A file node in the NTFS filesystem.
Inheritance: File, IDescribable
		public FileSystemNTFS(IFileSystemStore store) {
			Store = store;

			LoadBPB();

			_mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
			_MFT = new FileNTFS(MFTRecord.Load(0, this), "");
			_root = new FolderNTFS(MFTRecord.Load(5, this), "", true);

			_bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
			_bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
		}
Ejemplo n.º 2
0
        public FileSystemNTFS(IFileSystemStore store)
        {
            Store = store;

            LoadBPB();

            _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
            _MFT       = new FileNTFS(MFTRecord.Load(0, this), "");
            _root      = new FolderNTFS(MFTRecord.Load(5, this), "", true);

            _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
            _bitmap     = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
        }
Ejemplo n.º 3
0
        internal override FileRecoveryStatus GetChanceOfRecovery(FileSystemNode node)
        {
            FileNTFS file = node as FileNTFS;

            if (file == null)
            {
                return(FileRecoveryStatus.Unknown);
            }
            else
            {
                IEnumerable <IRun> runs = file.GetRuns();
                if (runs == null)
                {
                    // The data stream is resident, so recovery is trivial.
                    return(FileRecoveryStatus.Resident);
                }
                else
                {
                    ulong totalClusters = 0;
                    ulong usedClusters  = 0;
                    // Check the status of each cluster in the runs.
                    foreach (IRun run in runs)
                    {
                        if (run.HasRealClusters)
                        {
                            totalClusters += run.LengthInClusters;
                            for (ulong i = run.LCN; i < run.LengthInClusters; i++)
                            {
                                if (GetClusterStatus(run.LCN + i) == SectorStatus.Used ||
                                    GetClusterStatus(run.LCN + i) == SectorStatus.Bad)
                                {
                                    usedClusters++;
                                }
                            }
                        }
                    }
                    if (usedClusters == 0)
                    {
                        return(FileRecoveryStatus.MaybeOverwritten);
                    }
                    else if (usedClusters < totalClusters)
                    {
                        return(FileRecoveryStatus.PartiallyOverwritten);
                    }
                    else
                    {
                        return(FileRecoveryStatus.Overwritten);
                    }
                }
            }
        }
Ejemplo n.º 4
0
        public FolderNTFS(MFTRecord record, string path, bool isRoot = false)
        {
            _record    = record;
            FileSystem = record.FileSystem;
            Deleted    = _record.Deleted;
            _indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot);

            MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation);

            if (attr != null)
            {
                _indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation);
            }
            if (isRoot)               // root
            {
                Root = true;
                Name = FileSystem.Store.DeviceID;
                Path = FileSystem.Store.DeviceID;
                foreach (FileSystemNode node in GetChildren("$Volume"))
                {
                    FileNTFS file = node as FileNTFS;
                    if (file != null && file.VolumeLabel != "")
                    {
                        Name = file.VolumeLabel;
                        break;
                    }
                }
            }
            else
            {
                Name = PathUtils.MakeFileNameValid(record.FileName);
                if (!string.IsNullOrEmpty(path))
                {
                    Path = PathUtils.Combine(path, Name);
                }
                else
                {
                    // We don't know the path
                    Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name);
                }
            }
        }