Ejemplo n.º 1
0
 public DuplicatedInformation(byte[] buffer, int offset)
 {
     CreationTime        = StandardInformationRecord.ReadDateTime(buffer, offset + 0x00);
     ModificationTime    = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
     MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
     LastAccessTime      = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
     AllocatedLength     = LittleEndianConverter.ToUInt64(buffer, offset + 0x20);
     FileSize            = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
     FileAttributes      = (FileAttributes)LittleEndianConverter.ToUInt32(buffer, offset + 0x30);
     PackedEASize        = LittleEndianConverter.ToUInt16(buffer, offset + 0x34);
 }
Ejemplo n.º 2
0
        public FileRecord CreateFile(List <FileNameRecord> fileNameRecords, uint transactionID)
        {
            if (fileNameRecords.Count == 0)
            {
                throw new ArgumentException();
            }
            bool isDirectory = fileNameRecords[0].IsDirectory;
            MftSegmentReference segmentReference  = AllocateFileRecordSegment(transactionID);
            FileRecordSegment   fileRecordSegment = new FileRecordSegment(segmentReference.SegmentNumber, segmentReference.SequenceNumber);

            // UpdateFileRecord() expects the base segment to be present on disk
            byte[] redoData     = fileRecordSegment.GetBytes(m_volume.BytesPerFileRecordSegment, m_volume.MinorVersion, false);
            ulong  streamOffset = (ulong)(fileRecordSegment.SegmentNumber * m_volume.BytesPerFileRecordSegment);

            m_volume.LogClient.WriteLogRecord(m_mftRecord.BaseSegmentReference, m_mftRecord.DataRecord, streamOffset, NTFSLogOperation.InitializeFileRecordSegment, redoData, NTFSLogOperation.DeallocateFileRecordSegment, new byte[0], transactionID);
            UpdateFileRecordSegment(fileRecordSegment);

            fileRecordSegment.ReferenceCount = (ushort)fileNameRecords.Count; // Each FileNameRecord is about to be indexed
            fileRecordSegment.IsInUse        = true;
            fileRecordSegment.IsDirectory    = isDirectory;

            FileRecord fileRecord = new FileRecord(fileRecordSegment);
            StandardInformationRecord standardInformation = (StandardInformationRecord)fileRecord.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);

            standardInformation.CreationTime        = fileNameRecords[0].CreationTime;
            standardInformation.ModificationTime    = fileNameRecords[0].ModificationTime;
            standardInformation.MftModificationTime = fileNameRecords[0].MftModificationTime;
            standardInformation.LastAccessTime      = fileNameRecords[0].LastAccessTime;
            standardInformation.FileAttributes      = 0;
            foreach (FileNameRecord fileNameRecord in fileNameRecords)
            {
                FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)fileRecord.CreateAttributeRecord(AttributeType.FileName, String.Empty);
                fileNameAttribute.IsIndexed = true;
                fileNameAttribute.Record    = fileNameRecord;
            }

            if (isDirectory)
            {
                string          indexName = IndexHelper.GetIndexName(AttributeType.FileName);
                IndexRootRecord indexRoot = (IndexRootRecord)fileRecord.CreateAttributeRecord(AttributeType.IndexRoot, indexName);
                IndexHelper.InitializeIndexRoot(indexRoot, AttributeType.FileName, m_volume.BytesPerIndexRecord, m_volume.BytesPerCluster);
            }
            else
            {
                fileRecord.CreateAttributeRecord(AttributeType.Data, String.Empty);
            }

            UpdateFileRecord(fileRecord, transactionID);

            return(fileRecord);
        }
Ejemplo n.º 3
0
        public FileNameRecord(byte[] buffer, int offset)
        {
            ParentDirectory     = new MftSegmentReference(buffer, offset + 0x00);
            CreationTime        = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
            ModificationTime    = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
            MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
            LastAccessTime      = StandardInformationRecord.ReadDateTime(buffer, offset + 0x20);
            AllocatedSize       = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
            RealSize            = LittleEndianConverter.ToUInt64(buffer, offset + 0x30);
            byte fnLen = ByteReader.ReadByte(buffer, offset + 0x40);

            Namespace = (FilenameNamespace)ByteReader.ReadByte(buffer, offset + 0x41);
            FileName  = Encoding.Unicode.GetString(buffer, offset + 0x42, fnLen * 2);
        }
Ejemplo n.º 4
0
        public byte[] GetBytes()
        {
            byte[] buffer = new byte[Length];

            StandardInformationRecord.WriteDateTime(buffer, 0x00, CreationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x08, ModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x10, MftModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x18, LastAccessTime);
            LittleEndianWriter.WriteUInt64(buffer, 0x20, AllocatedLength);
            LittleEndianWriter.WriteUInt64(buffer, 0x28, FileSize);
            LittleEndianWriter.WriteUInt32(buffer, 0x30, (uint)FileAttributes);
            LittleEndianWriter.WriteUInt16(buffer, 0x34, PackedEASize);

            return(buffer);
        }
Ejemplo n.º 5
0
        public FileNameRecord(byte[] buffer, int offset)
        {
            ParentDirectory     = new MftSegmentReference(buffer, offset + 0x00);
            CreationTime        = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
            ModificationTime    = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
            MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
            LastAccessTime      = StandardInformationRecord.ReadDateTime(buffer, offset + 0x20);
            AllocatedLength     = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
            FileSize            = LittleEndianConverter.ToUInt64(buffer, offset + 0x30);
            FileAttributes      = (FileAttributes)LittleEndianConverter.ToUInt32(buffer, offset + 0x38);
            PackedEASize        = LittleEndianConverter.ToUInt16(buffer, offset + 0x3C);
            byte fileNameLength = ByteReader.ReadByte(buffer, offset + 0x40);

            Flags    = (FileNameFlags)ByteReader.ReadByte(buffer, offset + 0x41);
            FileName = Encoding.Unicode.GetString(buffer, offset + 0x42, fileNameLength * 2);
        }
Ejemplo n.º 6
0
        public byte[] GetBytes()
        {
            byte[] buffer = new byte[FixedLength + FileName.Length * 2];

            ParentDirectory.WriteBytes(buffer, 0x00);
            StandardInformationRecord.WriteDateTime(buffer, 0x08, CreationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x10, ModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x18, MftModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x20, LastAccessTime);
            LittleEndianWriter.WriteUInt64(buffer, 0x28, AllocatedSize);
            LittleEndianWriter.WriteUInt64(buffer, 0x30, RealSize);
            ByteWriter.WriteByte(buffer, 0x40, (byte)FileName.Length);
            ByteWriter.WriteByte(buffer, 0x41, (byte)Namespace);
            ByteWriter.WriteBytes(buffer, 0x42, Encoding.Unicode.GetBytes(FileName));

            return(buffer);
        }
Ejemplo n.º 7
0
        private static FileRecordSegment CreateSystemReservedSegment(long segmentNumber)
        {
            FileRecordSegment baseRecordSegment = new FileRecordSegment(segmentNumber, (ushort)segmentNumber);

            baseRecordSegment.IsInUse = true;
            baseRecordSegment.UpdateSequenceNumber = 1;
            DateTime creationTime = DateTime.Now;
            StandardInformationRecord standardInformation = (StandardInformationRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);

            standardInformation.CreationTime        = creationTime;
            standardInformation.ModificationTime    = creationTime;
            standardInformation.MftModificationTime = creationTime;
            standardInformation.LastAccessTime      = creationTime;
            standardInformation.FileAttributes      = FileAttributes.System | FileAttributes.Hidden;
            baseRecordSegment.CreateAttributeRecord(AttributeType.Data, String.Empty);
            return(baseRecordSegment);
        }
Ejemplo n.º 8
0
        public FileRecord CreateFile(List <FileNameRecord> fileNameRecords)
        {
            if (fileNameRecords.Count == 0)
            {
                throw new ArgumentException();
            }
            bool isDirectory = fileNameRecords[0].IsDirectory;
            MftSegmentReference segmentReference  = AllocateFileRecordSegment();
            FileRecordSegment   fileRecordSegment = new FileRecordSegment(segmentReference.SegmentNumber, segmentReference.SequenceNumber);

            fileRecordSegment.ReferenceCount = (ushort)fileNameRecords.Count; // Each FileNameRecord is about to be indexed
            fileRecordSegment.IsInUse        = true;
            fileRecordSegment.IsDirectory    = isDirectory;
            FileRecord fileRecord = new FileRecord(fileRecordSegment);
            StandardInformationRecord standardInformation = (StandardInformationRecord)fileRecord.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);

            standardInformation.CreationTime        = fileNameRecords[0].CreationTime;
            standardInformation.ModificationTime    = fileNameRecords[0].ModificationTime;
            standardInformation.MftModificationTime = fileNameRecords[0].MftModificationTime;
            standardInformation.LastAccessTime      = fileNameRecords[0].LastAccessTime;
            standardInformation.FileAttributes      = 0;
            foreach (FileNameRecord fileNameRecord in fileNameRecords)
            {
                FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)fileRecord.CreateAttributeRecord(AttributeType.FileName, String.Empty);
                fileNameAttribute.IsIndexed = true;
                fileNameAttribute.Record    = fileNameRecord;
            }

            if (isDirectory)
            {
                string          indexName = IndexHelper.GetIndexName(AttributeType.FileName);
                IndexRootRecord indexRoot = (IndexRootRecord)fileRecord.CreateAttributeRecord(AttributeType.IndexRoot, indexName);
                IndexHelper.InitializeIndexRoot(indexRoot, AttributeType.FileName, m_volume.BytesPerIndexRecord, m_volume.BytesPerCluster);
            }
            else
            {
                fileRecord.CreateAttributeRecord(AttributeType.Data, String.Empty);
            }

            UpdateFileRecord(fileRecord);

            return(fileRecord);
        }
Ejemplo n.º 9
0
        private static FileRecordSegment CreateBaseRecordSegment(long segmentNumber, ushort sequenceNumber, FileNameRecord fileNameRecord)
        {
            FileRecordSegment baseRecordSegment = new FileRecordSegment(segmentNumber, sequenceNumber);

            baseRecordSegment.IsInUse = true;
            baseRecordSegment.UpdateSequenceNumber = 1;
            StandardInformationRecord standardInformation = (StandardInformationRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.StandardInformation, String.Empty);

            standardInformation.CreationTime        = fileNameRecord.CreationTime;
            standardInformation.ModificationTime    = fileNameRecord.ModificationTime;
            standardInformation.MftModificationTime = fileNameRecord.MftModificationTime;
            standardInformation.LastAccessTime      = fileNameRecord.LastAccessTime;
            standardInformation.FileAttributes      = fileNameRecord.FileAttributes;
            FileNameAttributeRecord fileNameAttribute = (FileNameAttributeRecord)baseRecordSegment.CreateAttributeRecord(AttributeType.FileName, String.Empty);

            fileNameAttribute.IsIndexed = true;
            fileNameAttribute.Record    = fileNameRecord;
            return(baseRecordSegment);
        }
Ejemplo n.º 10
0
        public byte[] GetBytes()
        {
            byte[] buffer = new byte[this.Length];

            ParentDirectory.WriteBytes(buffer, 0x00);
            StandardInformationRecord.WriteDateTime(buffer, 0x08, CreationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x10, ModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x18, MftModificationTime);
            StandardInformationRecord.WriteDateTime(buffer, 0x20, LastAccessTime);
            LittleEndianWriter.WriteUInt64(buffer, 0x28, AllocatedLength);
            LittleEndianWriter.WriteUInt64(buffer, 0x30, FileSize);
            LittleEndianWriter.WriteUInt32(buffer, 0x38, (uint)FileAttributes);
            LittleEndianWriter.WriteUInt16(buffer, 0x3C, PackedEASize);
            ByteWriter.WriteByte(buffer, 0x40, (byte)FileName.Length);
            ByteWriter.WriteByte(buffer, 0x41, (byte)Flags);
            ByteWriter.WriteBytes(buffer, 0x42, Encoding.Unicode.GetBytes(FileName));

            return(buffer);
        }