public FileRecordSegment(byte[] buffer, int offset, long segmentNumber)
{
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00);
if (multiSectorHeader.Signature != ValidSignature)
{
throw new InvalidDataException("Invalid FILE record signature");
}
LogFileSequenceNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x08);
m_sequenceNumber = LittleEndianConverter.ToUInt16(buffer, offset + 0x10);
ReferenceCount = LittleEndianConverter.ToUInt16(buffer, offset + 0x12);
ushort firstAttributeOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x14);
m_flags = (FileRecordFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x16);
uint segmentLength = LittleEndianConverter.ToUInt32(buffer, offset + 0x18);
uint segmentAllocatedLength = LittleEndianConverter.ToUInt32(buffer, offset + 0x1C);
m_baseFileRecordSegment = new MftSegmentReference(buffer, offset + 0x20);
NextAttributeInstance = LittleEndianConverter.ToUInt16(buffer, offset + 0x28);
// 2 bytes padding
m_segmentNumberOnDisk = LittleEndianConverter.ToUInt32(buffer, offset + 0x2C);
int position = offset + multiSectorHeader.UpdateSequenceArrayOffset;
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber);
MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData);
// Read attributes
position = offset + firstAttributeOffset;
while (!IsEndMarker(buffer, position))
{
AttributeRecord attribute = AttributeRecord.FromBytes(buffer, position);
m_immediateAttributes.Add(attribute);
position += (int)attribute.RecordLengthOnDisk;
if (position > buffer.Length)
{
throw new InvalidDataException("Invalid attribute length");
}
}
m_segmentNumber = segmentNumber;
}
public IndexRecord(byte[] buffer, int offset)
{
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00);
if (multiSectorHeader.Signature != ValidSignature)
{
throw new InvalidDataException("Invalid INDX record signature");
}
LogFileSequenceNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x08);
RecordVBN = (long)LittleEndianConverter.ToUInt64(buffer, offset + 0x10);
m_indexHeader = new IndexHeader(buffer, offset + 0x18);
int position = offset + multiSectorHeader.UpdateSequenceArrayOffset;
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber);
MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData);
int entriesOffset = 0x18 + (int)m_indexHeader.EntriesOffset;
IndexEntries = IndexEntry.ReadIndexEntries(buffer, entriesOffset);
}
public LogRecordPage(byte[] buffer, int offset, int dataOffset)
{
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00);
if (multiSectorHeader.Signature != ValidSignature)
{
throw new InvalidDataException("Invalid RCRD record signature");
}
LastLsnOrFileOffset = LittleEndianConverter.ToUInt64(buffer, offset + 0x08);
Flags = (LogRecordPageFlags)LittleEndianConverter.ToUInt32(buffer, offset + 0x10);
PageCount = LittleEndianConverter.ToUInt16(buffer, offset + 0x14);
PagePosition = LittleEndianConverter.ToUInt16(buffer, offset + 0x16);
ushort nextRecordOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x18);
LastEndLsn = LittleEndianConverter.ToUInt64(buffer, offset + 0x20);
int position = offset + multiSectorHeader.UpdateSequenceArrayOffset;
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber);
MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData);
Data = ByteReader.ReadBytes(buffer, offset + dataOffset, (int)(nextRecordOffset - dataOffset));
}
public LogRestartPage(byte[] buffer, int offset)
{
MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00);
if (multiSectorHeader.Signature != ValidSignature)
{
throw new InvalidDataException("Invalid RSTR record signature");
}
ChkDskLsn = LittleEndianConverter.ToUInt64(buffer, offset + 0x08);
m_systemPageSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x10);
LogPageSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x14);
ushort restartOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x18);
MinorVersion = LittleEndianConverter.ToInt16(buffer, offset + 0x1A);
MajorVersion = LittleEndianConverter.ToInt16(buffer, offset + 0x1C);
int position = offset + multiSectorHeader.UpdateSequenceArrayOffset;
List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber);
MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData);
LogRestartArea = new LogRestartArea(buffer, offset + restartOffset);
}