Beispiel #1
0
        public int ReadFrom(byte[] buffer, int offset)
        {
            CreationTime     = ReadDateTime(buffer, 0x00);
            ModificationTime = ReadDateTime(buffer, 0x08);
            MftChangedTime   = ReadDateTime(buffer, 0x10);
            LastAccessTime   = ReadDateTime(buffer, 0x18);
            FileAttributes   = (FileAttributeFlags)Utilities.ToUInt32LittleEndian(buffer, 0x20);
            MaxVersions      = Utilities.ToUInt32LittleEndian(buffer, 0x24);
            Version          = Utilities.ToUInt32LittleEndian(buffer, 0x28);
            ClassId          = Utilities.ToUInt32LittleEndian(buffer, 0x2C);

            if (buffer.Length > 0x30)
            {
                OwnerId              = Utilities.ToUInt32LittleEndian(buffer, 0x30);
                SecurityId           = Utilities.ToUInt32LittleEndian(buffer, 0x34);
                QuotaCharged         = Utilities.ToUInt64LittleEndian(buffer, 0x38);
                UpdateSequenceNumber = Utilities.ToUInt64LittleEndian(buffer, 0x40);
                _haveExtraFields     = true;
                return(0x48);
            }
            else
            {
                _haveExtraFields = false;
                return(0x30);
            }
        }
        public int ReadFrom(byte[] buffer, int offset)
        {
            CreationTime = ReadDateTime(buffer, 0x00);
            ModificationTime = ReadDateTime(buffer, 0x08);
            MftChangedTime = ReadDateTime(buffer, 0x10);
            LastAccessTime = ReadDateTime(buffer, 0x18);
            FileAttributes = (FileAttributeFlags)Utilities.ToUInt32LittleEndian(buffer, 0x20);
            MaxVersions = Utilities.ToUInt32LittleEndian(buffer, 0x24);
            Version = Utilities.ToUInt32LittleEndian(buffer, 0x28);
            ClassId = Utilities.ToUInt32LittleEndian(buffer, 0x2C);

            if (buffer.Length > 0x30)
            {
                OwnerId = Utilities.ToUInt32LittleEndian(buffer, 0x30);
                SecurityId = Utilities.ToUInt32LittleEndian(buffer, 0x34);
                QuotaCharged = Utilities.ToUInt64LittleEndian(buffer, 0x38);
                UpdateSequenceNumber = Utilities.ToUInt64LittleEndian(buffer, 0x40);
                _haveExtraFields = true;
                return 0x48;
            }
            else
            {
                _haveExtraFields = false;
                return 0x30;
            }
        }
Beispiel #3
0
        public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags)
        {
            File newFile = context.AllocateFile(flags);

            FileAttributeFlags fileFlags =
                FileAttributeFlags.Archive
                | FileRecord.ConvertFlags(flags)
                | (dirFlags & FileAttributeFlags.Compressed);

            AttributeFlags dataAttrFlags = AttributeFlags.None;

            if ((dirFlags & FileAttributeFlags.Compressed) != 0)
            {
                dataAttrFlags |= AttributeFlags.Compressed;
            }

            StandardInformation.InitializeNewFile(newFile, fileFlags);

            if (context.ObjectIds != null)
            {
                Guid       newId  = CreateNewGuid(context);
                NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
                ObjectId   objId  = new ObjectId();
                objId.Id = newId;
                stream.SetContent(objId);
                context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
            }

            newFile.CreateAttribute(AttributeType.Data, dataAttrFlags);

            newFile.UpdateRecordInMft();

            return(newFile);
        }
Beispiel #4
0
 public static extern SafeFileHandle CreateFile(
     [In] string lpFileName,
     [In] AccessRights dwDesiredAccess,
     [In] FileShareMode dwShareMode,
     [In] IntPtr lpSecurityAttributes,
     [In] FileCreationDisposition dwCreationDisposition,
     [In] FileAttributeFlags dwFlagsAndAttributes,
     [In] IntPtr hTemplateFile);
Beispiel #5
0
 public static extern IntPtr SHGetFileInfo
 (
     [In] string pszPath,
     FileAttributeFlags fileAttributes,
     [In][Out] ref SHFileInfo psfi,
     uint fileInfo,
     ShGetFileInfoFlags flags
 );
        internal static FileAttributes ConvertFlags(FileAttributeFlags flags)
        {
            FileAttributes result = (FileAttributes)(((uint)flags) & 0xFFFF);

            if ((flags & FileAttributeFlags.Directory) != 0)
            {
                result |= FileAttributes.Directory;
            }
            return(result);
        }
Beispiel #7
0
        internal static FileAttributes ConvertFlags(FileAttributeFlags flags, bool isDirectory)
        {
            FileAttributes result = (FileAttributes)(((uint)flags) & 0xFFFF);

            if (isDirectory)
            {
                result |= System.IO.FileAttributes.Directory;
            }

            return(result);
        }
 public FileNameRecord(FileNameRecord toCopy)
 {
     ParentDirectory         = toCopy.ParentDirectory;
     CreationTime            = toCopy.CreationTime;
     ModificationTime        = toCopy.ModificationTime;
     MftChangedTime          = toCopy.MftChangedTime;
     LastAccessTime          = toCopy.LastAccessTime;
     AllocatedSize           = toCopy.AllocatedSize;
     RealSize                = toCopy.RealSize;
     Flags                   = toCopy.Flags;
     EASizeOrReparsePointTag = toCopy.EASizeOrReparsePointTag;
     FileNameNamespace       = toCopy.FileNameNamespace;
     FileName                = toCopy.FileName;
 }
Beispiel #9
0
        internal static new Directory CreateNew(INtfsContext context, FileAttributeFlags parentDirFlags)
        {
            Directory dir = (Directory)context.AllocateFile(FileRecordFlags.IsDirectory);

            StandardInformation.InitializeNewFile(
                dir,
                FileAttributeFlags.Archive | (parentDirFlags & FileAttributeFlags.Compressed));

            // Create the index root attribute by instantiating a new index
            dir.CreateIndex("$I30", AttributeType.FileName, AttributeCollationRule.Filename);

            dir.UpdateRecordInMft();

            return(dir);
        }
        public static StandardInformation InitializeNewFile(File file, FileAttributeFlags flags)
        {
            DateTime now = DateTime.UtcNow;

            NtfsStream siStream = file.CreateStream(AttributeType.StandardInformation, null);
            StandardInformation si = new StandardInformation();
            si.CreationTime = now;
            si.ModificationTime = now;
            si.MftChangedTime = now;
            si.LastAccessTime = now;
            si.FileAttributes = flags;
            siStream.SetContent(si);

            return si;
        }
Beispiel #11
0
        public static StandardInformation InitializeNewFile(File file, FileAttributeFlags flags)
        {
            DateTime now = DateTime.UtcNow;

            NtfsStream          siStream = file.CreateStream(AttributeType.StandardInformation, null);
            StandardInformation si       = new StandardInformation();

            si.CreationTime     = now;
            si.ModificationTime = now;
            si.MftChangedTime   = now;
            si.LastAccessTime   = now;
            si.FileAttributes   = flags;
            siStream.SetContent(si);

            return(si);
        }
        public int ReadFrom(byte[] buffer, int offset)
        {
            ParentDirectory         = new FileRecordReference(Utilities.ToUInt64LittleEndian(buffer, offset + 0x00));
            CreationTime            = ReadDateTime(buffer, offset + 0x08);
            ModificationTime        = ReadDateTime(buffer, offset + 0x10);
            MftChangedTime          = ReadDateTime(buffer, offset + 0x18);
            LastAccessTime          = ReadDateTime(buffer, offset + 0x20);
            AllocatedSize           = Utilities.ToUInt64LittleEndian(buffer, offset + 0x28);
            RealSize                = Utilities.ToUInt64LittleEndian(buffer, offset + 0x30);
            Flags                   = (FileAttributeFlags)Utilities.ToUInt32LittleEndian(buffer, offset + 0x38);
            EASizeOrReparsePointTag = Utilities.ToUInt32LittleEndian(buffer, offset + 0x3C);
            byte fnLen = buffer[offset + 0x40];

            FileNameNamespace = (FileNameNamespace)buffer[offset + 0x41];
            FileName          = Encoding.Unicode.GetString(buffer, offset + 0x42, fnLen * 2);

            return(0x42 + (fnLen * 2));
        }
Beispiel #13
0
        internal static FileAttributeFlags ConvertFlags(FileRecordFlags source)
        {
            FileAttributeFlags result = FileAttributeFlags.None;

            if ((source & FileRecordFlags.IsDirectory) != 0)
            {
                result |= FileAttributeFlags.Directory;
            }
            if ((source & FileRecordFlags.HasViewIndex) != 0)
            {
                result |= FileAttributeFlags.IndexView;
            }
            if ((source & FileRecordFlags.IsMetaFile) != 0)
            {
                result |= FileAttributeFlags.Hidden | FileAttributeFlags.System;
            }

            return(result);
        }
Beispiel #14
0
 public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags)
 {
     return(CreateNew(context, FileRecordFlags.None, dirFlags));
 }
Beispiel #15
0
        public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags)
        {
            File newFile = context.AllocateFile(flags);

            FileAttributeFlags fileFlags =
                FileAttributeFlags.Archive
                | FileRecord.ConvertFlags(flags)
                | (dirFlags & FileAttributeFlags.Compressed);

            AttributeFlags dataAttrFlags = AttributeFlags.None;
            if ((dirFlags & FileAttributeFlags.Compressed) != 0)
            {
                dataAttrFlags |= AttributeFlags.Compressed;
            }

            StandardInformation.InitializeNewFile(newFile, fileFlags);

            if (context.ObjectIds != null)
            {
                Guid newId = CreateNewGuid(context);
                NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
                ObjectId objId = new ObjectId();
                objId.Id = newId;
                stream.SetContent(objId);
                context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
            }

            newFile.CreateAttribute(AttributeType.Data, dataAttrFlags);

            newFile.UpdateRecordInMft();

            return newFile;
        }
Beispiel #16
0
 public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags)
 {
     return CreateNew(context, FileRecordFlags.None, dirFlags);
 }
 internal static FileAttributeFlags SetFileAttributes(FileAttributes newAttributes, FileAttributeFlags existing)
 {
     return (FileAttributeFlags)(((uint)existing & 0xFFFF0000) | ((uint)newAttributes & 0xFFFF));
 }
        internal static FileAttributes ConvertFlags(FileAttributeFlags flags, bool isDirectory)
        {
            FileAttributes result = (FileAttributes)(((uint)flags) & 0xFFFF);

            if (isDirectory)
            {
                result |= System.IO.FileAttributes.Directory;
            }

            return result;
        }
Beispiel #19
0
 private static IntPtr GetIcon(string path,FileAttributeFlags attrFlags, SHGetFileInfoFlags dwFlag)
 {
     SHFILEINFO fi = new SHFILEINFO();
     int iTotal = (int)SHGetFileInfo(path, attrFlags, ref fi, 0, dwFlag);
     return fi.hIcon;
 }
Beispiel #20
0
 public static extern IntPtr SHGetFileInfo(
     string pszPath,
     FileAttributeFlags dwFileAttributes, 
     ref SHFILEINFO psfi,
     uint cbSizeFileInfo, 
     SHGetFileInfoFlags uFlags);
        internal static FileAttributeFlags SetAttributes(FileAttributes attrs, FileAttributeFlags flags)
        {
            FileAttributes attrMask = ((FileAttributes)0xFFFF) & ~FileAttributes.Directory;

            return((FileAttributeFlags)(((uint)flags & 0xFFFF0000) | (uint)(attrs & attrMask)));
        }
Beispiel #22
0
 internal static FileAttributeFlags SetFileAttributes(FileAttributes newAttributes, FileAttributeFlags existing)
 {
     return((FileAttributeFlags)(((uint)existing & 0xFFFF0000) | ((uint)newAttributes & 0xFFFF)));
 }