Example #1
0
        /// <summary>
        /// Reads the File Allocation Table of a FAT filesystem.
        /// </summary>
        public FileAllocationTable(IFileSystemStore store, long fatOffset, long fatSizeInBytes, PartitionType type)
        {
            _store          = store;
            _fatOffset      = fatOffset;
            _fatSizeInBytes = fatSizeInBytes;
            if (type == PartitionType.FAT16)
            {
                _entrySize = 2;
            }
            else                 // FAT32
            {
                _entrySize = 4;
            }
            _numEntries = (int)(fatSizeInBytes / _entrySize);

            // If the FAT is small enough, just load it into memory.
            // Otherwise, we'll read from the disk on demand.
            if (fatSizeInBytes < 100 * 1024 * 1024)               // < 100 MB
            {
                _fatEntries = new uint[_numEntries];
                int i = 0;
                for (long offset = 0; offset < fatSizeInBytes; offset += _entrySize)
                {
                    _fatEntries[i] = (uint)Util.GetArbitraryUInt(store, (ulong)(fatOffset + offset), (int)_entrySize);
                    ++i;
                }
                _inMemory = true;
            }
            else
            {
                _inMemory = false;
            }
        }
		public static bool HasFileSystem(IFileSystemStore store) {
			if (store == null || store.StreamLength == 0) return false;
			switch (store.StorageType) {
				case StorageType.PhysicalDiskPartition: {
						PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
						if (attributes.PartitionType == PartitionType.NTFS) {
							return true;
						} else if (attributes.PartitionType == PartitionType.FAT16
								|| attributes.PartitionType == PartitionType.FAT32) {
							return true;
						} else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support) {
							return true;
						} else {
							return false;
						}
					}
				case StorageType.LogicalVolume: {
						LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
						if (attributes.FileSystem == "NTFS") {
							return true;
						} else if (attributes.FileSystem == "FAT16") {
							return true;
						} else if (attributes.FileSystem == "FAT32") {
							return true;
						} else {
							return false;
						}
					}
				default:
					return false;
			}
		}
Example #3
0
 public StoreService(IConvertor convertor, IFileSystemStore fileSystemStore, IPersonService personService, IHackingService hackingService)
 {
     this.convertor       = convertor;
     this.fileSystemStore = fileSystemStore;
     this.personService   = personService;
     this.hackingService  = hackingService;
 }
Example #4
0
 /// <summary>
 /// Views a data stream. Clients should check that CanView(stream)
 /// returns true before calling this method.
 /// </summary>
 /// <param name="stream">The data stream to view.</param>
 public void View(IDataStream stream)
 {
     if (stream != _currentStream)
     {
         _currentStream = stream;
         treeFiles.Nodes.Clear();
         IFileSystemStore store = stream as IFileSystemStore;
         if (store != null)
         {
             IFileSystem    fs = store.FS;
             FileSystemNode fsRoot;
             if (fs != null)
             {
                 fsRoot = fs.GetRoot();
                 TreeNode root = new TreeNode(fsRoot.ToString());
                 root.Tag = fsRoot;
                 root.SelectedImageKey = root.ImageKey = "Directory";
                 treeFiles.Nodes.Add(root);
                 root.Nodes.Add(new TreeNode("dummy"));
                 ((Folder)fsRoot).Loaded = false;
             }
             else
             {
                 treeFiles.Nodes.Add("Unknown file system");
             }
         }
     }
 }
		/// <summary>
		/// Reads the File Allocation Table of a FAT filesystem.
		/// </summary>
		public FileAllocationTable(IFileSystemStore store, long fatOffset, long fatSizeInBytes, PartitionType type) {
			_store = store;
			_fatOffset = fatOffset;
			_fatSizeInBytes = fatSizeInBytes;
			if (type == PartitionType.FAT16) {
				_entrySize = 2;
			} else { // FAT32
				_entrySize = 4;
			}
			_numEntries = (int)(fatSizeInBytes / _entrySize);

			// If the FAT is small enough, just load it into memory.
			// Otherwise, we'll read from the disk on demand.
			if (fatSizeInBytes < 100 * 1024 * 1024) { // < 100 MB
				_fatEntries = new uint[_numEntries];
				int i = 0;
				for (long offset = 0; offset < fatSizeInBytes; offset += _entrySize) {
					_fatEntries[i] = (uint)Util.GetArbitraryUInt(store, (ulong)(fatOffset + offset), (int)_entrySize);
					++i;
				}
				_inMemory = true;
			} else {
				_inMemory = false;
			}
		}
		public FileSystemNTFS(IFileSystemStore store) {
			Store = store;

			LoadBPB();

			_mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
			_MFT = new FileNTFS(MFTRecord.Load(0, this), "");
			_root = new FolderNTFS(MFTRecord.Load(5, this), "", true);

			_bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
			_bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
		}
Example #7
0
        public static bool HasFileSystem(IFileSystemStore store)
        {
            if (store == null || store.StreamLength == 0)
            {
                return(false);
            }
            switch (store.StorageType)
            {
            case StorageType.PhysicalDiskPartition: {
                PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
                if (attributes.PartitionType == PartitionType.NTFS)
                {
                    return(true);
                }
                else if (attributes.PartitionType == PartitionType.FAT16 ||
                         attributes.PartitionType == PartitionType.FAT32)
                {
                    return(true);
                }
                else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support)
                {
                    return(true);
                }
                else
                {
                    return(false);
                }
            }

            case StorageType.LogicalVolume: {
                LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
                if (attributes.FileSystem == "NTFS")
                {
                    return(true);
                }
                else if (attributes.FileSystem == "FAT16")
                {
                    return(true);
                }
                else if (attributes.FileSystem == "FAT32")
                {
                    return(true);
                }
                else
                {
                    return(false);
                }
            }

            default:
                return(false);
            }
        }
        public FileSystemNTFS(IFileSystemStore store)
        {
            Store = store;

            LoadBPB();

            _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
            _MFT       = new FileNTFS(MFTRecord.Load(0, this), "");
            _root      = new FolderNTFS(MFTRecord.Load(5, this), "", true);

            _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
            _bitmap     = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
        }
Example #9
0
 private void SetFileSystem(IFileSystemStore logicalDisk)
 {
     if (logicalDisk.FS != null)
     {
         if (!_scanners.ContainsKey(logicalDisk.FS))
         {
             _scanners[logicalDisk.FS]       = new Scanner(logicalDisk.ToString(), logicalDisk.FS);
             _deletedViewers[logicalDisk.FS] = new DeletedFileViewer(_scanners[logicalDisk.FS]);
             AddDeletedFileViewer(_deletedViewers[logicalDisk.FS]);
         }
         if (_fileSystem != null && _scanners.ContainsKey(_fileSystem))
         {
             _deletedViewers[_fileSystem].Hide();
         }
         _fileSystem = logicalDisk.FS;
         _deletedViewers[logicalDisk.FS].Show();
     }
 }
Example #10
0
        public FileSystemFAT(IFileSystemStore store, PartitionType type)
        {
            Store = store;
            Type  = type;
            LoadBPB();
            _FATLocation = BPB_RsvdSecCnt * BPB_BytsPerSec;
            // Load the FAT.
            _fileAllocationTable = new FileAllocationTable(store, _FATLocation, FATSize * BytesPerSector, type);
            long rootDirSectors = ((BPB_RootEntCnt * 32) + (BPB_BytsPerSec - 1)) / BPB_BytsPerSec;
            long afterFAT       = _FATLocation + BPB_NumFATs * FATSize * BPB_BytsPerSec;

            _dataLocation = afterFAT + rootDirSectors * BPB_BytsPerSec;
            if (Type == PartitionType.FAT32)
            {
                _rootDirLocation = GetDiskOffsetOfFATCluster(BPB_RootClus);
            }
            else
            {
                _rootDirLocation = afterFAT;
            }
            _root = new FolderFAT(this, _rootDirLocation, 2);
        }
Example #11
0
        public static IFileSystem TryLoad(IFileSystemStore store, string FSType = null)
        {
            if (store == null || store.StreamLength == 0)
            {
                return(null);
            }
            if (FSType == "NTFS")
            {
                return(new FileSystemNTFS(store));
            }
            else if (FSType == "FAT16")
            {
                return(new FileSystemFAT(store, PartitionType.FAT16));
            }
            else if (FSType == "FAT32")
            {
                return(new FileSystemFAT(store, PartitionType.FAT32));
            }

            // TODO: Autodetect based on FS signatures if possible?
            switch (store.StorageType)
            {
            case StorageType.PhysicalDiskPartition: {
                PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
                if (attributes.PartitionType == PartitionType.NTFS)
                {
                    return(new FileSystemNTFS(store));
                }
                else if (attributes.PartitionType == PartitionType.FAT16 ||
                         attributes.PartitionType == PartitionType.FAT32)
                {
                    return(new FileSystemFAT(store, attributes.PartitionType));
                }
                else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support)
                {
                    return(new FileSystemFAT(store, PartitionType.FAT32));
                }
                else
                {
                    return(null);
                }
            }

            case StorageType.LogicalVolume: {
                LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
                if (attributes.FileSystem == "NTFS")
                {
                    return(new FileSystemNTFS(store));
                }
                else if (attributes.FileSystem == "FAT16")
                {
                    return(new FileSystemFAT(store, PartitionType.FAT16));
                }
                else if (attributes.FileSystem == "FAT32")
                {
                    return(new FileSystemFAT(store, PartitionType.FAT32));
                }
                else
                {
                    return(null);
                }
            }

            default:
                return(null);
            }
        }