Program.cs

using System;
using System.IO;
using System.Drawing;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using Microsoft.Win32.SafeHandles;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace DataCarverGUI
{
    public class FoundFile
    {
        public long Offset { get; set; }
        public string Type { get; set; }
        public string Name { get; set; }
        public string Size { get; set; }
    }

    public class MainForm : Form
    {
        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern SafeFileHandle CreateFile(string lpFileName, uint dwDesiredAccess, uint dwShareMode, IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTemplateFile);

        [StructLayout(LayoutKind.Sequential)]
        public struct NTFS_VOLUME_DATA_BUFFER {
            public long VolumeSerialNumber;
            public long NumberSectors;
            public long TotalClusters;
            public long FreeClusters;
            public long TotalReserved;
            public uint BytesPerSector;
            public uint BytesPerCluster;
            public uint BytesPerFileRecordSegment;
            public uint ClustersPerFileRecordSegment;
            public long MftValidDataLength;
            public long MftStartLcn;
            public long Mft2StartLcn;
            public long MftZoneStart;
            public long MftZoneEnd;
        }

        [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
        public static extern bool DeviceIoControl(SafeFileHandle hDevice, uint dwIoControlCode, IntPtr lpInBuffer, int nInBufferSize, out NTFS_VOLUME_DATA_BUFFER lpOutBuffer, int nOutBufferSize, out int lpBytesReturned, IntPtr lpOverlapped);

        [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
        public static extern bool DeviceIoControl(SafeFileHandle hDevice, uint dwIoControlCode, ref long lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, out int lpBytesReturned, IntPtr lpOverlapped);

        [DllImport("kernel32.dll", ExactSpelling = true, SetLastError = true)]
        public static extern bool DeviceIoControl(SafeFileHandle hDevice, uint dwIoControlCode, IntPtr lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, out int lpBytesReturned, IntPtr lpOverlapped);

        [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool GetDiskFreeSpace(string lpRootPathName, out uint lpSectorsPerCluster, out uint lpBytesPerSector, out uint lpNumberOfFreeClusters, out uint lpTotalNumberOfClusters);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool ReadFile(SafeFileHandle hFile, byte[] lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, IntPtr lpOverlapped);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteFile(SafeFileHandle hFile, byte[] lpBuffer, uint nNumberOfBytesToWrite, out uint lpNumberOfBytesWritten, IntPtr lpOverlapped);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool SetFilePointerEx(SafeFileHandle hFile, long liDistanceToMove, out long lpNewFilePointer, uint dwMoveMethod);

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool FlushFileBuffers(SafeFileHandle hFile);

        const uint GENERIC_READ = 0x80000000;
        const uint GENERIC_WRITE = 0x40000000;
        const uint FILE_SHARE_READ = 0x00000001;
        const uint FILE_SHARE_WRITE = 0x00000002;
        const uint OPEN_EXISTING = 3;
        const uint FSCTL_GET_VOLUME_BITMAP = 0x0009003F;
        const uint FSCTL_LOCK_VOLUME = 0x00090018;
        const uint FSCTL_UNLOCK_VOLUME = 0x0009001C;

        static readonly byte[] JpegSignature = { 0xFF, 0xD8, 0xFF };
        static readonly byte[] PdfSignature = { 0x25, 0x50, 0x44, 0x46 };
        static readonly byte[] PngSignature = { 0x89, 0x50, 0x4E, 0x47 };
        static readonly byte[] RiffSignature = { 0x52, 0x49, 0x46, 0x46 }; // RIFF
        static readonly byte[] WebpIdentifier = { 0x57, 0x45, 0x42, 0x50 }; // WEBP
        static readonly byte[] ZipSignature = { 0x50, 0x4B, 0x03, 0x04 };
        static readonly byte[] RarSignature = { 0x52, 0x61, 0x72, 0x21, 0x1A, 0x07 };
        static readonly byte[] ExeSignature = { 0x4D, 0x5A };
        static readonly byte[] Mp3Signature = { 0x49, 0x44, 0x33 };
        static readonly byte[] Mp4Signature = { 0x66, 0x74, 0x79, 0x70 }; // Offset by 4 bytes usually
        static readonly byte[] AviSignature = { 0x41, 0x56, 0x49, 0x20 }; // Used with RIFF
        static readonly byte[] GifSignature = { 0x47, 0x49, 0x46, 0x38 };
        static readonly byte[] BmpSignature = { 0x42, 0x4D };
        static readonly byte[] WavSignature = { 0x57, 0x41, 0x56, 0x45 }; // Used with RIFF
        static readonly byte[] RtfSignature = { 0x7B, 0x5C, 0x72, 0x74, 0x66 };
        static readonly byte[] SqliteSignature = { 0x53, 0x51, 0x4C, 0x69, 0x74, 0x65, 0x20, 0x66, 0x6F, 0x72, 0x6D, 0x61, 0x74, 0x20, 0x33, 0x00 };
        static readonly byte[] GzipSignature = { 0x1F, 0x8B, 0x08 };
        static readonly byte[] SevenZipSignature = { 0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C };
        static readonly byte[] ElfSignature = { 0x7F, 0x45, 0x4C, 0x46 };
        static readonly byte[] ClassSignature = { 0xCA, 0xFE, 0xBA, 0xBE };
        static readonly byte[] PsdSignature = { 0x38, 0x42, 0x50, 0x53 };
        static readonly byte[] OggSignature = { 0x4F, 0x67, 0x67, 0x53 };
        static readonly byte[] FlacSignature = { 0x66, 0x4C, 0x61, 0x43 };
        static readonly byte[] TarSignature    = { 0x75, 0x73, 0x74, 0x61, 0x72 }; // "ustar", at offset 257

        // ── New widely-used formats ──────────────────────────────────────────────
        // Documents / Office
        static readonly byte[] OleSignature    = { 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1 }; // OLE2: DOC/XLS/PPT/MSG
        // Video
        static readonly byte[] EbmlSignature   = { 0x1A, 0x45, 0xDF, 0xA3 };          // MKV / WebM
        static readonly byte[] FlvSignature    = { 0x46, 0x4C, 0x56, 0x01 };          // Flash Video
        static readonly byte[] SwfFSignature   = { 0x46, 0x57, 0x53 };                // SWF uncompressed (FWS)
        static readonly byte[] SwfCSignature   = { 0x43, 0x57, 0x53 };                // SWF zlib (CWS)
        static readonly byte[] SwfZSignature   = { 0x5A, 0x57, 0x53 };                // SWF lzma (ZWS)
        // Images
        static readonly byte[] TiffLeSignature = { 0x49, 0x49, 0x2A, 0x00 };          // TIFF little-endian
        static readonly byte[] TiffBeSignature = { 0x4D, 0x4D, 0x00, 0x2A };          // TIFF big-endian
        // Audio
        static readonly byte[] AiffIdentifier  = { 0x41, 0x49, 0x46, 0x46 };          // "AIFF" at offset 8 in a FORM container
        static readonly byte[] FormSignature   = { 0x46, 0x4F, 0x52, 0x4D };          // IFF FORM container (used for AIFF)
        // Archives / Compression
        static readonly byte[] Bzip2Signature  = { 0x42, 0x5A, 0x68 };                // bzip2 "BZh"
        static readonly byte[] XzSignature     = { 0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00 }; // XZ
        static readonly byte[] CabSignature    = { 0x4D, 0x53, 0x43, 0x46 };          // Windows Cabinet "MSCF"
        // Email / Contacts
        static readonly byte[] PstSignature    = { 0x21, 0x42, 0x44, 0x4E };          // Outlook PST/OST "!BDN"
        // Fonts
        static readonly byte[] TtfSignature    = { 0x00, 0x01, 0x00, 0x00 };          // TrueType Font
        static readonly byte[] OtfSignature    = { 0x4F, 0x54, 0x54, 0x4F };          // OpenType Font "OTTO"
        static readonly byte[] WoffSignature   = { 0x77, 0x4F, 0x46, 0x46 };          // WOFF "wOFF"
        static readonly byte[] Woff2Signature  = { 0x77, 0x4F, 0x46, 0x32 };          // WOFF2 "wOF2"
        // Mobile / Executables
        static readonly byte[] DexSignature    = { 0x64, 0x65, 0x78, 0x0A };          // Android DEX "dex\n"
        static readonly byte[] MachoLeSignature  = { 0xCE, 0xFA, 0xED, 0xFE };        // Mach-O 32-bit LE
        static readonly byte[] Macho64LeSignature = { 0xCF, 0xFA, 0xED, 0xFE };       // Mach-O 64-bit LE
        // Virtual Machine Disks
        static readonly byte[] VmdkSignature   = { 0x4B, 0x44, 0x4D, 0x56 };          // VMware VMDK sparse "KDMV"
        static readonly byte[] Qcow2Signature  = { 0x51, 0x46, 0x49, 0xFB };          // QEMU QCOW2 "QFI\xFB"
        // Windows artifacts
        static readonly byte[] LnkSignature    = { 0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00 }; // Windows Shell Link (.lnk)

        static readonly byte[] PngEof = { 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82 };
        static readonly byte[] PdfEof = { 0x25, 0x25, 0x45, 0x4F, 0x46 };

        // ── Dark-theme color palette ──────────────────────────────────────────
        static readonly Color DarkBg      = Color.FromArgb(25,  25,  25);
        static readonly Color DarkSurface = Color.FromArgb(38,  38,  40);
        static readonly Color DarkControl = Color.FromArgb(55,  55,  58);
        static readonly Color DarkBorder  = Color.FromArgb(65,  65,  68);
        static readonly Color AccentBlue  = Color.FromArgb(0,  120, 215);
        static readonly Color AccentGreen = Color.FromArgb(35, 160,  65);
        static readonly Color DangerRed   = Color.FromArgb(190,  40,  40);
        static readonly Color TextPrimary = Color.FromArgb(220, 220, 220);
        static readonly Color TextMuted   = Color.FromArgb(130, 130, 135);

        // Describes a recoverable file type: the magic bytes and the byte offset
        // within the file where they appear (0 for most types, 257 for TAR, 4 for MP4).
        struct FileSignature
        {
            public readonly string Type;
            public readonly byte[] Magic;
            public readonly int    HeaderOffset; // offset within the file where Magic appears

            public FileSignature(string type, byte[] magic, int headerOffset = 0)
            { Type = type; Magic = magic; HeaderOffset = headerOffset; }
        }

        // All supported types. Longer / more-specific signatures are listed first so that
        // the per-first-byte lists are already ordered from most- to least-specific.
        static readonly FileSignature[] Signatures =
        {
            new FileSignature("jpg",    JpegSignature),
            new FileSignature("zip",    ZipSignature),
            new FileSignature("pdf",    PdfSignature),
            new FileSignature("png",    PngSignature),
            new FileSignature("sqlite", SqliteSignature),
            new FileSignature("rar",    RarSignature),
            new FileSignature("7z",     SevenZipSignature),
            new FileSignature("gif",    GifSignature),
            new FileSignature("psd",    PsdSignature),
            new FileSignature("elf",    ElfSignature),
            new FileSignature("ogg",    OggSignature),
            new FileSignature("flac",   FlacSignature),
            new FileSignature("class",  ClassSignature),
            new FileSignature("rtf",    RtfSignature),
            new FileSignature("gz",     GzipSignature),
            new FileSignature("mp3",    Mp3Signature),
            new FileSignature("bmp",    BmpSignature),
            new FileSignature("exe",    ExeSignature),
            new FileSignature("riff",   RiffSignature),          // subtype resolved at scan time
            new FileSignature("mp4",    Mp4Signature,       4),  // ftyp box starts at byte 4
            new FileSignature("tar",    TarSignature,     257),  // "ustar" appears at offset 257
            // New widely-used formats
            new FileSignature("ole2",   OleSignature),           // DOC / XLS / PPT / MSG (OLE2)
            new FileSignature("mkv",    EbmlSignature),          // Matroska / WebM
            new FileSignature("tiff",   TiffLeSignature),        // TIFF (little-endian)
            new FileSignature("tiff",   TiffBeSignature),        // TIFF (big-endian)
            new FileSignature("flv",    FlvSignature),           // Flash Video
            new FileSignature("swf",    SwfFSignature),          // SWF uncompressed
            new FileSignature("swf",    SwfCSignature),          // SWF zlib-compressed
            new FileSignature("swf",    SwfZSignature),          // SWF LZMA-compressed
            new FileSignature("bz2",    Bzip2Signature),         // bzip2
            new FileSignature("xz",     XzSignature),            // XZ
            new FileSignature("cab",    CabSignature),           // Windows Cabinet
            new FileSignature("pst",    PstSignature),           // Outlook PST / OST
            new FileSignature("ttf",    TtfSignature),           // TrueType Font
            new FileSignature("otf",    OtfSignature),           // OpenType Font
            new FileSignature("woff",   WoffSignature),          // WOFF web font
            new FileSignature("woff2",  Woff2Signature),         // WOFF2 web font
            new FileSignature("dex",    DexSignature),           // Android DEX
            new FileSignature("macho",  MachoLeSignature),       // Mach-O 32-bit LE
            new FileSignature("macho",  Macho64LeSignature),     // Mach-O 64-bit LE
            new FileSignature("vmdk",   VmdkSignature),          // VMware VMDK sparse
            new FileSignature("qcow2",  Qcow2Signature),         // QEMU QCOW2
            new FileSignature("lnk",    LnkSignature),           // Windows Shell Link
            new FileSignature("aiff",   AiffIdentifier,     8),  // AIFF: "AIFF" at offset 8 in FORM container
        };

        // Groups signatures by their first magic byte for O(1) per-byte dispatch.
        // Built once at class load time; never mutated, so thread-safe for reads.
        static readonly Dictionary<byte, List<FileSignature>> SigsByFirstByte;

        static MainForm()
        {
            SigsByFirstByte = new Dictionary<byte, List<FileSignature>>();
            foreach (FileSignature sig in Signatures)
            {
                byte key = sig.Magic[0];
                List<FileSignature> bucket;
                if (!SigsByFirstByte.TryGetValue(key, out bucket))
                {
                    bucket = new List<FileSignature>();
                    SigsByFirstByte[key] = bucket;
                }
                bucket.Add(sig);
            }
        }

        TabControl tabControl;
        TabPage carverTab;
        TabPage browserTab;
        TabPage cleanerTab;

        ComboBox driveCombo;
        Button scanBtn;
        ComboBox typeFilterCombo;
        ListView resultsListView;
        Button prevPageBtn;
        Button nextPageBtn;
        Label pageLabel;
        PictureBox previewBox;
        Button restoreBtn;
        Label statusLabel;

        TextBox pathBox;
        Button loadDirBtn;
        ListBox existingFilesList;
        PictureBox browserPreviewBox;
        
        ComboBox cleanerDriveCombo;
        Button cleanBtn;
        Label cleanerStatusLabel;

        NumericUpDown scanCacheNumeric;
        NumericUpDown cleanCacheNumeric;
        ProgressBar scanProgressBar;
        Label foundCountLabel;
        Button openFolderBtn;

        volatile bool _scanning = false;
        volatile bool _cleaning = false;
        long _cleanedCount = 0;
        List<FoundFile> allFoundFiles = new List<FoundFile>();
        HashSet<string> knownTypes = new HashSet<string>();
        HashSet<long> knownOffsets = new HashSet<long>();
        int currentPage = 1;
        int pageSize = 1000;
        object listLock = new object();
        System.Windows.Forms.Timer uiUpdateTimer;
        int lastUpdatedCount = 0;
        
        public MainForm()
        {
            Text = "Data Carver";
            Size = new Size(1100, 720);
            MinimumSize = new Size(900, 560);
            StartPosition = FormStartPosition.CenterScreen;
            BackColor = DarkBg;
            try { Icon = new Icon("logo.ico"); } catch {}

            tabControl = new TabControl { Dock = DockStyle.Fill, BackColor = DarkSurface };
            carverTab = new TabPage("Raw Disk Carver") { BackColor = DarkSurface };
            browserTab = new TabPage("Test Normal Files") { BackColor = DarkSurface };
            cleanerTab = new TabPage("Data Cleaner") { BackColor = DarkSurface };

            tabControl.TabPages.Add(carverTab);
            tabControl.TabPages.Add(browserTab);
            tabControl.TabPages.Add(cleanerTab);
            Controls.Add(tabControl);

            InitializeCarverTab();
            InitializeBrowserTab();
            InitializeCleanerTab();
            CheckAdmin();
        }

        private void InitializeCarverTab()
        {
            // ── Top toolbar ───────────────────────────────────────────────────────
            var toolbar = new Panel { Dock = DockStyle.Top, Height = 88, BackColor = DarkSurface };

            driveCombo = new ComboBox {
                Location = new Point(10, 10), Width = 82,
                DropDownStyle = ComboBoxStyle.DropDownList,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat
            };
            foreach (var di in DriveInfo.GetDrives())
                driveCombo.Items.Add(di.Name.Substring(0, 1));
            if (driveCombo.Items.Count > 0) driveCombo.SelectedIndex = 0;

            scanBtn = new Button {
                Text = "Scan Drive", Location = new Point(102, 8), Width = 115, Height = 28,
                BackColor = AccentBlue, ForeColor = Color.White,
                FlatStyle = FlatStyle.Flat, Font = new Font("Segoe UI", 9, FontStyle.Bold)
            };
            scanBtn.FlatAppearance.BorderSize = 0;
            scanBtn.Click += ScanBtn_Click;

            var cacheLabel = new Label {
                Location = new Point(226, 14), Width = 72, Text = "Cache (MB):",
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 9)
            };
            scanCacheNumeric = new NumericUpDown {
                Location = new Point(300, 10), Width = 62, Minimum = 1, Maximum = 1024, Value = 8,
                BackColor = DarkControl, ForeColor = TextPrimary
            };

            statusLabel = new Label {
                Location = new Point(374, 13), Width = 680, Height = 22,
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 9),
                Text = "Ready.  Run as Administrator to scan raw volumes."
            };
            statusLabel.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;

            // Row 2: filter + found count
            var filterLabel = new Label {
                Location = new Point(10, 47), Width = 52, Text = "Filter:",
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 9)
            };
            typeFilterCombo = new ComboBox {
                Location = new Point(62, 44), Width = 138,
                DropDownStyle = ComboBoxStyle.DropDownList,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat
            };
            typeFilterCombo.Items.Add("All");
            typeFilterCombo.SelectedIndex = 0;
            typeFilterCombo.SelectedIndexChanged += TypeFilterCombo_SelectedIndexChanged;

            foundCountLabel = new Label {
                Location = new Point(210, 47), Width = 840, Height = 20, Text = "",
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 9)
            };
            foundCountLabel.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;

            // Thin progress strip
            scanProgressBar = new ProgressBar {
                Location = new Point(0, 82), Height = 5, Width = 1060,
                Style = ProgressBarStyle.Marquee, MarqueeAnimationSpeed = 0,
                BackColor = DarkBorder
            };
            scanProgressBar.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;

            toolbar.Controls.AddRange(new Control[] {
                driveCombo, scanBtn, cacheLabel, scanCacheNumeric, statusLabel,
                filterLabel, typeFilterCombo, foundCountLabel, scanProgressBar
            });

            // ── Bottom action bar ─────────────────────────────────────────────────
            var actionBar = new Panel { Dock = DockStyle.Bottom, Height = 44, BackColor = DarkSurface };
            var sep = new Panel { Dock = DockStyle.Top, Height = 1, BackColor = DarkBorder };
            actionBar.Controls.Add(sep);

            restoreBtn = new Button {
                Text = "Restore Selected", Location = new Point(10, 8), Width = 148, Height = 28,
                BackColor = AccentBlue, ForeColor = Color.White,
                FlatStyle = FlatStyle.Flat, Font = new Font("Segoe UI", 9, FontStyle.Bold)
            };
            restoreBtn.FlatAppearance.BorderSize = 0;
            restoreBtn.Click += RestoreBtn_Click;

            openFolderBtn = new Button {
                Text = "Open Recovery Folder", Location = new Point(166, 8), Width = 162, Height = 28,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat,
                Font = new Font("Segoe UI", 9)
            };
            openFolderBtn.FlatAppearance.BorderColor = DarkBorder;
            openFolderBtn.FlatAppearance.BorderSize = 1;
            openFolderBtn.Click += (s, e) => {
                string folder = Path.Combine(Environment.CurrentDirectory, "RecoveredFiles");
                if (!Directory.Exists(folder)) Directory.CreateDirectory(folder);
                System.Diagnostics.Process.Start("explorer.exe", folder);
            };

            prevPageBtn = new Button {
                Text = "◀", Location = new Point(338, 8), Width = 32, Height = 28,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat
            };
            prevPageBtn.FlatAppearance.BorderSize = 0;
            prevPageBtn.Click += PrevPageBtn_Click;

            pageLabel = new Label {
                Location = new Point(374, 13), Width = 110, Text = "Page 1 / 1",
                ForeColor = TextMuted, BackColor = Color.Transparent,
                Font = new Font("Segoe UI", 9), TextAlign = ContentAlignment.MiddleCenter
            };

            nextPageBtn = new Button {
                Text = "▶", Location = new Point(488, 8), Width = 32, Height = 28,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat
            };
            nextPageBtn.FlatAppearance.BorderSize = 0;
            nextPageBtn.Click += NextPageBtn_Click;

            actionBar.Controls.AddRange(new Control[] {
                restoreBtn, openFolderBtn, prevPageBtn, pageLabel, nextPageBtn
            });

            // ── Main split: list (left) | preview (right) ─────────────────────────
            var mainSplit = new SplitContainer {
                Dock = DockStyle.Fill,
                BackColor = DarkBg, SplitterWidth = 4
            };
            mainSplit.Panel1.BackColor = DarkBg;
            mainSplit.Panel2.BackColor = DarkBg;

            resultsListView = new ListView {
                Dock = DockStyle.Fill, View = View.Details,
                FullRowSelect = true, GridLines = false,
                BackColor = Color.FromArgb(30, 30, 32), ForeColor = TextPrimary,
                BorderStyle = BorderStyle.None,
                Font = new Font("Consolas", 9),
                HeaderStyle = ColumnHeaderStyle.Nonclickable
            };
            resultsListView.Columns.Add("Offset", 92);
            resultsListView.Columns.Add("Type", 58);
            resultsListView.Columns.Add("Name", 178);
            resultsListView.Columns.Add("Size", 65);
            resultsListView.SelectedIndexChanged += ResultsListView_SelectedIndexChanged;
            mainSplit.Panel1.Controls.Add(resultsListView);

            previewBox = new PictureBox {
                Dock = DockStyle.Fill, SizeMode = PictureBoxSizeMode.Zoom,
                BackColor = DarkBg
            };
            mainSplit.Panel2.Controls.Add(previewBox);

            uiUpdateTimer = new System.Windows.Forms.Timer { Interval = 1000 };
            uiUpdateTimer.Tick += UiUpdateTimer_Tick;

            // Dock order matters: Fill must be added last
            carverTab.Controls.Add(mainSplit);
            carverTab.Controls.Add(actionBar);
            carverTab.Controls.Add(toolbar);
            this.Load += (s, e) => {
                mainSplit.Panel1MinSize = 240;
                mainSplit.Panel2MinSize = 380;
                mainSplit.SplitterDistance = 420;
            };
        }

        private void TypeFilterCombo_SelectedIndexChanged(object sender, EventArgs e)
        {
            lock (listLock) {
                currentPage = 1;
                UpdateListView();
            }
        }

        private void UiUpdateTimer_Tick(object sender, EventArgs e)
        {
            lock (listLock) {
                if (allFoundFiles.Count != lastUpdatedCount) {
                    lastUpdatedCount = allFoundFiles.Count;
                    UpdateListView();
                }
            }
        }

        private Color GetTypeRowColor(string type)
        {
            switch (type)
            {
                case "jpg": case "png": case "gif": case "bmp": case "tiff":
                case "psd": case "webp":
                    return Color.FromArgb(0, 48, 62);        // teal – images
                case "mp4": case "mkv": case "avi": case "flv": case "swf":
                    return Color.FromArgb(0, 34, 72);        // blue – video
                case "mp3": case "wav": case "ogg": case "flac": case "aiff":
                    return Color.FromArgb(52, 0, 72);        // purple – audio
                case "zip": case "rar": case "7z": case "gz": case "bz2":
                case "xz": case "cab": case "tar":
                    return Color.FromArgb(62, 40, 0);        // amber – archives
                case "pdf": case "docx": case "xlsx": case "ole2": case "rtf": case "pst":
                    return Color.FromArgb(58, 52, 0);        // gold – documents
                case "exe": case "elf": case "macho": case "dex": case "class":
                    return Color.FromArgb(66, 10, 10);       // red – executables
                case "sqlite": case "vmdk": case "qcow2":
                    return Color.FromArgb(0, 52, 18);        // green – data/disk
                case "lnk": case "ttf": case "otf": case "woff": case "woff2":
                    return Color.FromArgb(42, 28, 56);       // indigo – system/fonts
                default:
                    return Color.FromArgb(36, 36, 38);
            }
        }

        private void UpdateListView()
        {
            string filter = typeFilterCombo.SelectedItem != null ? typeFilterCombo.SelectedItem.ToString() : "All";

            foreach (var t in knownTypes) {
                if (!typeFilterCombo.Items.Contains(t))
                    typeFilterCombo.Items.Add(t);
            }

            var filteredFiles = filter == "All" ? allFoundFiles : allFoundFiles.Where(f => f.Type == filter).ToList();

            int totalPages = (filteredFiles.Count + pageSize - 1) / pageSize;
            if (totalPages == 0) totalPages = 1;
            if (currentPage > totalPages) currentPage = totalPages;

            pageLabel.Text = string.Format("Page {0} / {1}", currentPage, totalPages);

            int start = (currentPage - 1) * pageSize;
            int numItems = Math.Min(pageSize, filteredFiles.Count - start);

            resultsListView.BeginUpdate();
            resultsListView.Items.Clear();
            for (int i = 0; i < numItems; i++)
            {
                var f = filteredFiles[start + i];
                var item = new ListViewItem(f.Offset.ToString());
                item.SubItems.Add(f.Type);
                item.SubItems.Add(f.Name);
                item.SubItems.Add(f.Size);
                item.Tag = f;
                item.BackColor = GetTypeRowColor(f.Type);
                item.ForeColor = TextPrimary;
                resultsListView.Items.Add(item);
            }
            resultsListView.EndUpdate();

            // Update found-count summary
            if (foundCountLabel != null)
            {
                var topTypes = allFoundFiles
                    .GroupBy(f => f.Type)
                    .OrderByDescending(g => g.Count())
                    .Take(7)
                    .Select(g => string.Format("{0}:{1}", g.Key, g.Count()));
                foundCountLabel.Text = string.Format(
                    "Found: {0:N0}  |  {1}", allFoundFiles.Count, string.Join("   ", topTypes));
            }

            if (_scanning)
                statusLabel.Text = string.Format("Scanning… {0:N0} files found so far.", allFoundFiles.Count);
        }

        private void PrevPageBtn_Click(object sender, EventArgs e) {
            lock (listLock) {
                if (currentPage > 1) { currentPage--; UpdateListView(); }
            }
        }

        private void NextPageBtn_Click(object sender, EventArgs e) {
            lock (listLock) {
                string filter = typeFilterCombo.SelectedItem != null ? typeFilterCombo.SelectedItem.ToString() : "All";
                int count = filter == "All" ? allFoundFiles.Count : allFoundFiles.Count(f => f.Type == filter);
                int totalPages = (count + pageSize - 1) / pageSize;
                if (currentPage < totalPages) { currentPage++; UpdateListView(); }
            }
        }

        private void InitializeBrowserTab()
        {
            var topBar = new Panel { Dock = DockStyle.Top, Height = 44, BackColor = DarkSurface };

            pathBox = new TextBox {
                Location = new Point(10, 10), Height = 24, Text = "C:\\",
                BackColor = DarkControl, ForeColor = TextPrimary,
                BorderStyle = BorderStyle.FixedSingle, Font = new Font("Segoe UI", 9)
            };
            pathBox.Anchor = AnchorStyles.Top | AnchorStyles.Left | AnchorStyles.Right;
            pathBox.Width = 870;

            loadDirBtn = new Button {
                Text = "Load Folder", Location = new Point(888, 8), Width = 110, Height = 28,
                BackColor = AccentBlue, ForeColor = Color.White,
                FlatStyle = FlatStyle.Flat, Font = new Font("Segoe UI", 9, FontStyle.Bold)
            };
            loadDirBtn.FlatAppearance.BorderSize = 0;
            loadDirBtn.Anchor = AnchorStyles.Top | AnchorStyles.Right;
            loadDirBtn.Click += LoadDirBtn_Click;

            topBar.Controls.Add(pathBox);
            topBar.Controls.Add(loadDirBtn);

            var browserSplit = new SplitContainer {
                Dock = DockStyle.Fill,
                BackColor = DarkBg, SplitterWidth = 4
            };
            browserSplit.Panel1.BackColor = DarkBg;
            browserSplit.Panel2.BackColor = DarkBg;

            existingFilesList = new ListBox {
                Dock = DockStyle.Fill,
                BackColor = Color.FromArgb(30, 30, 32), ForeColor = TextPrimary,
                BorderStyle = BorderStyle.None, Font = new Font("Segoe UI", 9)
            };
            existingFilesList.SelectedIndexChanged += ExistingFilesList_SelectedIndexChanged;
            browserSplit.Panel1.Controls.Add(existingFilesList);

            browserPreviewBox = new PictureBox {
                Dock = DockStyle.Fill, SizeMode = PictureBoxSizeMode.Zoom,
                BackColor = DarkBg
            };
            browserSplit.Panel2.Controls.Add(browserPreviewBox);

            browserTab.Controls.Add(browserSplit);
            browserTab.Controls.Add(topBar);
            this.Load += (s, e) => {
                browserSplit.Panel1MinSize = 200;
                browserSplit.Panel2MinSize = 300;
                browserSplit.SplitterDistance = 380;
            };
        }

        private void CheckAdmin()
        {
            bool isAdmin;
            using (var identity = WindowsIdentity.GetCurrent())
                isAdmin = new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator);
            if (!isAdmin)
            {
                statusLabel.Text = "⚠  Not running as Administrator — raw disk scanning will fail.";
                statusLabel.ForeColor = Color.FromArgb(255, 155, 50);
            }
        }

        private void LoadDirBtn_Click(object sender, EventArgs e)
        {
            existingFilesList.Items.Clear();
            try {
                string[] files = Directory.GetFiles(pathBox.Text);
                foreach(string file in files) {
                    string ext = Path.GetExtension(file).ToLower();
                    if (ext == ".jpg" || ext == ".jpeg" || ext == ".png" || ext == ".webp") {
                        existingFilesList.Items.Add(file);
                    }
                }
            } catch (Exception ex) {
                MessageBox.Show("Error loading directory: " + ex.Message);
            }
        }
        
        private Image CreatePlaceholderMessage(string message) {
            Bitmap bmp = new Bitmap(620, 500);
            using (Graphics g = Graphics.FromImage(bmp)) {
                g.Clear(DarkBg);
                g.TextRenderingHint = System.Drawing.Text.TextRenderingHint.ClearTypeGridFit;
                using (var brush = new SolidBrush(TextMuted))
                using (var font  = new Font("Segoe UI", 11))
                    g.DrawString(message, font, brush, new RectangleF(30, 120, 560, 300));
            }
            return bmp;
        }

        private void ExistingFilesList_SelectedIndexChanged(object sender, EventArgs e)
        {
            if (existingFilesList.SelectedItem != null)
            {
                string filePath = existingFilesList.SelectedItem.ToString();
                try {
                    // Check if it's actually WEBP disguised as JPG
                    byte[] header = new byte[12];
                    using (FileStream fs = new FileStream(filePath, FileMode.Open, FileAccess.Read)) {
                        fs.Read(header, 0, 12);
                    }
                    if (Match(header, 0, RiffSignature) && Match(header, 8, WebpIdentifier)) {
                        Image old = browserPreviewBox.Image;
                        browserPreviewBox.Image = CreatePlaceholderMessage("WebP Compression Detected.\n\nBuilt-in Windows GDI+ component cannot visually render WebP.\n(A modern web browser opens it fine, but this app is lightweight).\n\nIf you carve this format from raw disk, you CAN restore it perfectly though!");
                        if (old != null) old.Dispose();
                        return;
                    }

                    Image img = Image.FromFile(filePath);
                    Image oldImg = browserPreviewBox.Image;
                    browserPreviewBox.Image = (Image)img.Clone();
                    img.Dispose();
                    if (oldImg != null) oldImg.Dispose();
                } catch {
                    browserPreviewBox.Image = CreatePlaceholderMessage("Format currently unsupported or decoding failed."); 
                }
            }
        }

        private void ScanBtn_Click(object sender, EventArgs e)
        {
            if (_scanning) {
                _scanning = false;
                scanBtn.Text = "Stopping...";
                return;
            }

            if (driveCombo.SelectedItem == null) return;
            string drive = driveCombo.SelectedItem.ToString();
            string volumePath = "\\\\.\\" + drive + ":";

            allFoundFiles.Clear();
            knownTypes.Clear();
            knownOffsets.Clear();
            lastUpdatedCount = 0;
            currentPage = 1;
            resultsListView.Items.Clear();
            typeFilterCombo.Items.Clear();
            typeFilterCombo.Items.Add("All");
            typeFilterCombo.SelectedIndex = 0;
            uiUpdateTimer.Start();
            
            _scanning = true;
            scanBtn.Text = "Stop Scan";
            statusLabel.Text = "Scanning " + volumePath + "…";
            statusLabel.ForeColor = TextPrimary;
            scanProgressBar.MarqueeAnimationSpeed = 25;

            int cacheSizeMB = (int)scanCacheNumeric.Value;

            ThreadPool.QueueUserWorkItem((state) => {
                ScanDisk(volumePath, cacheSizeMB);
            });
        }

        private void ProcessBuffer(byte[] buffer, int length, long baseOffset)
        {
            int numThreads = Environment.ProcessorCount;
            if (numThreads < 1) numThreads = 1;
            int chunkSize = length / numThreads;
            // Safety margin: longest magic sequence is SQLite at 16 bytes.
            const int safetyMargin = 16;

            Parallel.For(0, numThreads, t =>
            {
                int start = t * chunkSize;
                int end = (t == numThreads - 1) ? length - safetyMargin : start + chunkSize;

                for (int i = start; i < end; i++)
                {
                    if (!_scanning) break;

                    // Fast dispatch: skip bytes whose value doesn't start any signature.
                    List<FileSignature> candidates;
                    if (!SigsByFirstByte.TryGetValue(buffer[i], out candidates)) continue;

                    foreach (FileSignature sig in candidates)
                    {
                        // The magic bytes are found at position i; the file starts earlier.
                        int fileStart = i - sig.HeaderOffset;
                        if (fileStart < 0) continue; // file began before this buffer chunk

                        if (!Match(buffer, i, sig.Magic)) continue;

                        string type   = sig.Type;
                        int sigLen    = sig.HeaderOffset + sig.Magic.Length;
                        int actualOffset = fileStart;

                        // RIFF container: resolve subtype from bytes at fileStart+8
                        if (type == "riff")
                        {
                            if      (Match(buffer, fileStart + 8, WebpIdentifier)) type = "webp";
                            else if (Match(buffer, fileStart + 8, AviSignature))   type = "avi";
                            else if (Match(buffer, fileStart + 8, WavSignature))   type = "wav";
                            else continue; // unrecognized RIFF subtype, ignore
                            sigLen = 12; // RIFF(4) + size(4) + subtype(4)
                        }

                        string extractedName;
                        if (!IsValidInMemory(buffer, actualOffset, type, out extractedName)) continue;

                        long fileOffset = baseOffset + actualOffset;
                        string finalName = !string.IsNullOrEmpty(extractedName) ? extractedName : "unknown";
                        if (type == "zip" && finalName.EndsWith(".xml") && finalName.Contains("word")) type = "docx";
                        if (type == "zip" && finalName.EndsWith(".xml") && finalName.Contains("xl"))   type = "xlsx";

                        lock (listLock)
                        {
                            if (knownOffsets.Add(fileOffset))
                            {
                                allFoundFiles.Add(new FoundFile { Offset = fileOffset, Type = type, Name = finalName, Size = "N/A" });
                                knownTypes.Add(type);
                            }
                        }

                        // Advance past the matched signature bytes to avoid re-matching.
                        if (sigLen > 1) i += sigLen - 1;
                        break; // one match per position; move to next byte
                    }
                }
            });
        }

        private void ScanDisk(string volumePath, int cacheSizeMB)
        {
            using (SafeFileHandle handle = CreateFile(volumePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero))
            {
                if (handle.IsInvalid)
                {
                    Invoke((MethodInvoker)delegate {
                        statusLabel.Text = "Error: Failed to open raw volume. Are you running as Administrator?";
                        statusLabel.ForeColor = Color.Red;
                        scanBtn.Text = "Scan Drive";
                        _scanning = false;
                    });
                    return;
                }

                using (FileStream diskStream = new FileStream(handle, FileAccess.Read))
                {
                    List<Tuple<long, long>> freeExtents = GetVolumeFreeExtents(handle, string.IsNullOrEmpty(driveCombo.SelectedItem.ToString()) ? "C" : driveCombo.SelectedItem.ToString());

                    int bufferSize = cacheSizeMB * 1024 * 1024; 
                    byte[] buffer1 = new byte[bufferSize];
                    byte[] buffer2 = new byte[bufferSize];
                    byte[] readBuffer = buffer1;
                    byte[] processBuffer = null;
                    
                    Task processTask = Task.CompletedTask;

                    long totalProcessed = 0;

                    foreach (var extent in freeExtents)
                    {
                        if (!_scanning) break;
                        long currentOffset = extent.Item1;
                        long extentEnd = extent.Item2;
                        
                        diskStream.Position = currentOffset;

                        while (_scanning && currentOffset < extentEnd)
                        {
                            int toRead = (int)Math.Min(bufferSize, extentEnd - currentOffset);
                            int bytesRead = diskStream.Read(readBuffer, 0, toRead);
                            if (bytesRead <= 0) break;

                            processTask.Wait();
                            
                            processBuffer = readBuffer;
                            readBuffer = (readBuffer == buffer1) ? buffer2 : buffer1;
                            
                            int processBytes = bytesRead;
                            long processOffset = currentOffset;
                            
                            processTask = Task.Run(() => {
                                ProcessBuffer(processBuffer, processBytes, processOffset);
                            });

                            currentOffset += bytesRead;
                            totalProcessed += bytesRead;

                            if (totalProcessed % (200 * 1024 * 1024) == 0)
                            {
                                Invoke((MethodInvoker)delegate {
                                    statusLabel.Text = "Scanning Unallocated Space... " + (totalProcessed / (1024 * 1024)) + " MB scanned.";
                                });
                            }
                        }
                    }
                    if (processTask != null) processTask.Wait();
                }
            }

            Invoke((MethodInvoker)delegate {
                scanBtn.Text = "Scan Drive";
                scanProgressBar.MarqueeAnimationSpeed = 0;
                uiUpdateTimer.Stop();
                lock (listLock) { UpdateListView(); }
                if (statusLabel.Text.StartsWith("Scanning"))
                {
                    statusLabel.Text = string.Format("Scan complete — {0:N0} files found.", allFoundFiles.Count);
                    statusLabel.ForeColor = AccentGreen;
                }
                _scanning = false;
            });
        }

        static bool Match(byte[] buffer, int offset, byte[] signature)
        {
            if (offset < 0 || offset + signature.Length > buffer.Length) return false;
            for (int i = 0; i < signature.Length; i++)
                if (buffer[offset + i] != signature[i]) return false;
            return true;
        }

        private bool IsValidInMemory(byte[] buffer, int offset, string type, out string extractedName)
        {
            extractedName = "";
            if (type == "zip") {
                try {
                    // Try to parse ZIP local file header to extract filename
                    if (offset + 30 < buffer.Length) {
                        int nameLen = buffer[offset + 26] | (buffer[offset + 27] << 8);
                        if (nameLen > 0 && nameLen < 256 && offset + 30 + nameLen < buffer.Length) {
                            extractedName = System.Text.Encoding.ASCII.GetString(buffer, offset + 30, nameLen);
                        }
                    }
                } catch { }
                return true; 
            }
            if (type == "gz") {
                 try {
                     // Try to parse GZIP header for original filename (flag bit 3)
                     if (offset + 10 < buffer.Length && (buffer[offset + 3] & 0x08) != 0) {
                         int nameEnd = offset + 10;
                         while (nameEnd < buffer.Length && buffer[nameEnd] != 0 && nameEnd - offset < 256) nameEnd++;
                         if (nameEnd > offset + 10) {
                             extractedName = System.Text.Encoding.ASCII.GetString(buffer, offset + 10, nameEnd - (offset + 10));
                         }
                     }
                 } catch { }
                 return true;
            }

             if (type == "exe") {
                 if (offset + 64 > buffer.Length) return false;
                 int peOffset = BitConverter.ToInt32(buffer, offset + 60);
                 if (peOffset <= 0 || peOffset > 10 * 1024 * 1024 || offset + peOffset + 4 > buffer.Length) return false;
                 if (buffer[offset + peOffset] != 0x50 || buffer[offset + peOffset + 1] != 0x45 || 
                     buffer[offset + peOffset + 2] != 0x00 || buffer[offset + peOffset + 3] != 0x00) return false;
             }
             if (type == "bmp") {
                 if (offset + 14 > buffer.Length) return false;
                 if (buffer[offset + 6] != 0 || buffer[offset + 7] != 0 || buffer[offset + 8] != 0 || buffer[offset + 9] != 0) return false;
             }
             if (type == "mp3") {
                 if (offset + 10 > buffer.Length) return false;
                 if (buffer[offset + 3] > 0x04 || buffer[offset + 3] < 0x02 || buffer[offset + 4] != 0x00) return false;
             }

            // Per-type content validation to reduce false positives.
            switch (type)
            {
                case "pdf":
                    // Must be %PDF-X.Y where major version is 1 or 2
                    if (offset + 8 > buffer.Length) return false;
                    if (buffer[offset + 4] != '-') return false;
                    if (buffer[offset + 5] < '1' || buffer[offset + 5] > '2') return false;
                    break;
                case "gif":
                    // GIF87a or GIF89a with non-zero dimensions
                    if (offset + 10 > buffer.Length) return false;
                    if (buffer[offset + 4] != '7' && buffer[offset + 4] != '9') return false;
                    if (buffer[offset + 5] != 'a') return false;
                    int gifW = buffer[offset + 6] | (buffer[offset + 7] << 8);
                    int gifH = buffer[offset + 8] | (buffer[offset + 9] << 8);
                    if (gifW == 0 || gifH == 0) return false;
                    break;
                case "rtf":
                    // All modern RTF files begin with {\rtf1
                    if (offset + 6 > buffer.Length) return false;
                    if (buffer[offset + 5] != '1') return false;
                    break;
                case "ogg":
                    // OGG page stream_structure_version must be 0
                    if (offset + 6 > buffer.Length) return false;
                    if (buffer[offset + 4] != 0x00) return false;
                    break;
                case "flac":
                    // First metadata block must be STREAMINFO (block type 0)
                    if (offset + 8 > buffer.Length) return false;
                    if ((buffer[offset + 4] & 0x7F) != 0) return false;
                    break;
                case "psd":
                    // 8BPS: version 1 (PSD) or 2 (PSB), channels 1–56
                    if (offset + 10 > buffer.Length) return false;
                    int psdVer = (buffer[offset + 4] << 8) | buffer[offset + 5];
                    if (psdVer != 1 && psdVer != 2) return false;
                    int psdChannels = (buffer[offset + 6] << 8) | buffer[offset + 7];
                    if (psdChannels < 1 || psdChannels > 56) return false;
                    break;
                case "elf":
                    // EI_CLASS 1 or 2, EI_DATA 1 or 2, EI_VERSION must be 1
                    if (offset + 8 > buffer.Length) return false;
                    if (buffer[offset + 4] < 1 || buffer[offset + 4] > 2) return false;
                    if (buffer[offset + 5] < 1 || buffer[offset + 5] > 2) return false;
                    if (buffer[offset + 6] != 1) return false;
                    break;
                case "class":
                    // CAFEBABE: major version 45 (Java 1.1) – 67 (Java 23)
                    if (offset + 8 > buffer.Length) return false;
                    int classMajor = (buffer[offset + 6] << 8) | buffer[offset + 7];
                    if (classMajor < 45 || classMajor > 67) return false;
                    break;
                case "mp4":
                    // ftyp brand (bytes 8–11 of box) must be printable ASCII
                    if (offset + 12 > buffer.Length) return false;
                    for (int k = 8; k < 12; k++)
                        if (buffer[offset + k] < 0x20 || buffer[offset + k] > 0x7E) return false;
                    break;
                case "tar":
                    // POSIX ustar: need at least one 512-byte block in the buffer.
                    if (offset + 512 > buffer.Length) return false;
                    // Filename (bytes 0–99): printable ASCII, null-terminated.
                    int tarNameEnd = 0;
                    for (int k = 0; k < 100; k++) {
                        byte b = buffer[offset + k];
                        if (b == 0) { tarNameEnd = k; break; }
                        if (b < 0x20 || b > 0x7E) return false;
                        tarNameEnd = k + 1;
                    }
                    if (tarNameEnd == 0) return false;
                    // Mode field (bytes 100–107): octal digits, spaces, or null.
                    for (int k = 100; k < 108; k++) {
                        byte b = buffer[offset + k];
                        if (b == 0 || b == ' ') continue;
                        if (b < '0' || b > '7') return false;
                    }
                    extractedName = Encoding.ASCII.GetString(buffer, offset, tarNameEnd);
                    break;

                // ── New types ────────────────────────────────────────────────────

                case "ole2":
                    // Reserved bytes 8–15 must be zero; sector-size exponent 9 (512 B) or 12 (4 KB).
                    if (offset + 32 > buffer.Length) return false;
                    for (int k = 8; k < 16; k++) if (buffer[offset + k] != 0) return false;
                    int oleSectorPow = buffer[offset + 30] | (buffer[offset + 31] << 8);
                    if (oleSectorPow != 9 && oleSectorPow != 12) return false;
                    break;

                case "mkv":
                    // First VINT size byte at offset+4 must not be 0x00 (invalid VINT).
                    if (offset + 5 > buffer.Length) return false;
                    if (buffer[offset + 4] == 0x00) return false;
                    break;

                case "tiff":
                    // IFD0 offset (bytes 4–7) must be ≥ 8 and within a sane limit.
                    if (offset + 8 > buffer.Length) return false;
                    bool tiffLE = buffer[offset] == 0x49;
                    int tiffIfd = tiffLE
                        ? (buffer[offset+4] | (buffer[offset+5]<<8) | (buffer[offset+6]<<16) | (buffer[offset+7]<<24))
                        : (buffer[offset+7] | (buffer[offset+6]<<8) | (buffer[offset+5]<<16) | (buffer[offset+4]<<24));
                    if (tiffIfd < 8 || tiffIfd > 512 * 1024 * 1024) return false;
                    break;

                case "flv":
                    // DataOffset (bytes 5–8, big-endian) must equal 9 for FLV version 1.
                    if (offset + 9 > buffer.Length) return false;
                    int flvDataOff = (buffer[offset+5]<<24)|(buffer[offset+6]<<16)|(buffer[offset+7]<<8)|buffer[offset+8];
                    if (flvDataOff != 9) return false;
                    break;

                case "swf":
                    // byte[3] = SWF version (1–45); bytes 4–7 = file length (LE) > 25.
                    if (offset + 8 > buffer.Length) return false;
                    if (buffer[offset + 3] < 1 || buffer[offset + 3] > 45) return false;
                    int swfLen = buffer[offset+4] | (buffer[offset+5]<<8) | (buffer[offset+6]<<16) | (buffer[offset+7]<<24);
                    if (swfLen < 25) return false;
                    break;

                case "bz2":
                    // "BZh" must be followed by a compression-level digit '1'–'9'.
                    if (offset + 4 > buffer.Length) return false;
                    if (buffer[offset + 3] < '1' || buffer[offset + 3] > '9') return false;
                    break;

                case "xz":
                    // Stream-flags byte 6 is reserved and must be 0x00.
                    if (offset + 7 > buffer.Length) return false;
                    if (buffer[offset + 6] != 0x00) return false;
                    break;

                case "cab":
                    // Reserved1 (bytes 4–7) and Reserved2 (bytes 12–15) must be zero.
                    if (offset + 16 > buffer.Length) return false;
                    for (int k = 4;  k < 8;  k++) if (buffer[offset + k] != 0) return false;
                    for (int k = 12; k < 16; k++) if (buffer[offset + k] != 0) return false;
                    break;

                case "pst":
                    // wVer at bytes 10–11: 14/15=ANSI PST, 23=Unicode, 36=Large Unicode.
                    if (offset + 12 > buffer.Length) return false;
                    int pstVer = buffer[offset + 10] | (buffer[offset + 11] << 8);
                    if (pstVer != 14 && pstVer != 15 && pstVer != 23 && pstVer != 36) return false;
                    break;

                case "ttf":
                    // numTables at bytes 4–5 (big-endian) must be 1–30.
                    if (offset + 6 > buffer.Length) return false;
                    int ttfTables = (buffer[offset + 4] << 8) | buffer[offset + 5];
                    if (ttfTables < 1 || ttfTables > 30) return false;
                    break;

                case "otf":
                    // numTables at bytes 4–5 (big-endian) must be 1–30.
                    if (offset + 6 > buffer.Length) return false;
                    int otfTables = (buffer[offset + 4] << 8) | buffer[offset + 5];
                    if (otfTables < 1 || otfTables > 30) return false;
                    break;

                case "woff":
                    // totalLen (bytes 8–11, big-endian) must exceed the 44-byte header.
                    if (offset + 12 > buffer.Length) return false;
                    int woffLen = (buffer[offset+8]<<24)|(buffer[offset+9]<<16)|(buffer[offset+10]<<8)|buffer[offset+11];
                    if (woffLen <= 44) return false;
                    break;

                case "woff2":
                    // totalLen (bytes 8–11, big-endian) must exceed the 48-byte header.
                    if (offset + 12 > buffer.Length) return false;
                    int woff2Len = (buffer[offset+8]<<24)|(buffer[offset+9]<<16)|(buffer[offset+10]<<8)|buffer[offset+11];
                    if (woff2Len <= 48) return false;
                    break;

                case "dex":
                    // Version string (bytes 4–7): three ASCII digits then null, e.g. "035\0"–"041\0".
                    if (offset + 8 > buffer.Length) return false;
                    if (buffer[offset + 7] != 0x00) return false;
                    if (buffer[offset+4] < '0' || buffer[offset+4] > '9') return false;
                    if (buffer[offset+5] < '0' || buffer[offset+5] > '9') return false;
                    if (buffer[offset+6] < '0' || buffer[offset+6] > '9') return false;
                    break;

                case "macho":
                    // filetype (bytes 12–15, LE) must be 1–12; ncmds (bytes 16–19, LE) must be 1–500.
                    if (offset + 20 > buffer.Length) return false;
                    int machoType  = buffer[offset+12] | (buffer[offset+13]<<8) | (buffer[offset+14]<<16) | (buffer[offset+15]<<24);
                    int machoNcmds = buffer[offset+16] | (buffer[offset+17]<<8) | (buffer[offset+18]<<16) | (buffer[offset+19]<<24);
                    if (machoType < 1 || machoType > 12) return false;
                    if (machoNcmds < 1 || machoNcmds > 500) return false;
                    break;

                case "vmdk":
                    // Version (bytes 4–7, LE) must be 1, 2, or 3.
                    if (offset + 8 > buffer.Length) return false;
                    int vmdkVer = buffer[offset+4] | (buffer[offset+5]<<8) | (buffer[offset+6]<<16) | (buffer[offset+7]<<24);
                    if (vmdkVer < 1 || vmdkVer > 3) return false;
                    break;

                case "qcow2":
                    // Version (bytes 4–7, big-endian) must be 2 or 3.
                    if (offset + 8 > buffer.Length) return false;
                    int qcowVer = (buffer[offset+4]<<24)|(buffer[offset+5]<<16)|(buffer[offset+6]<<8)|buffer[offset+7];
                    if (qcowVer != 2 && qcowVer != 3) return false;
                    break;

                case "lnk":
                    // Shell Link CLSID at bytes 4–19 must match {00021401-0000-0000-C000-000000000046}.
                    if (offset + 20 > buffer.Length) return false;
                    byte[] lnkClsid = { 0x01,0x14,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46 };
                    for (int k = 0; k < lnkClsid.Length; k++)
                        if (buffer[offset + 4 + k] != lnkClsid[k]) return false;
                    break;

                case "aiff":
                    // Bytes 0–3 must be "FORM" (we matched "AIFF" at offset+8 via HeaderOffset).
                    if (offset + 12 > buffer.Length) return false;
                    if (buffer[offset]   != 0x46 || buffer[offset+1] != 0x4F ||
                        buffer[offset+2] != 0x52 || buffer[offset+3] != 0x4D) return false;
                    int aiffSize = (buffer[offset+4]<<24)|(buffer[offset+5]<<16)|(buffer[offset+6]<<8)|buffer[offset+7];
                    if (aiffSize <= 0) return false;
                    break;
            }

            if (type != "jpg" && type != "png") return true;

            try {
                int length = Math.Min(buffer.Length - offset, 5 * 1024 * 1024);
                if (length < 100) return false;
                
                byte[] chunk = new byte[length];
                Array.Copy(buffer, offset, chunk, 0, length);
                
                chunk = TrimToEOF(chunk, type);
                
                using (MemoryStream ms = new MemoryStream(chunk)) {
                    using (Image img = Image.FromStream(ms)) {
                        return true;
                    }
                }
            } catch {
                return false;
            }
        }

        private byte[] ReadCarvedBytes(long exactOffset, int length)
        {
            if (driveCombo.SelectedItem == null) return null;
            string volumePath = "\\\\.\\" + driveCombo.SelectedItem.ToString() + ":";

            long sectorSize = 4096;
            long alignedOffset = exactOffset - (exactOffset % sectorSize);
            int diff = (int)(exactOffset - alignedOffset);
            int readLength = length + diff;
            
            if (readLength % sectorSize != 0)
                readLength += (int)(sectorSize - (readLength % sectorSize));

            using (SafeFileHandle handle = CreateFile(volumePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero))
            {
                if (handle.IsInvalid) return null;
                using (FileStream diskStream = new FileStream(handle, FileAccess.Read))
                {
                    diskStream.Position = alignedOffset;
                    byte[] buffer = new byte[readLength];
                    int read = diskStream.Read(buffer, 0, readLength);
                    if (read > diff)
                    {
                        int actualDataLength = Math.Min(length, read - diff);
                        byte[] result = new byte[actualDataLength];
                        Array.Copy(buffer, diff, result, 0, actualDataLength);
                        return result;
                    }
                }
            }
            return null;
        }

        private byte[] TrimToEOF(byte[] data, string type)
        {
            if (type == "webp")
            {
                if (data.Length >= 8) {
                    // RIFF format stores exact file size (minus first 8 bytes) in bytes 4-7. WebP is incredibly clean to carve because of this!
                    int size = BitConverter.ToInt32(data, 4) + 8;
                    if (size > 0 && size <= data.Length) {
                        byte[] trimmed = new byte[size];
                        Array.Copy(data, 0, trimmed, 0, size);
                        return trimmed;
                    }
                }
            }
            if (type == "png")
            {
                byte[] iend = { 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82 };
                for (int i = 0; i < data.Length - iend.Length; i++)
                {
                    bool match = true;
                    for (int j = 0; j < iend.Length; j++) if (data[i+j] != iend[j]) { match = false; break; }
                    if (match) {
                        byte[] trimmed = new byte[i + iend.Length];
                        Array.Copy(data, 0, trimmed, 0, trimmed.Length);
                        return trimmed;
                    }
                }
            }
            else if (type == "jpg")
            {
                for(int i = 0; i < data.Length - 1; i++)
                {
                    if (data[i] == 0xFF && data[i+1] == 0xD9)
                    {
                        byte[] trimmed = new byte[i + 2];
                        Array.Copy(data, 0, trimmed, 0, i + 2);
                        return trimmed; 
                    }
                }
            }
            else if (type == "pdf")
            {
                byte[] eof = { 0x25, 0x25, 0x45, 0x4F, 0x46 }; // %%EOF
                byte[] pdfHeader = { 0x25, 0x50, 0x44, 0x46 }; // %PDF
                int bestEof = -1;
                for (int i = 0; i <= data.Length - 5; i++)
                {
                    if (i > 0 && data[i] == pdfHeader[0] && data[i+1] == pdfHeader[1] && data[i+2] == pdfHeader[2] && data[i+3] == pdfHeader[3])
                    {
                        break;
                    }
                    if (data[i] == eof[0] && data[i+1] == eof[1] && data[i+2] == eof[2] && data[i+3] == eof[3] && data[i+4] == eof[4])
                    {
                        bestEof = i + 5;
                    }
                }
                if (bestEof != -1)
                {
                    while (bestEof < data.Length && (data[bestEof] == '\r' || data[bestEof] == '\n'))
                    {
                        bestEof++;
                    }
                    byte[] trimmed = new byte[bestEof];
                    Array.Copy(data, 0, trimmed, 0, bestEof);
                    return trimmed;
                }
            }
            return data;
        }

        private void ResultsListView_SelectedIndexChanged(object sender, EventArgs e)
        {
            if (resultsListView.SelectedItems.Count == 0) return;
            FoundFile file = resultsListView.SelectedItems[0].Tag as FoundFile;
            if (file != null)
            {
                string baseType = file.Type;
                // Only JPG, PNG, GIF, BMP and TIFF can be rendered natively by GDI+.
                bool isRenderable = baseType == "jpg" || baseType == "png" ||
                                    baseType == "gif" || baseType == "bmp" || baseType == "tiff";
                if (!isRenderable)
                {
                    string msg = string.Format(
                        "{0}\n\nDisk offset:  {1:N0}\n\nThis format cannot be previewed here.\nClick  Restore Selected  to save the file to disk.",
                        baseType.ToUpper(), file.Offset);
                    Image old = previewBox.Image;
                    previewBox.Image = CreatePlaceholderMessage(msg);
                    if (old != null) old.Dispose();
                    return;
                }

                byte[] previewData = ReadCarvedBytes(file.Offset, 5 * 1024 * 1024); 
                if(previewData == null) {
                    previewBox.Image = null;
                    return;
                }

                previewData = TrimToEOF(previewData, file.Type);
                try {
                    MemoryStream ms = new MemoryStream(previewData);
                    Image rawImg = Image.FromStream(ms);
                    Image old = previewBox.Image;
                    previewBox.Image = rawImg;
                    if (old != null) old.Dispose();
                } catch {
                    previewBox.Image = CreatePlaceholderMessage(
                        "File header found and validated, but the image body\nis fragmented or partially overwritten.");
                }
            }
        }

        private void RestoreBtn_Click(object sender, EventArgs e)
        {
            if (resultsListView.SelectedItems.Count == 0) return;
            FoundFile file = resultsListView.SelectedItems[0].Tag as FoundFile;
            if (file != null)
            {
                string outputDir = Path.Combine(Environment.CurrentDirectory, "RecoveredFiles");
                if (!Directory.Exists(outputDir)) Directory.CreateDirectory(outputDir);

                string baseType = file.Type;
                string namePart = "recovered_" + file.Offset;
                
                if (file.Name != "unknown" && file.Name.IndexOfAny(Path.GetInvalidFileNameChars()) < 0) {
                    namePart = file.Name;
                }

                if (string.IsNullOrEmpty(Path.GetExtension(namePart))) {
                     namePart += "." + baseType;
                }

                string outPath = Path.Combine(outputDir, namePart);
                
                byte[] fileData = ReadCarvedBytes(file.Offset, 15 * 1024 * 1024); 
                
                if (fileData != null) {
                    fileData = TrimToEOF(fileData, baseType); 
                    File.WriteAllBytes(outPath, fileData);
                    MessageBox.Show("Successfully recovered the clean file to:\n\n" + outPath, "Restored Successfully", MessageBoxButtons.OK, MessageBoxIcon.Information);
                } else {
                }
            }
        }
        
        private void InitializeCleanerTab()
        {
            // Warning banner
            var warnPanel = new Panel { Dock = DockStyle.Top, Height = 60, BackColor = Color.FromArgb(75, 18, 18) };
            var warnLabel = new Label {
                Dock = DockStyle.Fill, TextAlign = ContentAlignment.MiddleLeft,
                Padding = new Padding(14, 0, 0, 0),
                Text = "⚠  DANGER ZONE  —  Permanently overwrites deleted file headers in unallocated disk space with random bytes. This makes carved files unrecoverable. Proceed with extreme caution.",
                ForeColor = Color.FromArgb(255, 160, 160), BackColor = Color.Transparent,
                Font = new Font("Segoe UI", 9, FontStyle.Bold)
            };
            warnPanel.Controls.Add(warnLabel);

            // Controls row
            var toolbar = new Panel { Dock = DockStyle.Top, Height = 52, BackColor = DarkSurface };
            cleanerDriveCombo = new ComboBox {
                Location = new Point(10, 12), Width = 82,
                DropDownStyle = ComboBoxStyle.DropDownList,
                BackColor = DarkControl, ForeColor = TextPrimary, FlatStyle = FlatStyle.Flat
            };
            foreach (var di in DriveInfo.GetDrives())
                cleanerDriveCombo.Items.Add(di.Name.Substring(0, 1));
            if (cleanerDriveCombo.Items.Count > 0) cleanerDriveCombo.SelectedIndex = 0;

            cleanBtn = new Button {
                Text = "Clean Drive", Location = new Point(102, 10), Width = 128, Height = 28,
                BackColor = DangerRed, ForeColor = Color.White,
                FlatStyle = FlatStyle.Flat, Font = new Font("Segoe UI", 9, FontStyle.Bold)
            };
            cleanBtn.FlatAppearance.BorderSize = 0;
            cleanBtn.Click += CleanBtn_Click;

            var cleanCacheLabel = new Label {
                Location = new Point(240, 16), Width = 72, Text = "Cache (MB):",
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 9)
            };
            cleanCacheNumeric = new NumericUpDown {
                Location = new Point(314, 12), Width = 62, Minimum = 1, Maximum = 1024, Value = 8,
                BackColor = DarkControl, ForeColor = TextPrimary
            };
            toolbar.Controls.AddRange(new Control[] { cleanerDriveCombo, cleanBtn, cleanCacheLabel, cleanCacheNumeric });

            // Status area
            var statusArea = new Panel { Dock = DockStyle.Fill, BackColor = DarkBg };
            cleanerStatusLabel = new Label {
                Dock = DockStyle.Fill, TextAlign = ContentAlignment.MiddleCenter,
                Text = "Select a drive and click Clean Drive to begin.",
                ForeColor = TextMuted, BackColor = Color.Transparent, Font = new Font("Segoe UI", 11)
            };
            statusArea.Controls.Add(cleanerStatusLabel);

            // Dock order: Fill last
            cleanerTab.Controls.Add(statusArea);
            cleanerTab.Controls.Add(toolbar);
            cleanerTab.Controls.Add(warnPanel);
        }

        private void CleanBtn_Click(object sender, EventArgs e)
        {
            if (_cleaning) {
                _cleaning = false;
                cleanBtn.Text = "Stopping...";
                return;
            }

            if (cleanerDriveCombo.SelectedItem == null) return;
            string drive = cleanerDriveCombo.SelectedItem.ToString();
            string volumePath = "\\\\.\\" + drive + ":";

            _cleanedCount = 0;
            _cleaning = true;
            cleanBtn.Text = "Stop Cleaning";
            cleanerStatusLabel.Text = "Cleaning " + volumePath + "...";
            cleanerStatusLabel.ForeColor = Color.Red;

            int cacheSizeMB = (int)cleanCacheNumeric.Value;

            ThreadPool.QueueUserWorkItem((state) => {
                CleanDisk(volumePath, cacheSizeMB);
            });
        }

        private List<KeyValuePair<long, int>> ProcessCleanBuffer(byte[] buffer, int length, long baseOffset)
        {
            int numThreads = Environment.ProcessorCount;
            if (numThreads < 1) numThreads = 1;
            int chunkSize = length / numThreads;

            List<KeyValuePair<long, int>> patches = new List<KeyValuePair<long, int>>();
            object patchLock = new object();

            Parallel.For(0, numThreads, t =>
            {
                int start = t * chunkSize;
                int end = (t == numThreads - 1) ? length - 12 : start + chunkSize;

                for (int i = start; i < end; i++)
                {
                    if (!_cleaning) break;

                    int sigLength = 0;
                    if (Match(buffer, i, JpegSignature)) sigLength = JpegSignature.Length;
                    else if (Match(buffer, i, ZipSignature)) sigLength = ZipSignature.Length;
                    else if (Match(buffer, i, PdfSignature)) sigLength = PdfSignature.Length;
                    else if (Match(buffer, i, PngSignature)) sigLength = PngSignature.Length;
                    else if (Match(buffer, i, ExeSignature)) sigLength = ExeSignature.Length;
                    else if (Match(buffer, i, RarSignature)) sigLength = RarSignature.Length;
                    else if (Match(buffer, i, Mp3Signature)) sigLength = Mp3Signature.Length;
                    else if (Match(buffer, i, RtfSignature)) sigLength = RtfSignature.Length;
                    else if (Match(buffer, i, GifSignature)) sigLength = GifSignature.Length;
                    else if (Match(buffer, i, SqliteSignature)) sigLength = SqliteSignature.Length;
                    else if (Match(buffer, i, GzipSignature)) sigLength = GzipSignature.Length;
                    else if (Match(buffer, i, SevenZipSignature)) sigLength = SevenZipSignature.Length;
                    else if (Match(buffer, i, ElfSignature)) sigLength = ElfSignature.Length;
                    else if (Match(buffer, i, PsdSignature)) sigLength = PsdSignature.Length;
                    else if (Match(buffer, i, OggSignature)) sigLength = OggSignature.Length;
                    else if (Match(buffer, i, FlacSignature)) sigLength = FlacSignature.Length;
                    else if (Match(buffer, i, ClassSignature)) sigLength = ClassSignature.Length;
                    else if (Match(buffer, i, RiffSignature)) {
                        if (Match(buffer, i + 8, WebpIdentifier)) sigLength = 12;
                        else if (Match(buffer, i + 8, AviSignature)) sigLength = 12;
                        else if (Match(buffer, i + 8, WavSignature)) sigLength = 12;
                    }
                    else if (i >= 4 && Match(buffer, i, Mp4Signature)) sigLength = 8;
                    else if (Match(buffer, i, PngEof)) sigLength = PngEof.Length;
                    else if (Match(buffer, i, PdfEof)) sigLength = PdfEof.Length;

                    if (sigLength > 0)
                    {
                        lock(patchLock) {
                            patches.Add(new KeyValuePair<long, int>(baseOffset + (i >= 4 && sigLength == 8 && Match(buffer, i, Mp4Signature) ? i - 4 : i), sigLength));
                        }
                    }
                }
            });

            return patches;
        }

        private void CleanDisk(string volumePath, int cacheSizeMB)
        {
            string driveLetter = string.IsNullOrEmpty(cleanerDriveCombo.SelectedItem.ToString()) ? "C" : cleanerDriveCombo.SelectedItem.ToString();
            
            uint spc, bps, nfc, tnc;
            if (!GetDiskFreeSpace(driveLetter + ":\\", out spc, out bps, out nfc, out tnc))
            {
                Invoke((MethodInvoker)delegate {
                    cleanerStatusLabel.Text = "Error: Could not determine cluster size of drive " + driveLetter + ":";
                    cleanBtn.Text = "Clean Drive (DANGER)";
                    _cleaning = false;
                });
                return;
            }
            long clusterSize = (long)spc * bps;

            using (SafeFileHandle handle = CreateFile(volumePath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero))
            {
                if (handle.IsInvalid)
                {
                    Invoke((MethodInvoker)delegate {
                        cleanerStatusLabel.Text = "Error: Failed to open raw volume for Write. Are you running as Administrator?";
                        cleanBtn.Text = "Clean Drive (DANGER)";
                        _cleaning = false;
                    });
                    return;
                }
                List<Tuple<long, long>> freeExtents = GetVolumeFreeExtents(handle, string.IsNullOrEmpty(cleanerDriveCombo.SelectedItem.ToString()) ? "C" : cleanerDriveCombo.SelectedItem.ToString());

                // Lock removed: prevents volume dismounts and Chkdsk triggers over harmless unallocated writes.

                int bufferSize = cacheSizeMB * 1024 * 1024; 
                byte[] buffer1 = new byte[bufferSize];
                byte[] buffer2 = new byte[bufferSize];
                byte[] readBuffer = buffer1;
                byte[] processBuffer = null;
                
                Task processTask = Task.CompletedTask;

                long totalProcessed = 0;
                Random rand = new Random();
                object diskLock = new object();

                foreach (var extent in freeExtents)
                {
                    if (!_cleaning) break;
                    long currentOffset = extent.Item1;
                    long extentEnd = extent.Item2;
                    
                    while (_cleaning && currentOffset < extentEnd)
                    {
                        int toRead = (int)Math.Min(bufferSize, extentEnd - currentOffset);
                        uint bytesRead = 0;
                        lock (diskLock)
                        {
                            long newPointer;
                            SetFilePointerEx(handle, currentOffset, out newPointer, 0);
                            ReadFile(handle, readBuffer, (uint)toRead, out bytesRead, IntPtr.Zero);
                        }
                        if (bytesRead <= 0) break;

                        processTask.Wait();
                        processBuffer = readBuffer;
                        readBuffer = (readBuffer == buffer1) ? buffer2 : buffer1;

                        int processBytes = (int)bytesRead;
                        long processOffset = currentOffset;

                        processTask = Task.Run(() => {
                            var patches = ProcessCleanBuffer(processBuffer, processBytes, processOffset);
                            
                            if (patches.Count > 0)
                            {
                                foreach (var patch in patches) {
                                    if (!_cleaning) break;
                                    long absoluteOffset = patch.Key;
                                    int patchLength = patch.Value;
                                    
                                    // Calculate precise physical 4KB sector boundaries
                                    long sectorStart = absoluteOffset - (absoluteOffset % bps);
                                    long sectorEnd = absoluteOffset + patchLength;
                                    if (sectorEnd % bps != 0) sectorEnd += (bps - (sectorEnd % bps));
                                    uint sectorBytes = (uint)(sectorEnd - sectorStart);
                                    
                                    if (sectorBytes <= 0 || sectorBytes > 1024 * 1024) continue;
                                    
                                    byte[] sectorBuf = new byte[sectorBytes];
                                    lock (diskLock) {
                                        long tempPtr;
                                        SetFilePointerEx(handle, sectorStart, out tempPtr, 0);
                                        uint read;
                                        if (ReadFile(handle, sectorBuf, sectorBytes, out read, IntPtr.Zero) && read == sectorBytes) {
                                            int offsetInBuf = (int)(absoluteOffset - sectorStart);
                                            byte[] rBytes = new byte[patchLength];
                                            rand.NextBytes(rBytes);
                                            Array.Copy(rBytes, 0, sectorBuf, offsetInBuf, patchLength);
                                            
                                            SetFilePointerEx(handle, sectorStart, out tempPtr, 0);
                                            uint sWritten;
                                            if (WriteFile(handle, sectorBuf, sectorBytes, out sWritten, IntPtr.Zero)) {
                                                Interlocked.Increment(ref _cleanedCount);
                                            }
                                        }
                                    }
                                }
                            }
                        });

                        currentOffset += bytesRead;
                        totalProcessed += bytesRead;

                        if (totalProcessed % (200 * 1024 * 1024) == 0)
                        {
                            Invoke((MethodInvoker)delegate {
                                cleanerStatusLabel.Text = "Micro-Patching Free Space... " + (totalProcessed / (1024 * 1024)) + " MB scanned. Overwrites: " + Interlocked.Read(ref _cleanedCount);
                            });
                        }
                    }
                }
                if (processTask != null) processTask.Wait();
                FlushFileBuffers(handle);
            }

            Invoke((MethodInvoker)delegate {
                cleanBtn.Text = "Clean Drive (DANGER)";
                cleanerStatusLabel.Text = string.Format("Complete — overwritten {0:N0} file headers.", _cleanedCount);
                cleanerStatusLabel.ForeColor = AccentGreen;
                _cleaning = false;
            });
        }
        
        private List<Tuple<long, long>> GetVolumeFreeExtents(SafeFileHandle handle, string driveLetter)
        {
            List<Tuple<long, long>> freeExtents = new List<Tuple<long, long>>();
            
            uint spc, bps, nfc, tnc;
            if (!GetDiskFreeSpace(driveLetter + ":\\", out spc, out bps, out nfc, out tnc)) return freeExtents;
            
            long clusterSize = (long)spc * bps;

            long startingLcn = 0;
            int outBufferSize = 32 * 1024 * 1024; 
            IntPtr outBuffer = Marshal.AllocHGlobal(outBufferSize);
            try {
                int bytesReturned;
                bool result = DeviceIoControl(handle, FSCTL_GET_VOLUME_BITMAP, ref startingLcn, sizeof(long), outBuffer, outBufferSize, out bytesReturned, IntPtr.Zero);
                
                if (result || Marshal.GetLastWin32Error() == 234) 
                {
                    long returnedStartingLcn = Marshal.ReadInt64(outBuffer, 0);
                    int bytesToRead = bytesReturned - 16;
                    
                    long currentFreeLcnStart = -1;
                    long currentLcn = returnedStartingLcn;
                    
                    for (int byteIdx = 0; byteIdx < bytesToRead && currentLcn < tnc; byteIdx++)
                    {
                        byte b = Marshal.ReadByte(outBuffer, 16 + byteIdx);
                        for (int bit = 0; bit < 8 && currentLcn < tnc; bit++)
                        {
                            bool isAllocated = (b & (1 << bit)) != 0;
                            if (!isAllocated) {
                                if (currentFreeLcnStart == -1) currentFreeLcnStart = currentLcn;
                            } else {
                                if (currentFreeLcnStart != -1) {
                                    freeExtents.Add(new Tuple<long, long>(currentFreeLcnStart * clusterSize, currentLcn * clusterSize));
                                    currentFreeLcnStart = -1;
                                }
                            }
                            currentLcn++;
                        }
                    }
                    if (currentFreeLcnStart != -1) {
                        freeExtents.Add(new Tuple<long, long>(currentFreeLcnStart * clusterSize, currentLcn * clusterSize));
                    }
                }
            } finally {
                Marshal.FreeHGlobal(outBuffer);
            }
            if (freeExtents.Count == 0) freeExtents.Add(new Tuple<long, long>(0, tnc * clusterSize));
            return freeExtents;
        }
    }

    static class Program {
        [STAThread]
        static void Main() {
            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
            Application.Run(new MainForm());
        }
    }
}