internal ulong StartVCN; // Starting VCN
#endregion Fields
#region Constructors
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
int DataRunLengthByteCount = bytes[0] & 0x0F;
int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4);
if (DataRunLengthByteCount != 0)
{
// DataRun
int offset = 0;
long startCluster = 0;
List<DataRun> dataRunList = new List<DataRun>();
do
{
if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
// Instantiate a DataRun object
DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster);
// Add DataRun Object to dataRunList
dataRunList.Add(dataRun);
// Increment offset
offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount;
if (offset <= (bytes.Length - 1))
{
DataRunLengthByteCount = bytes[offset] & 0x0F;
DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4);
}
else
{
break;
}
} while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunLengthByteCount != 0));
DataRun = dataRunList.ToArray();
}
}
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
int DataRunLengthByteCount = bytes[0] & 0x0F;
int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4);
if (DataRunLengthByteCount != 0)
{
// DataRun
int offset = 0;
long startCluster = 0;
List <DataRun> dataRunList = new List <DataRun>();
do
{
if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length)
{
break;
}
// Instantiate a DataRun object
DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster);
// Add DataRun Object to dataRunList
dataRunList.Add(dataRun);
// Increment offset
offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount;
if (offset <= (bytes.Length - 1))
{
DataRunLengthByteCount = bytes[offset] & 0x0F;
DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4);
}
else
{
break;
}
} while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0));
DataRun = dataRunList.ToArray();
}
}
internal NonResident(NonResidentHeader header, byte[] bytes, int offset, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
DataRun = Ntfs.DataRun.GetInstances(bytes, offset);
}
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName)
{
// Attr Object
Name = (ATTR_TYPE)header.commonHeader.ATTRType;
NameString = attrName;
NonResident = header.commonHeader.NonResident;
AttributeId = header.commonHeader.Id;
// NonResident Attribute
commonHeader = header.commonHeader;
StartVCN = header.StartVCN;
LastVCN = header.LastVCN;
DataRunOffset = header.DataRunOffset;
CompUnitSize = header.CompUnitSize;
AllocatedSize = header.AllocatedSize;
RealSize = header.RealSize;
InitializedSize = header.InitializedSize;
DataRun = Ntfs.DataRun.GetInstances(bytes);
}
internal static FileRecordAttribute Get(byte[] bytes, int offset, string volume)
{
#region CommonHeader
// Instantiate a Common Header Object
CommonHeader commonHeader = new CommonHeader(bytes, offset);
// Decode Name byte[] into Unicode String
string attributeName = Encoding.Unicode.GetString(bytes, commonHeader.NameOffset + offset, commonHeader.NameLength);
#endregion CommonHeader
#region NonResidentAttribute
// If Attribute is NonResident
if (commonHeader.NonResident)
{
#region NonResidentHeader
// Instantiate a Resident Header Object
NonResidentHeader nonresidentHeader = new NonResidentHeader(bytes, commonHeader, COMMONHEADERSIZE + offset);
#endregion NonResidentHeader
#region DataRun
int headerSize = 0x00;
if (commonHeader.NameOffset != 0x00)
{
headerSize = commonHeader.NameOffset + commonHeader.NameLength + (commonHeader.NameLength % 8);
}
else
{
headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE;
}
int attributeoffset = headerSize + offset;
return new NonResident(nonresidentHeader, bytes, attributeoffset, attributeName);
#endregion DataRun
}
#endregion NonResidentAttribute
#region ResidentAttribute
// Else Attribute is Resident
else
{
#region ResidentHeader
// Instantiate a Resident Header Object
ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE + offset, RESIDENTHEADERSIZE), commonHeader);
#endregion ResidentHeader
int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + commonHeader.NameLength;
int attributeoffset = headerSize + offset;
#region ATTRSwitch
switch (residentHeader.commonHeader.ATTRType)
{
case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION:
return new StandardInformation(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST:
return new AttributeList(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME:
return new FileName(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID:
return new ObjectId(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME:
return new VolumeName(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION:
return new VolumeInformation(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.DATA:
return new Data(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT:
return new IndexRoot(residentHeader, bytes, attributeoffset, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.EA:
//Console.WriteLine("EA");
return null;
case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION:
//Console.WriteLine("EA_INFORMATION");
return null;
default:
return null;
}
#endregion ATTRSwitch
}
#endregion ResidentAttribute
}
internal static FileRecordAttribute Get(byte[] bytes, int offset, string volume)
{
#region CommonHeader
// Instantiate a Common Header Object
CommonHeader commonHeader = new CommonHeader(bytes, offset);
// Decode Name byte[] into Unicode String
string attributeName = Encoding.Unicode.GetString(bytes, commonHeader.NameOffset + offset, commonHeader.NameLength);
#endregion CommonHeader
#region NonResidentAttribute
// If Attribute is NonResident
if (commonHeader.NonResident)
{
#region NonResidentHeader
// Instantiate a Resident Header Object
NonResidentHeader nonresidentHeader = new NonResidentHeader(bytes, commonHeader, COMMONHEADERSIZE + offset);
#endregion NonResidentHeader
#region DataRun
int headerSize = 0x00;
if (commonHeader.NameOffset != 0x00)
{
headerSize = commonHeader.NameOffset + commonHeader.NameLength + (commonHeader.NameLength % 8);
}
else
{
headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE;
}
int attributeoffset = headerSize + offset;
return(new NonResident(nonresidentHeader, bytes, attributeoffset, attributeName));
#endregion DataRun
}
#endregion NonResidentAttribute
#region ResidentAttribute
// Else Attribute is Resident
else
{
#region ResidentHeader
// Instantiate a Resident Header Object
ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE + offset, RESIDENTHEADERSIZE), commonHeader);
#endregion ResidentHeader
int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + commonHeader.NameLength;
int attributeoffset = headerSize + offset;
#region ATTRSwitch
switch (residentHeader.commonHeader.ATTRType)
{
case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION:
return(new StandardInformation(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST:
return(new AttributeList(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME:
return(new FileName(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID:
return(new ObjectId(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME:
return(new VolumeName(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION:
return(new VolumeInformation(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.DATA:
return(new Data(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT:
return(new IndexRoot(residentHeader, bytes, attributeoffset, attributeName));
case (Int32)FileRecordAttribute.ATTR_TYPE.EA:
//Console.WriteLine("EA");
return(null);
case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION:
//Console.WriteLine("EA_INFORMATION");
return(null);
default:
return(null);
}
#endregion ATTRSwitch
}
#endregion ResidentAttribute
}
internal static Attr Get(byte[] bytes, string volume)
{
#region CommonHeader
if (bytes.Length == 0)
{
return(null);
}
// Instantiate a Common Header Object
CommonHeader commonHeader = new CommonHeader(bytes);
#endregion CommonHeader
uint NameLength = (uint)commonHeader.NameLength * 2;
// Decode Name byte[] into Unicode String
string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength);
// Determine if Attribute is Resident or NonResident
bool resident = (bytes[8] == 0x00);
#region ResidentAttribute
// If Attribute is Resident
if (resident)
{
#region ResidentHeader
// Instantiate a Resident Header Object
ResidentHeader residentHeader = new ResidentHeader(Util.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader);
#endregion ResidentHeader
#region AttributeBytes
// Create a byte[] representing the attribute itself
int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength;
byte[] attributeBytes = Util.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize);
#endregion AttributeBytes
#region ATTRSwitch
switch (residentHeader.commonHeader.ATTRType)
{
case (Int32)Attr.ATTR_TYPE.STANDARD_INFORMATION:
return(new StandardInformation(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.ATTRIBUTE_LIST:
return(new AttributeList(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.FILE_NAME:
return(new FileName(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.OBJECT_ID:
return(new ObjectId(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.VOLUME_NAME:
return(new VolumeName(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.VOLUME_INFORMATION:
return(new VolumeInformation(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.DATA:
return(new Data(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.INDEX_ROOT:
return(new IndexRoot(residentHeader, attributeBytes, attributeName));
case (Int32)Attr.ATTR_TYPE.EA:
//Console.WriteLine("EA");
return(null);
case (Int32)Attr.ATTR_TYPE.EA_INFORMATION:
//Console.WriteLine("EA_INFORMATION");
return(null);
default:
return(null);
}
#endregion ATTRSwitch
}
#endregion ResidentAttribute
#region NonResidentAttribute
// Else Attribute is Non-Resident
else
{
#region NonResidentHeader
// Instantiate a Resident Header Object
NonResidentHeader nonresidentHeader = new NonResidentHeader(Util.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader);
#endregion NonResidentHeader
#region DataRun
int headerSize = 0;
if (commonHeader.NameOffset != 0)
{
headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8);
}
else
{
headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE;
}
return(new NonResident(nonresidentHeader, Util.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize), attributeName));
#endregion DataRun
}
#endregion NonResidentAttribute
}
internal static FileRecordAttribute Get(byte[] bytes, string volume)
{
#region CommonHeader
if (bytes.Length == 0)
{
return null;
}
// Instantiate a Common Header Object
CommonHeader commonHeader = new CommonHeader(bytes);
#endregion CommonHeader
uint NameLength = (uint)commonHeader.NameLength * 2;
// Decode Name byte[] into Unicode String
string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength);
// Determine if Attribute is Resident or NonResident
bool resident = (bytes[8] == 0x00);
#region ResidentAttribute
// If Attribute is Resident
if (resident)
{
#region ResidentHeader
// Instantiate a Resident Header Object
ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader);
#endregion ResidentHeader
#region AttributeBytes
// Create a byte[] representing the attribute itself
int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength;
byte[] attributeBytes = Helper.GetSubArray(bytes, headerSize, (int)commonHeader.TotalSize - headerSize);
#endregion AttributeBytes
#region ATTRSwitch
switch (residentHeader.commonHeader.ATTRType)
{
case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION:
return new StandardInformation(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST:
return new AttributeList(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME:
return new FileName(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID:
return new ObjectId(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME:
return new VolumeName(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION:
return new VolumeInformation(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.DATA:
return new Data(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT:
return new IndexRoot(residentHeader, attributeBytes, attributeName);
case (Int32)FileRecordAttribute.ATTR_TYPE.EA:
//Console.WriteLine("EA");
return null;
case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION:
//Console.WriteLine("EA_INFORMATION");
return null;
default:
return null;
}
#endregion ATTRSwitch
}
#endregion ResidentAttribute
#region NonResidentAttribute
// Else Attribute is Non-Resident
else
{
#region NonResidentHeader
// Instantiate a Resident Header Object
NonResidentHeader nonresidentHeader = new NonResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader);
#endregion NonResidentHeader
#region DataRun
int headerSize = 0x00;
if (commonHeader.NameOffset != 0x00)
{
headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8);
}
else
{
headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE;
}
return new NonResident(nonresidentHeader, Helper.GetSubArray(bytes, headerSize, (int)commonHeader.TotalSize - headerSize), attributeName);
#endregion DataRun
}
#endregion NonResidentAttribute
}
