/// <param name="segmentLength">This refers to the maximum length of FileRecord as defined in the Volume's BootRecord</param>
public byte[] GetBytes(int bytesPerFileRecordSegment, ushort minorNTFSVersion)
{
int strideCount = bytesPerFileRecordSegment / MultiSectorHelper.BytesPerStride;
ushort updateSequenceArraySize = (ushort)(1 + strideCount);
ushort updateSequenceArrayOffset;
if (minorNTFSVersion == 0)
{
updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset;
}
else
{
updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset;
}
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(ValidSignature, updateSequenceArrayOffset, updateSequenceArraySize);
ushort firstAttributeOffset = GetFirstAttributeOffset(bytesPerFileRecordSegment, minorNTFSVersion);
byte[] buffer = new byte[bytesPerFileRecordSegment];
multiSectorHeader.WriteBytes(buffer, 0x00);
LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x10, m_sequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x12, ReferenceCount);
LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset);
LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags);
LittleEndianWriter.WriteInt32(buffer, 0x1C, bytesPerFileRecordSegment);
m_baseFileRecordSegment.WriteBytes(buffer, 0x20);
LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeInstance);
if (minorNTFSVersion == 1)
{
LittleEndianWriter.WriteUInt32(buffer, 0x2C, (uint)m_segmentNumber);
}
// write attributes
int position = firstAttributeOffset;
foreach (AttributeRecord attribute in m_immediateAttributes)
{
byte[] attributeBytes = attribute.GetBytes();
ByteWriter.WriteBytes(buffer, position, attributeBytes);
position += attributeBytes.Length;
}
byte[] marker = GetEndMarker();
ByteWriter.WriteBytes(buffer, position, marker);
position += marker.Length;
position += 4; // record (length) is aligned to 8-byte boundary
uint segmentLength = (uint)position;
LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentLength);
// Write UpdateSequenceNumber and UpdateSequenceReplacementData
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.EncodeSegmentBuffer(buffer, 0, bytesPerFileRecordSegment, UpdateSequenceNumber);
MultiSectorHelper.WriteUpdateSequenceArray(buffer, updateSequenceArrayOffset, updateSequenceArraySize, UpdateSequenceNumber, updateSequenceReplacementData);
return(buffer);
}
public override void WriteBytes(byte[] buffer, int offset)
{
LittleEndianWriter.WriteUInt32(buffer, offset + 0x00, AllocatedOrNextFree);
ByteWriter.WriteByte(buffer, offset + 0x04, (byte)TransactionState);
LittleEndianWriter.WriteUInt64(buffer, offset + 0x08, FirstLsn);
LittleEndianWriter.WriteUInt64(buffer, offset + 0x10, PreviousLsn);
LittleEndianWriter.WriteUInt64(buffer, offset + 0x18, UndoNextLsn);
LittleEndianWriter.WriteUInt32(buffer, offset + 0x20, UndoRecords);
LittleEndianWriter.WriteInt32(buffer, offset + 0x24, UndoBytes);
}
public override void WriteDataBytes(byte[] buffer, ref int offset)
{
ByteWriter.WriteByte(buffer, offset + 0, (byte)btype);
ByteWriter.WriteByte(buffer, offset + 1, cLevel);
LittleEndianWriter.WriteInt32(buffer, offset + 2, rgentries.Count);
offset = 8;
for (int index = 0; index < rgentries.Count; index++)
{
rgentries[index].WriteBytes(buffer, offset);
offset += SubnodeIntermediateEntry.Length;
}
}
public override void WriteDataBytes(byte[] buffer, ref int offset)
{
ByteWriter.WriteByte(buffer, offset + 0, (byte)btype);
ByteWriter.WriteByte(buffer, offset + 1, (byte)cLevel);
LittleEndianWriter.WriteInt32(buffer, offset + 2, rgbid.Count);
LittleEndianWriter.WriteUInt32(buffer, offset + 4, lcbTotal);
offset = 8;
for (int index = 0; index < rgbid.Count; index++)
{
LittleEndianWriter.WriteUInt64(buffer, offset, rgbid[index].Value);
offset += 8;
}
}
public byte[] GetBytes()
{
byte[] buffer = new byte[Length];
LittleEndianWriter.WriteInt32(buffer, 0, lBias);
LittleEndianWriter.WriteInt32(buffer, 4, lStandardBias);
LittleEndianWriter.WriteInt32(buffer, 8, lDaylightBias);
LittleEndianWriter.WriteUInt16(buffer, 12, stStandardDate.wYear);
stStandardDate.WriteBytes(buffer, 14);
LittleEndianWriter.WriteUInt16(buffer, 30, stDaylightDate.wYear);
stDaylightDate.WriteBytes(buffer, 32);
return(buffer);
}
public void WriteBytes(byte[] buffer, int offset)
{
ByteWriter.WriteByte(buffer, offset + 0, MajorVersion);
ByteWriter.WriteByte(buffer, offset + 1, MinorVersion);
LittleEndianWriter.WriteUInt16(buffer, offset + 2, Reserved);
LittleEndianWriter.WriteUInt16(buffer, offset + 4, (ushort)TZRuleFlags);
LittleEndianWriter.WriteUInt16(buffer, offset + 6, wYear);
// 14 unused bytes
LittleEndianWriter.WriteInt32(buffer, offset + 22, lBias);
LittleEndianWriter.WriteInt32(buffer, offset + 26, lStandardBias);
LittleEndianWriter.WriteInt32(buffer, offset + 30, lDaylightBias);
stStandardDate.WriteBytes(buffer, offset + 34);
stDaylightDate.WriteBytes(buffer, offset + 50);
}
// ExtendedException Structure:
// http://msdn.microsoft.com/en-us/library/ee159855%28v=exchg.80%29
public void WriteExtendedException(Stream stream, WriterCompatibilityMode writerCompatibilityMode)
{
if (writerCompatibilityMode >= WriterCompatibilityMode.Outlook2007RTM)
{
// Change highlight structure:
uint changeHighlightSize = 4;
LittleEndianWriter.WriteUInt32(stream, changeHighlightSize);
int changeHighlightValue = 0; // Apparently Outlook 2010 uses 0 regardless of the actual changes
LittleEndianWriter.WriteInt32(stream, changeHighlightValue);
}
uint reservedBlockEE1Size = 0;
LittleEndianWriter.WriteUInt32(stream, reservedBlockEE1Size);
if (HasModifiedSubject || HasModifiedLocation)
{
DateTimeHelper.WriteDateTimeInMinutes(stream, NewStartDT);
DateTimeHelper.WriteDateTimeInMinutes(stream, NewEndDT);
DateTimeHelper.WriteDateTimeInMinutes(stream, OriginalStartDT);
if (HasModifiedSubject)
{
LittleEndianWriter.WriteUInt16(stream, (ushort)Subject.Length);
ByteWriter.WriteBytes(stream, Encoding.Unicode.GetBytes(Subject));
}
if (HasModifiedLocation)
{
LittleEndianWriter.WriteUInt16(stream, (ushort)Location.Length);
ByteWriter.WriteBytes(stream, Encoding.Unicode.GetBytes(Location));
}
uint reservedBlockEE2Size = 0;
LittleEndianWriter.WriteUInt32(stream, reservedBlockEE2Size);
}
}
/// <param name="segmentLength">This refers to the maximum length of FileRecord as defined in the Volume's BootRecord</param>
public byte[] GetBytes(int segmentLength, int bytesPerCluster, ushort minorNTFSVersion)
{
int strideCount = segmentLength / MultiSectorHelper.BytesPerStride;
ushort updateSequenceArraySize = (ushort)(1 + strideCount);
ushort updateSequenceArrayOffset;
if (minorNTFSVersion == 0)
{
updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset;
}
else
{
updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset;
}
ushort firstAttributeOffset = GetFirstAttributeOffset(segmentLength, minorNTFSVersion);
byte[] buffer = new byte[segmentLength];
ByteWriter.WriteAnsiString(buffer, 0, Signature, 4);
LittleEndianWriter.WriteUInt16(buffer, 0x04, updateSequenceArrayOffset);
LittleEndianWriter.WriteUInt16(buffer, 0x06, updateSequenceArraySize);
LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x10, SequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x12, HardLinkCount);
LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset);
LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags);
LittleEndianWriter.WriteInt32(buffer, 0x1C, segmentLength);
LittleEndianWriter.WriteUInt64(buffer, 0x20, BaseFileRecordSegmentNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeId);
if (minorNTFSVersion == 1)
{
LittleEndianWriter.WriteUInt32(buffer, 0x2C, MftSegmentNumberXP);
}
// write attributes
int position = firstAttributeOffset;
foreach (AttributeRecord attribute in m_immediateAttributes)
{
byte[] attributeBytes = attribute.GetBytes(bytesPerCluster);
ByteWriter.WriteBytes(buffer, position, attributeBytes);
position += attributeBytes.Length;
}
byte[] marker = GetEndMarker();
ByteWriter.WriteBytes(buffer, position, marker);
position += marker.Length;
position += 4; // record (length) is aligned to 8-byte boundary
uint segmentRealSize = (uint)position;
LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentRealSize);
// write UpdateSequenceNumber and UpdateSequenceReplacementData
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.EncodeSegmentBuffer(buffer, 0, segmentLength, UpdateSequenceNumber);
position = updateSequenceArrayOffset;
LittleEndianWriter.WriteUInt16(buffer, position, UpdateSequenceNumber);
position += 2;
foreach (byte[] endOfSectorBytes in updateSequenceReplacementData)
{
ByteWriter.WriteBytes(buffer, position, endOfSectorBytes);
position += 2;
}
return(buffer);
}
public byte[] GetBytes(int bytesPerFileRecordSegment, ushort minorNTFSVersion, bool applyUsaProtection)
{
int strideCount = bytesPerFileRecordSegment / MultiSectorHelper.BytesPerStride;
ushort updateSequenceArraySize = (ushort)(1 + strideCount);
ushort updateSequenceArrayOffset;
if (minorNTFSVersion == 0)
{
updateSequenceArrayOffset = NTFS30UpdateSequenceArrayOffset;
}
else
{
updateSequenceArrayOffset = NTFS31UpdateSequenceArrayOffset;
}
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(ValidSignature, updateSequenceArrayOffset, updateSequenceArraySize);
ushort firstAttributeOffset = GetFirstAttributeOffset(bytesPerFileRecordSegment, minorNTFSVersion);
int length = applyUsaProtection ? bytesPerFileRecordSegment : GetNumberOfBytesInUse(bytesPerFileRecordSegment, minorNTFSVersion);
byte[] buffer = new byte[length];
multiSectorHeader.WriteBytes(buffer, 0x00);
LittleEndianWriter.WriteUInt64(buffer, 0x08, LogFileSequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x10, m_sequenceNumber);
LittleEndianWriter.WriteUInt16(buffer, 0x12, ReferenceCount);
LittleEndianWriter.WriteUInt16(buffer, 0x14, firstAttributeOffset);
LittleEndianWriter.WriteUInt16(buffer, 0x16, (ushort)m_flags);
LittleEndianWriter.WriteInt32(buffer, 0x1C, bytesPerFileRecordSegment);
m_baseFileRecordSegment.WriteBytes(buffer, 0x20);
LittleEndianWriter.WriteUInt16(buffer, 0x28, NextAttributeInstance);
if (minorNTFSVersion == 1)
{
LittleEndianWriter.WriteUInt32(buffer, 0x2C, (uint)m_segmentNumber);
}
LittleEndianWriter.WriteUInt32(buffer, updateSequenceArrayOffset, UpdateSequenceNumber);
// write attributes
int position = firstAttributeOffset;
foreach (AttributeRecord attribute in m_immediateAttributes)
{
byte[] attributeBytes = attribute.GetBytes();
ByteWriter.WriteBytes(buffer, position, attributeBytes);
position += attributeBytes.Length;
}
LittleEndianWriter.WriteUInt32(buffer, position, AttributesEndMarker);
position += AttributesEndMarkerLength; // End marker + alignment to 8-byte boundary
uint segmentLength = (uint)position;
LittleEndianWriter.WriteUInt32(buffer, 0x18, segmentLength);
if (applyUsaProtection)
{
MultiSectorHelper.ApplyUsaProtection(buffer, 0);
}
return(buffer);
}