Re: Decompress Recovered Compressed Sectors
Is there any way to harness the decompression ability of this driver to forcefully decompress a block of raw data?
In a compressed file, each block of 4K is compressed independently, so you should be able to interpret its contents. However if cluster size were smaller than 4K the blocks might be non-contiguous.
Now, to locate the beginning of a block, you have to search for a pattern 0xbn (>= 0xb0 and <= 0xbf) in the second byte of a cluster.
When you get such a block, you can decompress it by applying the function ntfs_decompress() from compress.c