internal ulong USN; // USN Journel
internal ATTR_STANDARD_INFORMATION(byte[] bytes, int length)
{
if (length == 120)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24));
AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32));
MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40));
ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48));
Permission = BitConverter.ToUInt32(bytes, 56);
MaxVersionNo = BitConverter.ToUInt32(bytes, 60);
VersionNo = BitConverter.ToUInt32(bytes, 64);
ClassId = BitConverter.ToUInt32(bytes, 68);
OwnerId = BitConverter.ToUInt32(bytes, 72);
SecurityId = BitConverter.ToUInt32(bytes, 76);
QuotaCharged = BitConverter.ToUInt64(bytes, 80);
USN = BitConverter.ToUInt64(bytes, 88);
}
else
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24));
AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32));
MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40));
ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48));
Permission = BitConverter.ToUInt32(bytes, 56);
MaxVersionNo = 0;
VersionNo = 0;
ClassId = 0;
OwnerId = 0;
SecurityId = 0;
QuotaCharged = 0;
USN = 0;
}
}
internal ATTR_EA_INFORMATION(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
PackedSize = BitConverter.ToUInt16(bytes, 24);
EACount = BitConverter.ToUInt16(bytes, 26);
UnpackedSize = BitConverter.ToUInt32(bytes, 28);
}
internal ATTR_OBJECT_ID(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
ObjectId = bytes.Skip(24).Take(16).ToArray();
BirthVolumeId = null;
BirthObjectId = null;
BirthDomainId = null;
}
internal short Flags; // Flags
internal ATTR_VOLUME_INFORMATION(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
Reserved1 = bytes.Skip(24).Take(8).ToArray();
MajorVersion = bytes[32];
MinorVersion = bytes[33];
Flags = BitConverter.ToInt16(bytes, 34);
}
internal ATTR_INDEX_ROOT(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
AttributeType = BitConverter.ToUInt32(bytes, 32);
CollationSortingRule = BitConverter.ToUInt32(bytes, 36);
IndexSizeinBytes = BitConverter.ToUInt32(bytes, 40);
IndexSizeinClusters = bytes[44];
Padding = bytes.Skip(45).Take(3).ToArray();
NodeHeader = new NODE_HEADER(bytes.Skip(48).Take(16).ToArray());
}
internal byte[] Name; // Filename
internal ATTR_FILE_NAME(byte[] bytes)
{
if (bytes.Length < 90)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(new byte[24]);
ParentRef = BitConverter.ToUInt64(bytes, 0);
CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 8));
AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 16));
MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24));
ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32));
AllocSize = BitConverter.ToUInt64(bytes, 40);
RealSize = BitConverter.ToUInt64(bytes, 48);
Flags = BitConverter.ToUInt32(bytes, 56);
ER = BitConverter.ToUInt32(bytes, 60);
NameLength = bytes[64];
NameSpace = bytes[65];
Name = bytes.Skip(66).Take(NameLength * 2).ToArray();
}
else
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
ParentRef = BitConverter.ToUInt64(bytes, 24);
CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32));
AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40));
MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48));
ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 56));
AllocSize = BitConverter.ToUInt64(bytes, 64);
RealSize = BitConverter.ToUInt64(bytes, 72);
Flags = BitConverter.ToUInt32(bytes, 80);
ER = BitConverter.ToUInt32(bytes, 84);
NameLength = bytes[88];
NameSpace = bytes[89];
Name = bytes.Skip(90).Take(NameLength * 2).ToArray();
}
}
internal ATTR_DATA(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
RawBytes = bytes.Skip(24).ToArray();
}
internal ATTR_VOLNAME(byte[] bytes)
{
header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray());
VolumeNameString = Encoding.Unicode.GetString(bytes.Skip(24).ToArray());
}
