_tag_t;
+
+
+struct j_bitmap_list_t
+{
+	int 			count;
+	journal_bitmap_tag_t 	*list;
+	__u32			groups;
+	__u32			first_trans;
+	__u32			last_trans;
+	journal_bitmap_tag_t 	*pointer;	
+	unsigned int 		blocksize ;
+	unsigned int 		blocklen ;
+	unsigned int 		last_blocklen ;
+	char*			block_buf;
+		
+};
 
 void dump_journal_superblock( void); //print journal superblock
 extern int journal_open(char* , int );// open an extract the blocklist from journal 
 extern int journal_close(void); // close the journal (last function in main() if the journal open)
 static int init_journal(void); // main for extract the journal to the local private data
 static const char *type_to_name(int);
-int get_block_list_count(blk64_t block);//get count of journal blocklist 
+int get_block_list_count(blk64_t);//get count of journal blocklist 
 __u32 get_trans_time( __u32); //get the transactiontime of a transactionnumber
-int get_block_list(journal_descriptor_tag_t *, blk64_t, int);//get a sortet list of all copys of a filesystemblock
+int get_block_list(journal_descriptor_tag_t*, blk64_t, int);//get a sortet list of all copys of a filesystemblock
 int read_journal_block(off_t, char*, int, unsigned int*);
 void print_block_list(int);
 int dump_journal_block( __u32 , int );
 void print_block_transaction(blk64_t,int);//print all transactions for a fs-block
 __u32 get_journal_blocknr(blk64_t, __u32);// get the last dir-block for transaction from journal or if not found the real block
 
+int get_last_block(char*,  blk_t*, __u32, __u32);// get the last dir-block for transaction from journal or if not, found the real block
+int get_block_bitmap_list( journal_bitmap_tag_t**);//get a list of all copies of blockbitmap from journal
+int init_block_bitmap_list(ext2fs_block_bitmap* , __u32); //create and init the the journal block bitmap
+void clear_block_bitmap_list(ext2fs_block_bitmap); //destroy the journal block bitmap
+int next_block_bitmap(ext2fs_block_bitmap); //produces a differential block bitmap for a transaction from the Journal
 
 #endif
\ No newline at end of file
diff --git a/src/magic.h b/src/magic.h
new file mode 100644
index 0000000..a664e9a
--- /dev/null
+++ b/src/magic.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) Christos Zoulas 2003.
+ * All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice immediately at the beginning of the file, without modification,
+ *    this list of conditions, and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef _MAGIC_H
+#define _MAGIC_H
+
+#include <sys/types.h>
+
+#define	MAGIC_NONE		0x000000 /* No flags */
+#define	MAGIC_DEBUG		0x000001 /* Turn on debugging */
+#define	MAGIC_SYMLINK		0x000002 /* Follow symlinks */
+#define	MAGIC_COMPRESS		0x000004 /* Check inside compressed files */
+#define	MAGIC_DEVICES		0x000008 /* Look at the contents of devices */
+#define	MAGIC_MIME_TYPE		0x000010 /* Return the MIME type */
+#define	MAGIC_CONTINUE		0x000020 /* Return all matches */
+#define	MAGIC_CHECK		0x000040 /* Print warnings to stderr */
+#define	MAGIC_PRESERVE_ATIME	0x000080 /* Restore access time on exit */
+#define	MAGIC_RAW		0x000100 /* Don't translate unprintable chars */
+#define	MAGIC_ERROR		0x000200 /* Handle ENOENT etc as real errors */
+#define	MAGIC_MIME_ENCODING	0x000400 /* Return the MIME encoding */
+#define MAGIC_MIME		(MAGIC_MIME_TYPE|MAGIC_MIME_ENCODING)
+#define	MAGIC_APPLE		0x000800 /* Return the Apple creator and type */
+#define	MAGIC_NO_CHECK_COMPRESS	0x001000 /* Don't check for compressed files */
+#define	MAGIC_NO_CHECK_TAR	0x002000 /* Don't check for tar files */
+#define	MAGIC_NO_CHECK_SOFT	0x004000 /* Don't check magic entries */
+#define	MAGIC_NO_CHECK_APPTYPE	0x008000 /* Don't check application type */
+#define	MAGIC_NO_CHECK_ELF	0x010000 /* Don't check for elf details */
+#define	MAGIC_NO_CHECK_TEXT	0x020000 /* Don't check for text files */
+#define	MAGIC_NO_CHECK_CDF	0x040000 /* Don't check for cdf files */
+#define	MAGIC_NO_CHECK_TOKENS	0x100000 /* Don't check tokens */
+#define MAGIC_NO_CHECK_ENCODING 0x200000 /* Don't check text encodings */
+
+/* Defined for backwards compatibility (renamed) */
+#define	MAGIC_NO_CHECK_ASCII	MAGIC_NO_CHECK_TEXT
+
+/* Defined for backwards compatibility; do nothing */
+#define	MAGIC_NO_CHECK_FORTRAN	0x000000 /* Don't check ascii/fortran */
+#define	MAGIC_NO_CHECK_TROFF	0x000000 /* Don't check ascii/troff */
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct magic_set *magic_t;
+magic_t magic_open(int);
+void magic_close(magic_t);
+
+const char *magic_file(magic_t, const char *);
+const char *magic_descriptor(magic_t, int);
+const char *magic_buffer(magic_t, const void *, size_t);
+
+const char *magic_error(magic_t);
+int magic_setflags(magic_t, int);
+
+int magic_load(magic_t, const char *);
+int magic_compile(magic_t, const char *);
+int magic_check(magic_t, const char *);
+int magic_errno(magic_t);
+
+#ifdef __cplusplus
+};
+#endif
+
+#endif /* _MAGIC_H */
diff --git a/src/magic_block_scan.c b/src/magic_block_scan.c
new file mode 100644
index 0000000..76792e7
--- /dev/null
+++ b/src/magic_block_scan.c
@@ -0,0 +1,96 @@
+/***************************************************************************
+ *   Copyright (C) 2010 by Roberto Maar                                    *
+ *   robi@users.berlios.de                                                 *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program; if not, write to the                         *
+ *   Free Software Foundation, Inc.,                                       *
+ *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                         *
+ *                                                                         *
+ *   C Implementation: magic_block_scan                                    * 
+ ***************************************************************************/
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <ctype.h>
+#include <string.h>
+
+#include "util.h"
+
+#include "magic.h"
+
+extern ext2_filsys     current_fs ;
+
+
+
+ext2fs_block_bitmap 	  	d_bmap = NULL ; 
+
+
+void magic_block_scan(char* des_dir, __u32 t_after){
+	int					 	retval;
+	blk_t  						blk, o_blk;
+	int 						ret, load_db;
+	struct 	ext2fs_struct_loc_generic_bitmap 	*ds_bmap;
+	char 						*block_buf = NULL;
+	magic_t 					cookie;
+	int						m_result;
+
+	cookie = magic_open(MAGIC_NO_CHECK_COMPRESS | MAGIC_NO_CHECK_ELF | MAGIC_NO_CHECK_TAR); 
+	if ((cookie) && (! magic_load(cookie, NULL))){
+
+		retval = init_block_bitmap_list(&d_bmap, t_after);
+		while (retval){
+			retval = next_block_bitmap(d_bmap);
+			if (retval == 2 ) 
+				continue;
+
+			if (d_bmap && retval ){
+
+				ds_bmap = (struct ext2fs_struct_loc_generic_bitmap *) d_bmap;
+				block_buf = malloc(current_fs->blocksize);
+				if (block_buf){
+					for (blk = ds_bmap->start; blk <ds_bmap->real_end; blk++){
+						if (! (blk & 0x7)){
+							o_blk = blk >> 3;
+							while ((! *(ds_bmap->bitmap + o_blk)) && (o_blk <= (ds_bmap->real_end >> 3)))  
+								o_blk ++;
+							blk = o_blk << 3;
+						}
+						if (blk >= ds_bmap->real_end)
+							break;
+//FIXME in work								
+						if (ext2fs_test_block_bitmap ( d_bmap, blk) && (! ext2fs_test_block_bitmap( bmap, blk))){
+							printf(" read block : %u\n",blk);	
+							ret = io_channel_read_blk ( current_fs->io,  blk,  1,  block_buf );
+							if (ret){
+								fprintf(stderr,"ERROR: while read block %10u\n",blk);
+							}
+							m_result = magic_check_block(block_buf,cookie,current_fs->blocksize,blk);
+						}
+
+					}
+					free(block_buf);
+				}
+				else
+					printf("can't allocate memory for blocksearch\n");
+			}
+			clear_block_bitmap_list(d_bmap);
+		}
+		if(cookie) magic_close(cookie);
+	}
+//FIXME only if needed
+if(d_bmap)
+	ext2fs_free_block_bitmap(d_bmap);
+
+}
diff --git a/src/recover.c b/src/recover.c
index 1ee390b..1a53d8e 100644
--- a/src/recover.c
+++ b/src/recover.c
@@ -158,9 +158,11 @@ return ;
 		return BLOCK_ERROR;
 	struct alloc_stat *stat = priv;
         if ( ext2fs_test_block_bitmap ( fs->block_map, *blocknr ))
-		(stat->allocated)++ ;
+		(stat->allocated)++ ;	
 	else
 		(stat->not_allocated)++ ;
+	if (bmap)
+		ext2fs_mark_generic_bitmap(bmap, *blocknr);
 return 0;
 }
 
diff --git a/src/util.h b/src/util.h
index 9551805..02216bf 100644
--- a/src/util.h
+++ b/src/util.h
@@ -76,8 +76,7 @@ struct inode_nr_collect{
 };
 
 
-//FIXME
-//struct for generic bitmap  (only temporarily for the development)
+//struct for generic bitmap 
 struct ext2fs_struct_loc_generic_bitmap {
         errcode_t       magic;
         ext2_filsys     fs;
@@ -125,7 +124,11 @@ int check_dir(char*);//check if the target directory existent
 
 
 //public functions imap_search.c
-void search_imap_inode(char* , __u32, __u32, int); // search inode by imap (step1 + step2)
+void imap_search(char* , __u32, __u32 ); // search inode by imap (step1 + step2)
 int check_find_dir(char*, ext2_ino_t, char*, char*); //check if the directory always recovert; then move
 
+
+//public functions magic_block_scan.c
+void magic_block_scan(char* , __u32);
+
 #endif