public DuplicatedInformation(byte[] buffer, int offset)
{
CreationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x00);
ModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
LastAccessTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
AllocatedLength = LittleEndianConverter.ToUInt64(buffer, offset + 0x20);
FileSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
FileAttributes = (FileAttributes)LittleEndianConverter.ToUInt32(buffer, offset + 0x30);
PackedEASize = LittleEndianConverter.ToUInt16(buffer, offset + 0x34);
}
public FileRecord CreateFile(List <FileNameRecord> fileNameRecords, uint transactionID)
{
if (fileNameRecords.Count == 0)
{
throw new ArgumentException();
}
bool isDirectory = fileNameRecords[0].IsDirectory;
MftSegmentReference segmentReference = AllocateFileRecordSegment(transactionID);
FileRecordSegment fileRecordSegment = new FileRecordSegment(segmentReference.SegmentNumber, segmentReference.SequenceNumber);
// UpdateFileRecord() expects the base segment to be present on disk
byte[] redoData = fileRecordSegment.GetBytes(m_volume.BytesPerFileRecordSegment, m_volume.MinorVersion, false);
ulong streamOffset = (ulong)(fileRecordSegment.SegmentNumber * m_volume.BytesPerFileRecordSegment);
m_volume.LogClient.WriteLogRecord(m_mftRecord.BaseSegmentReference, m_mftRecord.DataRecord, streamOffset, NTFSLogOperation.InitializeFileRecordSegment, redoData, NTFSLogOperation.DeallocateFileRecordSegment, new byte[0], transactionID);
UpdateFileRecordSegment(fileRecordSegment);
fileRecordSegment.ReferenceCount = (ushort)fileNameRecords.Count; // Each FileNameRecord is about to be indexed
fileRecordSegment.IsInUse = true;
fileRecordSegment.IsDirectory = isDirectory;
FileRecord fileRecord = new FileRecord(fileRecordSegment);
StandardInformationRecord standardInformation = (StandardInformationRecord)fileRecord.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);
standardInformation.CreationTime = fileNameRecords[0].CreationTime;
standardInformation.ModificationTime = fileNameRecords[0].ModificationTime;
standardInformation.MftModificationTime = fileNameRecords[0].MftModificationTime;
standardInformation.LastAccessTime = fileNameRecords[0].LastAccessTime;
standardInformation.FileAttributes = 0;
foreach (FileNameRecord fileNameRecord in fileNameRecords)
{
FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)fileRecord.CreateAttributeRecord(AttributeType.FileName, String.Empty);
fileNameAttribute.IsIndexed = true;
fileNameAttribute.Record = fileNameRecord;
}
if (isDirectory)
{
string indexName = IndexHelper.GetIndexName(AttributeType.FileName);
IndexRootRecord indexRoot = (IndexRootRecord)fileRecord.CreateAttributeRecord(AttributeType.IndexRoot, indexName);
IndexHelper.InitializeIndexRoot(indexRoot, AttributeType.FileName, m_volume.BytesPerIndexRecord, m_volume.BytesPerCluster);
}
else
{
fileRecord.CreateAttributeRecord(AttributeType.Data, String.Empty);
}
UpdateFileRecord(fileRecord, transactionID);
return(fileRecord);
}
public FileNameRecord(byte[] buffer, int offset)
{
ParentDirectory = new MftSegmentReference(buffer, offset + 0x00);
CreationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
ModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
LastAccessTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x20);
AllocatedSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
RealSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x30);
byte fnLen = ByteReader.ReadByte(buffer, offset + 0x40);
Namespace = (FilenameNamespace)ByteReader.ReadByte(buffer, offset + 0x41);
FileName = Encoding.Unicode.GetString(buffer, offset + 0x42, fnLen * 2);
}
public byte[] GetBytes()
{
byte[] buffer = new byte[Length];
StandardInformationRecord.WriteDateTime(buffer, 0x00, CreationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x08, ModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x10, MftModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x18, LastAccessTime);
LittleEndianWriter.WriteUInt64(buffer, 0x20, AllocatedLength);
LittleEndianWriter.WriteUInt64(buffer, 0x28, FileSize);
LittleEndianWriter.WriteUInt32(buffer, 0x30, (uint)FileAttributes);
LittleEndianWriter.WriteUInt16(buffer, 0x34, PackedEASize);
return(buffer);
}
public FileNameRecord(byte[] buffer, int offset)
{
ParentDirectory = new MftSegmentReference(buffer, offset + 0x00);
CreationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
ModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
LastAccessTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x20);
AllocatedLength = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
FileSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x30);
FileAttributes = (FileAttributes)LittleEndianConverter.ToUInt32(buffer, offset + 0x38);
PackedEASize = LittleEndianConverter.ToUInt16(buffer, offset + 0x3C);
byte fileNameLength = ByteReader.ReadByte(buffer, offset + 0x40);
Flags = (FileNameFlags)ByteReader.ReadByte(buffer, offset + 0x41);
FileName = Encoding.Unicode.GetString(buffer, offset + 0x42, fileNameLength * 2);
}
public byte[] GetBytes()
{
byte[] buffer = new byte[FixedLength + FileName.Length * 2];
ParentDirectory.WriteBytes(buffer, 0x00);
StandardInformationRecord.WriteDateTime(buffer, 0x08, CreationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x10, ModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x18, MftModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x20, LastAccessTime);
LittleEndianWriter.WriteUInt64(buffer, 0x28, AllocatedSize);
LittleEndianWriter.WriteUInt64(buffer, 0x30, RealSize);
ByteWriter.WriteByte(buffer, 0x40, (byte)FileName.Length);
ByteWriter.WriteByte(buffer, 0x41, (byte)Namespace);
ByteWriter.WriteBytes(buffer, 0x42, Encoding.Unicode.GetBytes(FileName));
return(buffer);
}
private static FileRecordSegment CreateSystemReservedSegment(long segmentNumber)
{
FileRecordSegment baseRecordSegment = new FileRecordSegment(segmentNumber, (ushort)segmentNumber);
baseRecordSegment.IsInUse = true;
baseRecordSegment.UpdateSequenceNumber = 1;
DateTime creationTime = DateTime.Now;
StandardInformationRecord standardInformation = (StandardInformationRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);
standardInformation.CreationTime = creationTime;
standardInformation.ModificationTime = creationTime;
standardInformation.MftModificationTime = creationTime;
standardInformation.LastAccessTime = creationTime;
standardInformation.FileAttributes = FileAttributes.System | FileAttributes.Hidden;
baseRecordSegment.CreateAttributeRecord(AttributeType.Data, String.Empty);
return(baseRecordSegment);
}
public FileRecord CreateFile(List <FileNameRecord> fileNameRecords)
{
if (fileNameRecords.Count == 0)
{
throw new ArgumentException();
}
bool isDirectory = fileNameRecords[0].IsDirectory;
MftSegmentReference segmentReference = AllocateFileRecordSegment();
FileRecordSegment fileRecordSegment = new FileRecordSegment(segmentReference.SegmentNumber, segmentReference.SequenceNumber);
fileRecordSegment.ReferenceCount = (ushort)fileNameRecords.Count; // Each FileNameRecord is about to be indexed
fileRecordSegment.IsInUse = true;
fileRecordSegment.IsDirectory = isDirectory;
FileRecord fileRecord = new FileRecord(fileRecordSegment);
StandardInformationRecord standardInformation = (StandardInformationRecord)fileRecord.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);
standardInformation.CreationTime = fileNameRecords[0].CreationTime;
standardInformation.ModificationTime = fileNameRecords[0].ModificationTime;
standardInformation.MftModificationTime = fileNameRecords[0].MftModificationTime;
standardInformation.LastAccessTime = fileNameRecords[0].LastAccessTime;
standardInformation.FileAttributes = 0;
foreach (FileNameRecord fileNameRecord in fileNameRecords)
{
FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)fileRecord.CreateAttributeRecord(AttributeType.FileName, String.Empty);
fileNameAttribute.IsIndexed = true;
fileNameAttribute.Record = fileNameRecord;
}
if (isDirectory)
{
string indexName = IndexHelper.GetIndexName(AttributeType.FileName);
IndexRootRecord indexRoot = (IndexRootRecord)fileRecord.CreateAttributeRecord(AttributeType.IndexRoot, indexName);
IndexHelper.InitializeIndexRoot(indexRoot, AttributeType.FileName, m_volume.BytesPerIndexRecord, m_volume.BytesPerCluster);
}
else
{
fileRecord.CreateAttributeRecord(AttributeType.Data, String.Empty);
}
UpdateFileRecord(fileRecord);
return(fileRecord);
}
private static FileRecordSegment CreateBaseRecordSegment(long segmentNumber, ushort sequenceNumber, FileNameRecord fileNameRecord)
{
FileRecordSegment baseRecordSegment = new FileRecordSegment(segmentNumber, sequenceNumber);
baseRecordSegment.IsInUse = true;
baseRecordSegment.UpdateSequenceNumber = 1;
StandardInformationRecord standardInformation = (StandardInformationRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);
standardInformation.CreationTime = fileNameRecord.CreationTime;
standardInformation.ModificationTime = fileNameRecord.ModificationTime;
standardInformation.MftModificationTime = fileNameRecord.MftModificationTime;
standardInformation.LastAccessTime = fileNameRecord.LastAccessTime;
standardInformation.FileAttributes = fileNameRecord.FileAttributes;
FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.FileName, String.Empty);
fileNameAttribute.IsIndexed = true;
fileNameAttribute.Record = fileNameRecord;
return(baseRecordSegment);
}
public byte[] GetBytes()
{
byte[] buffer = new byte[this.Length];
ParentDirectory.WriteBytes(buffer, 0x00);
StandardInformationRecord.WriteDateTime(buffer, 0x08, CreationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x10, ModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x18, MftModificationTime);
StandardInformationRecord.WriteDateTime(buffer, 0x20, LastAccessTime);
LittleEndianWriter.WriteUInt64(buffer, 0x28, AllocatedLength);
LittleEndianWriter.WriteUInt64(buffer, 0x30, FileSize);
LittleEndianWriter.WriteUInt32(buffer, 0x38, (uint)FileAttributes);
LittleEndianWriter.WriteUInt16(buffer, 0x3C, PackedEASize);
ByteWriter.WriteByte(buffer, 0x40, (byte)FileName.Length);
ByteWriter.WriteByte(buffer, 0x41, (byte)Flags);
ByteWriter.WriteBytes(buffer, 0x42, Encoding.Unicode.GetBytes(FileName));
return(buffer);
}