Beispiel #1
0
        private void LoadData(MFTLoadDepth loadDepth = MFTLoadDepth.Full)
        {
            if (loadDepth.CompareTo(_dataLoaded) <= 0)
            {
                // If we're not loading more than we already have, just stop here.
                return;
            }

            string Magic = Encoding.ASCII.GetString(_data, 0, 4);

            if (!Magic.Equals("FILE"))
            {
                Console.Error.WriteLine("Warning: MFT record number {0} was missing the 'FILE' header. Skipping.", RecordNum);
                // This record is invalid, so don't read any more.
                Valid = false;
                return;
            }

            ushort updateSequenceOffset = BitConverter.ToUInt16(_data, 4);
            ushort updateSequenceLength = BitConverter.ToUInt16(_data, 6);

            ushort updateSequenceNumber = BitConverter.ToUInt16(_data, updateSequenceOffset);

            ushort[] updateSequenceArray = new ushort[updateSequenceLength - 1];
            ushort   read = 1;

            while (read < updateSequenceLength)
            {
                updateSequenceArray[read - 1] = BitConverter.ToUInt16(_data, (ushort)(updateSequenceOffset + read * 2));
                read++;
            }

            // Apply fixups to the in-memory array
            try {
                FixupStream.FixArray(_data, updateSequenceNumber, updateSequenceArray, (int)BytesPerSector);
            } catch (NTFSFixupException e) {
                Console.Error.WriteLine(e);
                // This record is invalid, so don't read any more.
                Valid = false;
                return;
            }

            LoadHeader();
            LoadAttributes(AttributeOffset, loadDepth);

            if (_attributes.Count == 0)
            {
                Console.Error.WriteLine("Warning: MFT record number {0} had no attributes.", RecordNum);
            }

            _dataLoaded = loadDepth;

            // If we've loaded everything, dispose of the underlying byte array.
            if (_dataLoaded == MFTLoadDepth.Full)
            {
                _data = null;
            }
        }
		private void LoadData(MFTLoadDepth loadDepth = MFTLoadDepth.Full) {
			if (loadDepth.CompareTo(_dataLoaded) <= 0) {
				// If we're not loading more than we already have, just stop here.
				return;
			}

			string Magic = Encoding.ASCII.GetString(_data, 0, 4);
			if (!Magic.Equals("FILE")) {
				Console.Error.WriteLine("Warning: MFT record number {0} was missing the 'FILE' header. Skipping.", RecordNum);
				// This record is invalid, so don't read any more.
				Valid = false;
				return;
			}

			ushort updateSequenceOffset = BitConverter.ToUInt16(_data, 4);
			ushort updateSequenceLength = BitConverter.ToUInt16(_data, 6);

			ushort updateSequenceNumber = BitConverter.ToUInt16(_data, updateSequenceOffset);
			ushort[] updateSequenceArray = new ushort[updateSequenceLength - 1];
			ushort read = 1;
			while (read < updateSequenceLength) {
				updateSequenceArray[read - 1] = BitConverter.ToUInt16(_data, (ushort)(updateSequenceOffset + read * 2));
				read++;
			}

			// Apply fixups to the in-memory array
			try {
				FixupStream.FixArray(_data, updateSequenceNumber, updateSequenceArray, (int)BytesPerSector);
			} catch (NTFSFixupException e) {
				Console.Error.WriteLine(e);
				// This record is invalid, so don't read any more.
				Valid = false;
				return;
			}

			LoadHeader();
			LoadAttributes(AttributeOffset, loadDepth);

			if (_attributes.Count == 0) {
				Console.Error.WriteLine("Warning: MFT record number {0} had no attributes.", RecordNum);
			}

			_dataLoaded = loadDepth;

			// If we've loaded everything, dispose of the underlying byte array.
			if (_dataLoaded == MFTLoadDepth.Full) {
				_data = null;
			}
		}