internal override void ParseAttributeResidentBody(byte[] data, int maxLength, int offset)
{
base.ParseAttributeResidentBody(data, maxLength, offset);
Debug.Assert(maxLength >= ResidentHeader.ContentLength);
List <AttributeListItem> results = new List <AttributeListItem>();
int pointer = offset;
while (pointer + 26 <= offset + maxLength) // 26 is the smallest possible MFTAttributeListItem
{
AttributeListItem item = AttributeListItem.ParseListItem(data, Math.Min(data.Length - pointer, maxLength), pointer);
if (item.Type == AttributeType.EndOfAttributes)
{
break;
}
results.Add(item);
pointer += item.Length;
}
Items = results.ToArray();
}
public static AttributeListItem ParseListItem(byte[] data, int maxLength, int offset)
{
Debug.Assert(maxLength >= 26);
AttributeListItem res = new AttributeListItem();
res.Type = (AttributeType)BitConverter.ToUInt32(data, offset);
res.Length = BitConverter.ToUInt16(data, offset + 4);
res.NameLength = data[offset + 6];
res.NameOffset = data[offset + 7];
res.StartingVCN = BitConverter.ToUInt64(data, offset + 8);
res.BaseFile = new FileReference(BitConverter.ToUInt64(data, offset + 16));
res.AttributeId = BitConverter.ToUInt16(data, offset + 24);
Debug.Assert(maxLength >= res.NameOffset + res.NameLength * 2);
res.Name = Encoding.Unicode.GetString(data, offset + res.NameOffset, res.NameLength * 2);
return(res);
}
internal override void ParseAttributeNonResidentBody(RawDisk disk)
{
base.ParseAttributeNonResidentBody(disk);
// Get all chunks
byte[] data = NtfsUtils.ReadFragments(disk, NonResidentHeader.Fragments);
// Parse
List <AttributeListItem> results = new List <AttributeListItem>();
int pointer = 0;
int contentSize = (int)NonResidentHeader.ContentSize;
while (pointer + 26 <= contentSize) // 26 is the smallest possible MFTAttributeListItem
{
AttributeListItem item = AttributeListItem.ParseListItem(data, data.Length - pointer, pointer);
if (item.Type == AttributeType.EndOfAttributes)
{
break;
}
if (item.Length == 0)
{
break;
}
results.Add(item);
pointer += item.Length;
}
Debug.Assert(pointer == contentSize);
Items = results.ToArray();
}
