Beispiel #1
0
        private void ScanMtf(ScanningState state, CancellationToken token)
        {
            Dictionary <uint, FileNodeIndexes> fileNodes = new Dictionary <uint, FileNodeIndexes>();

            DriveInfo driveInfo = new DriveInfo(Path.GetPathRoot(state.RootPath));

            using (NtfsReader ntfs = new NtfsReader(driveInfo, RetrieveMode.StandardInformations)) {
                ReadMft(state, ntfs, fileNodes, token);
            }

            foreach (FileNodeIndexes indexes in fileNodes.Values)
            {
                FileNodeBase node = indexes.FileNode;
                //if (node.Type == FileNodeType.File)
                //	document.Extensions.Include(node.Extension, node.Size);
                if (indexes.NodeIndex == indexes.ParentNodeIndex)
                {
                    // This must be a root
                }
                else if (fileNodes.TryGetValue(indexes.ParentNodeIndex, out var parentIndexes))
                {
                    ((FolderNode)parentIndexes.FileNode).AddChild(node,
                                                                  ref parentIndexes.FileCollection, ref parentIndexes.SingleFile);
                }
                SuspendCheck();
                if (token.IsCancellationRequested)
                {
                    return;
                }
            }
        }
        private async void DrvCombo_SelectionChanged(object sender,
                                                     System.Windows.Controls.SelectionChangedEventArgs e)
        {
            if (DrvCombo.SelectedItem != null)
            {
                var driveToAnalyze = (DriveInfo)DrvCombo.SelectedItem;
                DrvCombo.IsEnabled = false;
                StatusTxt.Text     = "Analyzing drive";
                List <INode> nodes = null;
                await Task.Factory.StartNew(() =>
                {
                    var ntfsReader =
                        new NtfsReader(driveToAnalyze, RetrieveMode.All);
                    nodes =
                        ntfsReader.GetNodes(driveToAnalyze.Name)
                        .Where(n => (n.Attributes &
                                     (Attributes.Hidden | Attributes.System |
                                      Attributes.Temporary | Attributes.Device |
                                      Attributes.Directory | Attributes.Offline |
                                      Attributes.ReparsePoint | Attributes.SparseFile)) == 0)
                        .OrderByDescending(n => n.Size).ToList();
                });

                FilesList.ItemsSource = nodes;
                _view = (CollectionView)CollectionViewSource.GetDefaultView(FilesList.ItemsSource);

                DrvCombo.IsEnabled = true;
                StatusTxt.Text     = $"{nodes.Count} files listed. " +
                                     $"Total size: {nodes.Sum(n => (double)n.Size):N0}";
            }
            else
            {
                _view = null;
            }
        }
Beispiel #3
0
        //[PrincipalPermission(SecurityAction.Demand, Role = @"BUILTIN\Administrators")]
        #endregion

        public void ntfsread(IProgress <int> progress, IProgress <string> fase, bool update)
        {
            string[] drivetoscan = DiskInfo.listDrive().ToArray();
            createDB(update);

            SharedVar.listScore = getAllIndexProcess();

            int i = 1;

            foreach (string drive in drivetoscan)
            {
                progress?.Report(i * 100 / drivetoscan.Length - 1);
                fase?.Report("Indexing Drive " + drive + ":\\ in progress. Please wait a few seconds.");
                Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));

                DriveInfo driveToAnalyze = new DriveInfo(drive);

                NtfsReader ntfsReader =
                    new NtfsReader(driveToAnalyze, RetrieveMode.All);

                IEnumerable <INode> nodes =
                    ntfsReader.GetNodes(driveToAnalyze.Name)
                    .Where(n => (n.Attributes &
                                 (Attributes.Hidden | Attributes.System |
                                  Attributes.Temporary | Attributes.Device |
                                  Attributes.Directory | Attributes.Offline |
                                  Attributes.ReparsePoint | Attributes.SparseFile)) == 0)
                    .OrderByDescending(n => n.Size);
                ntfsReader.Dispose();

                InsertNodes(nodes, driveToAnalyze, update);
                i++;
            }
        }
        private void ScanMtf(ScanningState state, CancellationToken token)
        {
            FileNodeIndexes[]      fileItemsLookup;
            List <FileNodeIndexes> fileItems = new List <FileNodeIndexes>();

            DriveInfo driveInfo = new DriveInfo(Path.GetPathRoot(state.RootPath));

            using (NtfsReader ntfs = new NtfsReader(driveInfo, RetrieveMode.StandardInformations)) {
                fileItemsLookup = new FileNodeIndexes[ntfs.NodeCount];
                ReadMft(state, ntfs, fileItemsLookup, fileItems, token);
            }

            foreach (FileNodeIndexes indexes in fileItems)
            {
                FileItemBase    item          = indexes.FileItem;
                FileNodeIndexes parentIndexes = fileItemsLookup[indexes.ParentNodeIndex];
                if (indexes.NodeIndex == indexes.ParentNodeIndex)
                {
                    // This must be the drive root
                }
                else if (parentIndexes != null)
                {
                    ((FolderItem)parentIndexes.FileItem).AddItem(item,
                                                                 ref parentIndexes.FileCollection, ref parentIndexes.FirstFile);
                }
                else
                {
                    // This must be the root
                }
                if (AsyncChecks(token))
                {
                    return;
                }
            }
        }
Beispiel #5
0
        private async Task <List <UserSpaceModel> > GetProfilesSizesAsync(string usersPath = "C:\\Users")
        {
            return(await Task.Run(() =>
            {
                var driveToAnalyze = new DriveInfo(Path.GetPathRoot(usersPath));
                var trimmedUserPath = usersPath.Replace('/', '\\').Trim('"', '\\');

                List <UserSpaceModel> nodes;
                using (var ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.Minimal))
                {
                    nodes = ntfsReader.GetNodes(usersPath)
                            .AsParallel()
                            .Where(node => (node.Attributes & Attributes.Directory) == 0)
                            .ToLookup(x => x.FullName
                                      .Substring(trimmedUserPath.Length)
                                      .Split('\\')
                                      .ElementAtOrDefault(1) ?? ".")
                            .Where(x => !x.Key.Contains(".LOG", StringComparison.OrdinalIgnoreCase))
                            .OrderBy(x => x.Key)
                            .Select(gr => new UserSpaceModel
                    {
                        Username = gr.Key,
                        UsedSpaceBytes = gr.Aggregate <INode, ulong>(0, (a, c) => a + c.Size)
                    })
                            .ToList();
                }

                return nodes;
            }));
        }
Beispiel #6
0
        private void bw_DoWork(object sender, DoWorkEventArgs e)
        {
            DriveInfo  driveToAnalyze = new DriveInfo("c");
            NtfsReader ntfsReader     =
                new NtfsReader(driveToAnalyze, RetrieveMode.All);

            IEnumerable <INode> nodes =
                ntfsReader.GetNodes(driveToAnalyze.Name);

            foreach (INode node in nodes)
            {
                ListViewItem lvi = new ListViewItem();

                lvi.Tag  = node;
                lvi.Text = node.Name;
                lvi.SubItems.Add(node.FullName);
                lvi.SubItems.Add(node.Size.ToString());
                lvi.SubItems.Add(node.LastChangeTime.ToString());

                allItems.Add(lvi);

                if (filecount++ % 1000 == 0)
                {
                    bw.ReportProgress(filecount);
                }
            }

            allItems.Sort((x, y) => string.Compare(x.Text, y.Text));
        }
Beispiel #7
0
        private void ReadMft(ScanningState state, NtfsReader ntfs, Dictionary <uint, FileNodeIndexes> fileNodes,
                             CancellationToken token)
        {
            foreach (INtfsNode node in ntfs.EnumerateNodes(state.RootPath))
            {
                string fullPath = PathUtils.TrimSeparatorDotEnd(node.FullName);
                bool   isRoot   = (node.NodeIndex == node.ParentNodeIndex);
                if (!isRoot && SkipFile(state, Path.GetFileName(fullPath), fullPath))
                {
                    continue;
                }
                FileNodeBase child;
                if (isRoot)
                {
                    child = state.Root;

                    /*state.Root = new RootNode(document, node, IsSingle);
                     * child = state.Root;
                     * // Let the user know that the root was found
                     * SetupRoot(state.Root, rootSetup);*/
                }
                else if (node.Attributes.HasFlag(FileAttributes.Directory))
                {
                    if (!state.IsDrive && state.RootPath == node.FullName.ToUpperInvariant())
                    {
                        child = state.Root;

                        /*state.Root = new RootNode(document, node, IsSingle);
                         * child = state.Root;
                         * // Let the user know that the root was found
                         * SetupRoot(state.Root, rootSetup);*/
                    }
                    else
                    {
                        child = new FolderNode(node);
                    }
                }
                else
                {
                    FileNode file = new FileNode(node);
                    child = file;
                    if (!node.Attributes.HasFlag(FileAttributes.ReparsePoint))
                    {
                        state.ScannedSize += child.Size;
                        totalScannedSize  += child.Size;
                    }
                    file.extRecord = extensions.Include(GetExtension(file.Name), child.Size);
                }
                fileNodes[node.NodeIndex] = new FileNodeIndexes(child, node);
                SuspendCheck();
                if (token.IsCancellationRequested)
                {
                    return;
                }
            }
        }
        private async void BuildFileIndex()
        {
            Stopwatch stopwatch = new Stopwatch();

            stopwatch.Start();
            _State = eState.NotReady;
            string[]    FixedDrives  = GetFixedDriveNames();
            List <Task> PrepareTasks = new List <Task>();

            foreach (var FixedDrive in FixedDrives)
            {
                Task Prepare = Task.Run(() =>
                {
                    try
                    {
                        LogStatics.Debug("begin analyze ntfs drive : {0}", FixedDrive);
                        DriveInfo driveToAnalyze  = new DriveInfo(FixedDrive);
                        NtfsReader ntfsReader     = new NtfsReader(driveToAnalyze, RetrieveMode.Minimal);
                        IEnumerable <INode> nodes = ntfsReader.GetNodes(driveToAnalyze.Name);
                        return(nodes.ToArray());
                    }
                    catch (Exception ex)
                    {
                        LogStatics.Warn("failue analyze ntfs drive : {0} {1}", FixedDrive, ex);
                    }
                    finally
                    {
                        LogStatics.Debug("end analyze ntfs drive : {0}", FixedDrive);
                    }
                    return(null);
                }).ContinueWith(task =>
                {
                    try
                    {
                        LogStatics.Debug("begin build ntfs drive : {0}", FixedDrive);
                        BuildIndexDictionary(task.Result, ref _IndexDictionary);
                    }
                    catch (Exception ex)
                    {
                        LogStatics.Warn("failue build ntfs drive : {0} {1}", FixedDrive, ex);
                    }
                    finally
                    {
                        LogStatics.Debug("end build ntfs drive : {0}", FixedDrive);
                    }
                });
                PrepareTasks.Add(Prepare);
            }
            await Task.WhenAll(PrepareTasks);

            GC.Collect();
            _State = eState.Ready;
            RaiseOnInitializeComplate();
            LogStatics.Debug("file finder total file index build time {0} ms", (float)stopwatch.ElapsedTicks / TimeSpan.TicksPerMillisecond);
        }
Beispiel #9
0
        private IEnumerable <INode> GetAllNodesFromDrive()
        {
            DriveInfo driveToAnalyze = new DriveInfo(Path);

            NtfsReader ntfsReader =
                new NtfsReader(driveToAnalyze, RetrieveMode.All);

            IEnumerable <INode> nodes =
                ntfsReader.GetNodes(driveToAnalyze.Name);

            return(nodes);
        }
        private void ReadMft(ScanningState state, NtfsReader ntfs, FileNodeIndexes[] fileItemsLookup,
                             List <FileNodeIndexes> fileItems, CancellationToken token)
        {
            foreach (INtfsNode node in ntfs.EnumerateNodes(state.RootPath))
            {
                string fullPath = PathUtils.TrimSeparatorDotEnd(node.FullName);
                bool   isRoot   = (node.NodeIndex == node.ParentNodeIndex);
                if (!isRoot && SkipFile(state, Path.GetFileName(fullPath), fullPath))
                {
                    continue;
                }
                FileItemBase child;
                bool         reparsePoint = node.Attributes.HasFlag(FileAttributes.ReparsePoint);
                if (isRoot)
                {
                    child = state.Root;
                }
                else if (node.Attributes.HasFlag(FileAttributes.Directory))
                {
                    if (!state.IsDrive && state.RootPath == node.FullName.ToUpperInvariant())
                    {
                        child = state.Root;
                    }
                    else
                    {
                        child = new FolderItem(new ScanFileInfo(node));
                    }
                }
                else
                {
                    ExtensionItem extension = Extensions.GetOrAddFromPath(node.Name);
                    FileItem      file      = new FileItem(new ScanFileInfo(node), extension);
                    child = file;
                    if (!reparsePoint)
                    {
                        TotalScannedSize += child.Size;
                    }
                }
                FileNodeIndexes indexes = new FileNodeIndexes(child, node);
                fileItemsLookup[node.NodeIndex] = indexes;

                if (!reparsePoint)
                {
                    fileItems.Add(indexes);
                }

                if (AsyncChecks(token))
                {
                    return;
                }
            }
        }
        private static IEnumerable <INode> GetFileNodes(DriveInfo driveToAnalyze)
        {
            var ntfsReader =
                new NtfsReader(driveToAnalyze, RetrieveMode.All);

            return
                (ntfsReader.GetNodes(driveToAnalyze.Name)
                 .Where(n => (n.Attributes &
                              (Attributes.Hidden | Attributes.System |
                               Attributes.Temporary | Attributes.Device |
                               Attributes.Directory | Attributes.Offline |
                               Attributes.ReparsePoint | Attributes.SparseFile)) == 0));
        }
        public static IEnumerable <INode> EnumerateMft(DriveInfo driveToAnalyze)
        {
            NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);

            IEnumerable <INode> nodes =
                ntfsReader.GetNodes(driveToAnalyze.Name)
                .Where(n => (n.Attributes &
                             (
                                 NtfsNodeAttributes.Device
                                 | NtfsNodeAttributes.Directory
                                 | NtfsNodeAttributes.ReparsePoint
                                 | NtfsNodeAttributes.SparseFile
                             )
                             ) == 0);    // This means that we DONT want any matches of the above NtfsNodeAttributes types.

            //.OrderByDescending(n => n.Size);

            return(nodes);
        }
Beispiel #13
0
        public static IEnumerable <INode> EnumerateFiles(ScanParameters parameters)
        {
            parameters.CancelToken.ThrowIfCancellationRequested();

            StringBuilder currentPath = new StringBuilder(parameters.SelectedFolder);
            string        lastParent  = currentPath.ToString();

            string temp = currentPath.ToString();

            if (temp.Contains(':') && (temp.Length == 2 || temp.Length == 3))             // Is a root directory, i.e. "C:" or "C:\"
            {
                lastParent = ".";
            }

            string drive = parameters.SelectedFolder[0].ToString().ToUpper();

            List <DriveInfo> ntfsDrives = DriveInfo.GetDrives().Where(d => d.IsReady && d.DriveFormat == "NTFS").ToList();

            DriveInfo driveToAnalyze = ntfsDrives.Where(dr => dr.Name.ToUpper().Contains(drive)).Single();

            NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);

            IEnumerable <INode> mftNodes =
                ntfsReader.GetNodes(driveToAnalyze.Name)
                .Where(node =>
                       (node.Attributes &
                        (NtfsNodeAttributes.Device
                         | NtfsNodeAttributes.Directory
                         | NtfsNodeAttributes.ReparsePoint
                         | NtfsNodeAttributes.SparseFile
                        )
                       ) == 0)                                  // This means that we DONT want any matches of the above NtfsNodeAttributes type
                .Where(node => FileMatchesPattern(node.FullName, parameters.SearchPatterns));

            if (parameters.SelectedFolder.ToCharArray().Length > 3)
            {
                string selectedFolderUppercase = parameters.SelectedFolder.ToUpperInvariant().TrimEnd(new char[] { '\\' });
                mftNodes = mftNodes.Where(node => node.FullName.ToUpperInvariant().Contains(selectedFolderUppercase));
            }

            return(mftNodes);
        }
Beispiel #14
0
        static void Main(string[] args)
        {
            Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));

            DriveInfo driveToAnalyze = new DriveInfo("c");

            NtfsReader ntfsReader =
                new NtfsReader(driveToAnalyze, RetrieveMode.All);

            IEnumerable <INode> nodes =
                ntfsReader.GetNodes(driveToAnalyze.Name);

            int directoryCount = 0, fileCount = 0;

            foreach (INode node in nodes)
            {
                if ((node.Attributes & Attributes.Directory) != 0)
                {
                    directoryCount++;
                }
                else
                {
                    fileCount++;
                }
            }

            Console.WriteLine(
                string.Format(
                    "Directory Count: {0}, File Count {1}",
                    directoryCount,
                    fileCount
                    )
                );

            AnalyzeFragmentation(nodes, driveToAnalyze);

            AnalyzeSimilarity(nodes, driveToAnalyze);

            Console.ReadKey();
        }
Beispiel #15
0
        public List <DeletedFile> getFiles()
        {
            NtfsReader          ntfsReader = new NtfsReader(this.DriveInfo, RetrieveMode.All);
            IEnumerable <INode> nodes      =
                ntfsReader.GetNodes(this.DriveInfo.Name);

            int directoryCount = 0, fileCount = 0;

            this.DeletedFiles.Clear();
            foreach (INode node in nodes)
            {
                if ((node.Attributes & Attributes.Directory) != 0)
                {
                    directoryCount++;
                }
                else
                {
                    this.DeletedFiles.Add(new DeletedFile(node.Name, node.FullName, node.CreationTime, node.LastChangeTime, node.LastAccessTime, node.Size));
                    fileCount++;
                }
            }
            return(this.DeletedFiles);
        }
Beispiel #16
0
        private static FileEnumeratorReport Worker(FileEnumeratorParameters parameters)
        {
            TimingMetrics    timingMetrics       = new TimingMetrics();
            FailSuccessCount fileEnumCount       = new FailSuccessCount("OS files enumerated");
            FailSuccessCount databaseInsertCount = new FailSuccessCount("OS database rows updated");

            try
            {
                parameters.CancelToken.ThrowIfCancellationRequested();

                StringBuilder currentPath = new StringBuilder(parameters.SelectedFolder);
                string        lastParent  = currentPath.ToString();

                string temp = currentPath.ToString();
                if (temp.Contains(':') && (temp.Length == 2 || temp.Length == 3))                 // Is a root directory, i.e. "C:" or "C:\"
                {
                    lastParent = ".";
                }

                string drive = parameters.SelectedFolder[0].ToString().ToUpper();

                timingMetrics.Start(TimingMetric.ParsingMFT);

                List <DriveInfo> ntfsDrives = DriveInfo.GetDrives().Where(d => d.IsReady && d.DriveFormat == "NTFS").ToList();

                DriveInfo driveToAnalyze = ntfsDrives.Where(dr => dr.Name.ToUpper().Contains(drive)).Single();

                NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);

                IEnumerable <INode> mftNodes =
                    ntfsReader.GetNodes(driveToAnalyze.Name)
                    .Where(node => (node.Attributes &
                                    (NtfsNodeAttributes.Device
                                     | NtfsNodeAttributes.Directory
                                     | NtfsNodeAttributes.ReparsePoint
                                     | NtfsNodeAttributes.SparseFile
                                    )) == 0)                                      // This means that we DONT want any matches of the above NtfsNodeAttributes type
                    .Where(node => FileMatchesPattern(node.FullName, parameters.SearchPatterns));
                //.OrderByDescending(n => n.Size);

                if (parameters.SelectedFolder.ToCharArray().Length > 3)
                {
                    string selectedFolderUppercase = parameters.SelectedFolder.ToUpperInvariant().TrimEnd(new char[] { '\\' });
                    mftNodes = mftNodes.Where(node => node.FullName.ToUpperInvariant().Contains(selectedFolderUppercase));
                }

                timingMetrics.Stop(TimingMetric.ParsingMFT);

                IDataPersistenceLayer dataPersistenceLayer = parameters.DataPersistenceLayer;

                foreach (INode node in mftNodes)
                {
                    string message = $"MFT#: {node.MFTRecordNumber.ToString().PadRight(7)} Seq.#: {node.SequenceNumber.ToString().PadRight(4)} Path: {node.FullName}";

                    parameters.ReportAndLogOutputFunction.Invoke(message);

                    fileEnumCount.IncrementSucceededCount();

                    FileProperties prop = new FileProperties();
                    prop.PopulateFileProperties(parameters, parameters.SelectedFolder[0], node, timingMetrics);

                    // INSERT file properties into _DATABASE_
                    timingMetrics.Start(TimingMetric.PersistingFileProperties);
                    bool insertResult = dataPersistenceLayer.PersistFileProperties(prop);
                    if (insertResult)
                    {
                        databaseInsertCount.IncrementSucceededCount();
                    }
                    else
                    {
                        databaseInsertCount.IncrementFailedCount();
                    }
                    timingMetrics.Stop(TimingMetric.PersistingFileProperties);

                    parameters.CancelToken.ThrowIfCancellationRequested();
                }

                dataPersistenceLayer.Dispose();
                FileProperties.CleanUp();
            }
            catch (OperationCanceledException)
            { }

            return(new FileEnumeratorReport(new List <FailSuccessCount> {
                fileEnumCount, databaseInsertCount
            }, timingMetrics));
        }
Beispiel #17
0
 public StreamWrapper(NtfsReader reader, NodeWrapper parentNode, int streamIndex)
 {
     _reader      = reader;
     _parentNode  = parentNode;
     _streamIndex = streamIndex;
 }
Beispiel #18
0
 public NodeWrapper(NtfsReader reader, UInt32 nodeIndex, Node node)
 {
     _reader    = reader;
     _nodeIndex = nodeIndex;
     _node      = node;
 }