internal FileNameAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_fnr = new FileNameRecord();
_fnr.ReadFrom(content, 0);
}
internal FileNameAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_fnr = new FileNameRecord();
_fnr.ReadFrom(content, 0);
}
internal AttributeListAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_list = new AttributeList();
_list.ReadFrom(content, 0);
}
internal StandardInformationAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_si = new StandardInformation();
_si.ReadFrom(content, 0);
}
public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags)
{
File newFile = context.AllocateFile(flags);
FileAttributeFlags fileFlags =
FileAttributeFlags.Archive
| FileRecord.ConvertFlags(flags)
| (dirFlags & FileAttributeFlags.Compressed);
AttributeFlags dataAttrFlags = AttributeFlags.None;
if ((dirFlags & FileAttributeFlags.Compressed) != 0)
{
dataAttrFlags |= AttributeFlags.Compressed;
}
StandardInformation.InitializeNewFile(newFile, fileFlags);
if (context.ObjectIds != null)
{
Guid newId = CreateNewGuid(context);
NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
ObjectId objId = new ObjectId();
objId.Id = newId;
stream.SetContent(objId);
context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
}
newFile.CreateAttribute(AttributeType.Data, dataAttrFlags);
newFile.UpdateRecordInMft();
return(newFile);
}
internal AttributeListAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_list = new AttributeList();
_list.ReadFrom(content, 0);
}
internal StandardInformationAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
byte[] content = Utilities.ReadAll(Content);
_si = new StandardInformation();
_si.ReadFrom(content, 0);
}
public RawClusterStream(INtfsContext context, CookedDataRuns cookedRuns, bool isMft)
{
_context = context;
_cookedRuns = cookedRuns;
_isMft = isMft;
_fsStream = _context.RawStream;
_bytesPerCluster = context.BiosParameterBlock.BytesPerCluster;
}
public RawClusterStream(INtfsContext context, CookedDataRuns cookedRuns, bool isMft)
{
_context = context;
_cookedRuns = cookedRuns;
_isMft = isMft;
_fsStream = _context.RawStream;
_bytesPerCluster = context.BiosParameterBlock.BytesPerCluster;
}
public CompressedClusterStream(INtfsContext context, NtfsAttribute attr, RawClusterStream rawStream)
{
_context = context;
_attr = attr;
_rawStream = rawStream;
_bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster;
_cacheBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster];
_ioBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster];
}
public CompressedClusterStream(INtfsContext context, NtfsAttribute attr, RawClusterStream rawStream)
{
_context = context;
_attr = attr;
_rawStream = rawStream;
_bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster;
_cacheBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster];
_ioBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster];
}
public File(INtfsContext context, FileRecord baseRecord)
{
_context = context;
_mft = _context.Mft;
_records = new List<FileRecord>();
_records.Add(baseRecord);
_indexCache = new ObjectCache<string, Index>();
_attributes = new List<NtfsAttribute>();
LoadAttributes();
}
public NonResidentDataBuffer(INtfsContext context, CookedDataRuns cookedRuns, bool isMft)
{
_context = context;
_cookedRuns = cookedRuns;
_rawStream = new RawClusterStream(_context, _cookedRuns, isMft);
_activeStream = _rawStream;
_bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster;
_ioBuffer = new byte[_bytesPerCluster];
}
public File(INtfsContext context, FileRecord baseRecord)
{
_context = context;
_mft = _context.Mft;
_records = new List <FileRecord>();
_records.Add(baseRecord);
_indexCache = new ObjectCache <string, Index>();
_attributes = new List <NtfsAttribute>();
LoadAttributes();
}
public NonResidentDataBuffer(INtfsContext context, CookedDataRuns cookedRuns, bool isMft)
{
_context = context;
_cookedRuns = cookedRuns;
_rawStream = new RawClusterStream(_context, _cookedRuns, isMft);
_activeStream = _rawStream;
_bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster;
_ioBuffer = new byte[_bytesPerCluster];
}
public MasterFileTable(INtfsContext context)
{
BiosParameterBlock bpb = context.BiosParameterBlock;
_recordCache = new ObjectCache <long, FileRecord>();
_recordLength = bpb.MftRecordSize;
_bytesPerSector = bpb.BytesPerSector;
// Temporary record stream - until we've bootstrapped the MFT properly
_recordStream = new SubStream(context.RawStream, bpb.MftCluster * bpb.SectorsPerCluster * bpb.BytesPerSector, 24 * _recordLength);
}
private static Guid CreateNewGuid(INtfsContext context)
{
Random rng = context.Options.RandomNumberGenerator;
if (rng != null)
{
byte[] buffer = new byte[16];
rng.NextBytes(buffer);
return(new Guid(buffer));
}
return(Guid.NewGuid());
}
internal new static Directory CreateNew(INtfsContext context)
{
Directory dir = (Directory)context.AllocateFile(FileRecordFlags.IsDirectory);
StandardInformation.InitializeNewFile(dir, FileAttributeFlags.Archive);
// Create the index root attribute by instantiating a new index
dir.CreateIndex("$I30", AttributeType.FileName, AttributeCollationRule.Filename);
dir.UpdateRecordInMft();
return(dir);
}
internal static GenericAttribute FromAttributeRecord(INtfsContext context, AttributeRecord record)
{
switch (record.AttributeType)
{
case AttributeType.AttributeList:
return(new AttributeListAttribute(context, record));
case AttributeType.FileName:
return(new FileNameAttribute(context, record));
case AttributeType.StandardInformation:
return(new StandardInformationAttribute(context, record));
default:
return(new UnknownAttribute(context, record));
}
}
public File InitializeNew(INtfsContext context, long firstBitmapCluster, ulong numBitmapClusters,
long firstRecordsCluster, ulong numRecordsClusters)
{
BiosParameterBlock bpb = context.BiosParameterBlock;
FileRecord fileRec = new FileRecord(bpb.BytesPerSector, bpb.MftRecordSize, (uint)MftIndex);
fileRec.Flags = FileRecordFlags.InUse;
fileRec.SequenceNumber = 1;
_recordCache[MftIndex] = fileRec;
_self = new File(context, fileRec);
StandardInformation.InitializeNewFile(_self, FileAttributeFlags.Hidden | FileAttributeFlags.System);
NtfsStream recordsStream = _self.CreateStream(AttributeType.Data, null, firstRecordsCluster,
numRecordsClusters, (uint)bpb.BytesPerCluster);
_recordStream = recordsStream.Open(FileAccess.ReadWrite);
Wipe(_recordStream);
NtfsStream bitmapStream = _self.CreateStream(AttributeType.Bitmap, null, firstBitmapCluster,
numBitmapClusters, (uint)bpb.BytesPerCluster);
using (Stream s = bitmapStream.Open(FileAccess.ReadWrite))
{
Wipe(s);
s.SetLength(8);
_bitmap = new Bitmap(s, long.MaxValue);
}
RecordSize = context.BiosParameterBlock.MftRecordSize;
_bytesPerSector = context.BiosParameterBlock.BytesPerSector;
_bitmap.MarkPresentRange(0, 1);
// Write the MFT's own record to itself
byte[] buffer = new byte[RecordSize];
fileRec.ToBytes(buffer, 0);
_recordStream.Position = 0;
_recordStream.Write(buffer, 0, RecordSize);
_recordStream.Flush();
return(_self);
}
internal static File CreateNew(INtfsContext context, FileRecordFlags flags)
{
DateTime now = DateTime.UtcNow;
File newFile = context.AllocateFile(flags);
StandardInformation.InitializeNewFile(newFile, FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags));
if (context.ObjectIds != null)
{
Guid newId = CreateNewGuid(context);
NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
ObjectId objId = new ObjectId();
objId.Id = newId;
stream.SetContent(objId);
context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
}
newFile.CreateAttribute(AttributeType.Data, AttributeFlags.None);
newFile.UpdateRecordInMft();
return(newFile);
}
public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags)
{
File newFile = context.AllocateFile(flags);
FileAttributeFlags fileFlags =
FileAttributeFlags.Archive
| FileRecord.ConvertFlags(flags)
| (dirFlags & FileAttributeFlags.Compressed);
AttributeFlags dataAttrFlags = AttributeFlags.None;
if ((dirFlags & FileAttributeFlags.Compressed) != 0)
{
dataAttrFlags |= AttributeFlags.Compressed;
}
StandardInformation.InitializeNewFile(newFile, fileFlags);
if (context.ObjectIds != null)
{
Guid newId = CreateNewGuid(context);
NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
ObjectId objId = new ObjectId();
objId.Id = newId;
stream.SetContent(objId);
context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
}
newFile.CreateAttribute(AttributeType.Data, dataAttrFlags);
newFile.UpdateRecordInMft();
return newFile;
}
public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags)
{
return CreateNew(context, FileRecordFlags.None, dirFlags);
}
internal static GenericAttribute FromAttributeRecord(INtfsContext context, AttributeRecord record)
{
switch (record.AttributeType)
{
case AttributeType.AttributeList:
return new AttributeListAttribute(context, record);
case AttributeType.FileName:
return new FileNameAttribute(context, record);
case AttributeType.StandardInformation:
return new StandardInformationAttribute(context, record);
default:
return new UnknownAttribute(context, record);
}
}
internal MasterFileTableEntry(INtfsContext context, FileRecord fileRecord)
{
_context = context;
_fileRecord = fileRecord;
}
public Directory(INtfsContext context, FileRecord baseRecord)
: base(context, baseRecord)
{
}
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context)
{
return(new NonResidentDataBuffer(context, this));
}
internal static File CreateNew(INtfsContext context)
{
return(CreateNew(context, FileRecordFlags.None));
}
internal MasterFileTable(INtfsContext context, InternalMasterFileTable mft)
{
_context = context;
_mft = mft;
}
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context)
{
return new NonResidentDataBuffer(context, this);
}
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context)
{
return(_memoryBuffer);
}
internal static File CreateNew(INtfsContext context, FileRecordFlags flags)
{
DateTime now = DateTime.UtcNow;
File newFile = context.AllocateFile(flags);
StandardInformation.InitializeNewFile(newFile, FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags));
if (context.ObjectIds != null)
{
Guid newId = CreateNewGuid(context);
NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null);
ObjectId objId = new ObjectId();
objId.Id = newId;
stream.SetContent(objId);
context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty);
}
newFile.CreateAttribute(AttributeType.Data, AttributeFlags.None);
newFile.UpdateRecordInMft();
return newFile;
}
public File InitializeNew(INtfsContext context, long firstBitmapCluster, ulong numBitmapClusters, long firstRecordsCluster, ulong numRecordsClusters)
{
BiosParameterBlock bpb = context.BiosParameterBlock;
FileRecord fileRec = new FileRecord(bpb.BytesPerSector, bpb.MftRecordSize, (uint)MftIndex);
fileRec.Flags = FileRecordFlags.InUse;
fileRec.SequenceNumber = 1;
_recordCache[MftIndex] = fileRec;
_self = new File(context, fileRec);
StandardInformation.InitializeNewFile(_self, FileAttributeFlags.Hidden | FileAttributeFlags.System);
NtfsStream recordsStream = _self.CreateStream(AttributeType.Data, null, firstRecordsCluster, numRecordsClusters, (uint)bpb.BytesPerCluster);
_recordStream = recordsStream.Open(FileAccess.ReadWrite);
Wipe(_recordStream);
NtfsStream bitmapStream = _self.CreateStream(AttributeType.Bitmap, null, firstBitmapCluster, numBitmapClusters, (uint)bpb.BytesPerCluster);
using (Stream s = bitmapStream.Open(FileAccess.ReadWrite))
{
Wipe(s);
s.SetLength(8);
_bitmap = new Bitmap(s, long.MaxValue);
}
_recordLength = context.BiosParameterBlock.MftRecordSize;
_bytesPerSector = context.BiosParameterBlock.BytesPerSector;
_bitmap.MarkPresentRange(0, 1);
// Write the MFT's own record to itself
byte[] buffer = new byte[_recordLength];
fileRec.ToBytes(buffer, 0);
_recordStream.Position = 0;
_recordStream.Write(buffer, 0, _recordLength);
_recordStream.Flush();
return _self;
}
public MasterFileTable(INtfsContext context)
{
BiosParameterBlock bpb = context.BiosParameterBlock;
_recordCache = new ObjectCache<long, FileRecord>();
_recordLength = bpb.MftRecordSize;
_bytesPerSector = bpb.BytesPerSector;
// Temporary record stream - until we've bootstrapped the MFT properly
_recordStream = new SubStream(context.RawStream, bpb.MftCluster * bpb.SectorsPerCluster * bpb.BytesPerSector, 24 * _recordLength);
}
private static Guid CreateNewGuid(INtfsContext context)
{
Random rng = context.Options.RandomNumberGenerator;
if (rng != null)
{
byte[] buffer = new byte[16];
rng.NextBytes(buffer);
return new Guid(buffer);
}
else
{
return Guid.NewGuid();
}
}
public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags)
{
return(CreateNew(context, FileRecordFlags.None, dirFlags));
}
internal MasterFileTable(INtfsContext context, InternalMasterFileTable mft)
{
_context = context;
_mft = mft;
}
public UnknownAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
}
internal GenericAttribute(INtfsContext context, AttributeRecord record)
{
_context = context;
_record = record;
}
public NonResidentDataBuffer(INtfsContext context, NonResidentAttributeRecord record)
: this(context, new CookedDataRuns(record.DataRuns, record), false)
{
}
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context)
{
return _memoryBuffer;
}
internal MasterFileTableEntry(INtfsContext context, FileRecord fileRecord)
{
_context = context;
_fileRecord = fileRecord;
}
internal GenericAttribute(INtfsContext context, AttributeRecord record)
{
_context = context;
_record = record;
}
public UnknownAttribute(INtfsContext context, AttributeRecord record)
: base(context, record)
{
}
public NonResidentDataBuffer(INtfsContext context, NonResidentAttributeRecord record)
: this(context, new CookedDataRuns(record.DataRuns, record), false)
{
}
internal static File CreateNew(INtfsContext context)
{
return CreateNew(context, FileRecordFlags.None);
}
public abstract IBuffer GetReadOnlyDataBuffer(INtfsContext context);
