forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathntfs.go
51 lines (42 loc) · 1.14 KB
/
ntfs.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
package paths
import (
"errors"
"path/filepath"
"regexp"
"strings"
)
var (
// For convenience we transform paths like c:\Windows -> \\.\c:\Windows
driveRegex = regexp.MustCompile(
`(?i)^[/\\]?([a-z]:)(.*)`)
deviceDriveRegex = regexp.MustCompile(
`(?i)^(\\\\[\?\.]\\[a-zA-Z]:)(.*)`)
deviceDirectoryRegex = regexp.MustCompile(
`(?i)^(\\\\[\?\.]\\GLOBALROOT\\Device\\[^/\\]+)([/\\]?.*)`)
)
func GetDeviceAndSubpath(path string) (device string, subpath string, err error) {
// Make sure not to run filepath.Clean() because it will
// collapse multiple slashes (and prevent device names from
// being recognized).
path = strings.Replace(path, "/", "\\", -1)
m := deviceDriveRegex.FindStringSubmatch(path)
if len(m) != 0 {
return m[1], clean(m[2]), nil
}
m = driveRegex.FindStringSubmatch(path)
if len(m) != 0 {
return "\\\\.\\" + m[1], clean(m[2]), nil
}
m = deviceDirectoryRegex.FindStringSubmatch(path)
if len(m) != 0 {
return m[1], clean(m[2]), nil
}
return "/", path, errors.New("Unsupported device type")
}
func clean(path string) string {
result := filepath.Clean(path)
if result == "." {
result = ""
}
return result
}