internal byte[] GetContent(NtfsVolumeBootRecord VBR)
{
foreach (FileRecordAttribute attr in this.Attribute)
{
if (attr.Name == FileRecordAttribute.ATTR_TYPE.DATA)
{
if (attr.NonResident)
{
return((attr as NonResident).GetBytes(VBR));
}
else
{
return((attr as Data).RawData);
}
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST)
{
AttributeList attrlist = attr as AttributeList;
foreach (AttrRef ar in attrlist.AttributeReference)
{
if (ar.Name == "DATA")
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, (int)VBR.BytesPerFileRecord, true);
return(record.GetContent());
}
}
}
}
throw new Exception("Could not locate file contents");
}
public static byte[] GetSlackByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
byte[] bytes = record.GetContent();
return(GetSlack(bytes));
}
internal static FileRecord[] GetInstances(string volume, bool fast)
{
FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true);
byte[] mftBytes = record.GetContent();
return(GetInstances(mftBytes, volume, fast));
}
public static FileRecord[] GetInstancesTest(string volume)
{
FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true);
byte[] mftBytes = record.GetContent();
return(GetInstancesTest(mftBytes, volume));
}
public static FileRecord[] GetInstances(string volume)
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
byte[] mftBytes = record.GetContent();
return(GetInstances(mftBytes, volume));
}
/// <summary>
///
/// </summary>
/// <param name="path"></param>
/// <returns></returns>
public static FileRecord[] GetInstancesByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
byte[] mftBytes = record.GetContent();
return(GetInstances(mftBytes, Helper.GetVolumeFromPath(path), false));
}
/// <summary>
///
/// </summary>
/// <param name="volume"></param>
/// <returns></returns>
public static AttrDef[] GetInstances(string volume)
{
Helper.getVolumeName(ref volume);
FileRecord record = FileRecord.Get(volume, MftIndex.ATTRDEF_INDEX, true);
return(AttrDef.GetInstances(record.GetContent()));
}
public static FileRecord[] GetInstancesByPath(string path)
{
string volume = Util.GetVolumeFromPath(path);
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
byte[] mftBytes = record.GetContent();
return(GetInstances(mftBytes, volume));
}
internal byte[] GetContent(VolumeBootRecord VBR)
{
foreach (Attr attr in this.Attribute)
{
if (attr.Name == Attr.ATTR_TYPE.DATA)
{
if (attr.NonResident)
{
return (attr as NonResident).GetBytes(this.VolumePath, VBR);
}
else
{
return (attr as Data).RawData;
}
}
else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
{
AttributeList attrlist = attr as AttributeList;
foreach (AttrRef ar in attrlist.AttributeReference)
{
if (ar.Name == "DATA")
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
return record.GetContent();
}
}
}
}
throw new Exception("Could not locate file contents");
}
public static FileRecord[] GetInstancesByPath(string path)
{
string volume = Util.GetVolumeFromPath(path);
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
byte[] mftBytes = record.GetContent();
return GetInstances(mftBytes, volume);
}
public static FileRecord[] GetInstances(string volume)
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
byte[] mftBytes = record.GetContent();
return GetInstances(mftBytes, volume);
}
/// <summary>
///
/// </summary>
/// <param name="streamToRead"></param>
/// <param name="volume"></param>
/// <returns></returns>
internal static byte[] GetBytes(FileStream streamToRead, string volume)
{
FileRecord mftRecord = GetRecord(streamToRead, volume);
return(mftRecord.GetContent());
}
public static byte[] GetBytesByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
return(record.GetContent());
}
/// <summary>
///
/// </summary>
/// <param name="path"></param>
/// <returns></returns>
public static UsnJrnlInformation GetByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
return(new UsnJrnlInformation(record.GetContent(@"$Max")));
}
/// <summary>
///
/// </summary>
/// <param name="path"></param>
/// <param name="streamName"></param>
/// <returns></returns>
public static byte[] GetContentBytes(string path, string streamName)
{
FileRecord record = Get(path, true);
return(record.GetContent(streamName));
}
/// <summary>
///
/// </summary>
/// <param name="path"></param>
/// <returns></returns>
public static AttrDef[] GetInstancesByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
return(AttrDef.GetInstances(record.GetContent()));
}
public static AttrDef[] GetInstances(string volume)
{
FileRecord record = FileRecord.Get(volume, ATTRDEF_INDEX, true);
return(AttrDef.GetInstances(record.GetContent()));
}
