internal static byte[] getFile(string volume, int index)
{
byte[] mftBytes = MasterFileTable.GetBytes(volume);
// Get the FileRecord (MFT Record Entry) for the given inode on the specified volume
MFTRecord MFTRecord = MFTRecord.Get(mftBytes, index, null, null);
if (!(MFTRecord.Directory))
{
foreach (Attr attr in MFTRecord.Attribute)
{
if (attr.Name == "DATA")
{
if (attr.NonResident == true)
{
NonResident nonResAttr = (NonResident)attr;
return(NonResident.GetContent(volume, nonResAttr).ToArray());
}
else
{
Data dataAttr = (Data)attr;
return(dataAttr.RawData);
}
}
}
}
return(null);
}
// Get all MFT Records for the specified volume (Ex. \\.\C:)
public static MFTRecord[] GetInstances(string volume, string volLetter)
{
// Get MFT as byte array
byte[] mftBytes = MasterFileTable.GetBytes(volume);
// Call private GetInstances
return(GetInstances(mftBytes, volLetter));
}
public static byte[] getBytes(string volume)
{
byte[] mftBytes = MasterFileTable.GetBytes(volume);
MFTRecord logFileRecord = MFTRecord.Get(mftBytes, 2, null, null);
NonResident data = null;
foreach (Attr attr in logFileRecord.Attribute)
{
if (attr.Name == "DATA")
{
data = attr as NonResident;
break;
}
}
return((NonResident.GetContent(volume, data)).ToArray());
}
internal static List<IndexEntry> Get(string volume, int index)
{
MFTRecord fileRecord = MFTRecord.Get(MasterFileTable.GetBytes(volume), index, null, null);
NonResident INDX = null;
foreach (Attr attr in fileRecord.Attribute)
{
if (attr.Name == "INDEX_ALLOCATION")
{
if (attr.NonResident)
{
INDX = (NonResident)attr;
}
}
}
List<byte> nonResBytes = NonResident.GetContent(volume, INDX);
List<IndexEntry> indxEntryList = new List<IndexEntry>();
for (int offset = 0; offset < nonResBytes.Count; offset += 4096)
{
byte[] indxBytes = nonResBytes.Skip(offset).Take(4096).ToArray();
INDEX_BLOCK indxBlock = new INDEX_BLOCK(indxBytes.Take(40).ToArray());
byte[] IndexAllocEntryBytes = indxBytes.Skip(64).ToArray();
int offsetIndx = 0;
int offsetIndxPrev = 1;
while ((offsetIndx < IndexAllocEntryBytes.Length) && (offsetIndx != offsetIndxPrev))
{
INDEX_ENTRY indxEntryStruct = new INDEX_ENTRY(IndexAllocEntryBytes.Skip(offsetIndx).ToArray());
offsetIndxPrev = offsetIndx;
offsetIndx += indxEntryStruct.Size;
if (indxEntryStruct.Stream.Length > 66)
{
FileName.ATTR_FILE_NAME fileNameStruct = new FileName.ATTR_FILE_NAME(indxEntryStruct.Stream);
#region indxFlags
StringBuilder indxFlags = new StringBuilder();
if (indxEntryStruct.Flags != 0)
{
if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.SUBNODE) == (int)INDEX_ENTRY_FLAG.SUBNODE)
{
indxFlags.Append("Subnode, ");
}
if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.LAST) == (int)INDEX_ENTRY_FLAG.LAST)
{
indxFlags.Append("Last Entry, ");
}
indxFlags.Length -= 2;
}
#endregion indxFlags
string Name = System.Text.Encoding.Unicode.GetString(fileNameStruct.Name);
IndexEntry indxEntry = new IndexEntry(indxEntryStruct, indxFlags.ToString(), Name);
indxEntryList.Add(indxEntry);
}
}
}
return indxEntryList;
}