/// <summary>
/// Reads the File Allocation Table of a FAT filesystem.
/// </summary>
public FileAllocationTable(IFileSystemStore store, long fatOffset, long fatSizeInBytes, PartitionType type)
{
_store = store;
_fatOffset = fatOffset;
_fatSizeInBytes = fatSizeInBytes;
if (type == PartitionType.FAT16)
{
_entrySize = 2;
}
else // FAT32
{
_entrySize = 4;
}
_numEntries = (int)(fatSizeInBytes / _entrySize);
// If the FAT is small enough, just load it into memory.
// Otherwise, we'll read from the disk on demand.
if (fatSizeInBytes < 100 * 1024 * 1024) // < 100 MB
{
_fatEntries = new uint[_numEntries];
int i = 0;
for (long offset = 0; offset < fatSizeInBytes; offset += _entrySize)
{
_fatEntries[i] = (uint)Util.GetArbitraryUInt(store, (ulong)(fatOffset + offset), (int)_entrySize);
++i;
}
_inMemory = true;
}
else
{
_inMemory = false;
}
}
public static bool HasFileSystem(IFileSystemStore store) {
if (store == null || store.StreamLength == 0) return false;
switch (store.StorageType) {
case StorageType.PhysicalDiskPartition: {
PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
if (attributes.PartitionType == PartitionType.NTFS) {
return true;
} else if (attributes.PartitionType == PartitionType.FAT16
|| attributes.PartitionType == PartitionType.FAT32) {
return true;
} else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support) {
return true;
} else {
return false;
}
}
case StorageType.LogicalVolume: {
LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
if (attributes.FileSystem == "NTFS") {
return true;
} else if (attributes.FileSystem == "FAT16") {
return true;
} else if (attributes.FileSystem == "FAT32") {
return true;
} else {
return false;
}
}
default:
return false;
}
}
public StoreService(IConvertor convertor, IFileSystemStore fileSystemStore, IPersonService personService, IHackingService hackingService)
{
this.convertor = convertor;
this.fileSystemStore = fileSystemStore;
this.personService = personService;
this.hackingService = hackingService;
}
/// <summary>
/// Views a data stream. Clients should check that CanView(stream)
/// returns true before calling this method.
/// </summary>
/// <param name="stream">The data stream to view.</param>
public void View(IDataStream stream)
{
if (stream != _currentStream)
{
_currentStream = stream;
treeFiles.Nodes.Clear();
IFileSystemStore store = stream as IFileSystemStore;
if (store != null)
{
IFileSystem fs = store.FS;
FileSystemNode fsRoot;
if (fs != null)
{
fsRoot = fs.GetRoot();
TreeNode root = new TreeNode(fsRoot.ToString());
root.Tag = fsRoot;
root.SelectedImageKey = root.ImageKey = "Directory";
treeFiles.Nodes.Add(root);
root.Nodes.Add(new TreeNode("dummy"));
((Folder)fsRoot).Loaded = false;
}
else
{
treeFiles.Nodes.Add("Unknown file system");
}
}
}
}
/// <summary>
/// Reads the File Allocation Table of a FAT filesystem.
/// </summary>
public FileAllocationTable(IFileSystemStore store, long fatOffset, long fatSizeInBytes, PartitionType type) {
_store = store;
_fatOffset = fatOffset;
_fatSizeInBytes = fatSizeInBytes;
if (type == PartitionType.FAT16) {
_entrySize = 2;
} else { // FAT32
_entrySize = 4;
}
_numEntries = (int)(fatSizeInBytes / _entrySize);
// If the FAT is small enough, just load it into memory.
// Otherwise, we'll read from the disk on demand.
if (fatSizeInBytes < 100 * 1024 * 1024) { // < 100 MB
_fatEntries = new uint[_numEntries];
int i = 0;
for (long offset = 0; offset < fatSizeInBytes; offset += _entrySize) {
_fatEntries[i] = (uint)Util.GetArbitraryUInt(store, (ulong)(fatOffset + offset), (int)_entrySize);
++i;
}
_inMemory = true;
} else {
_inMemory = false;
}
}
public FileSystemNTFS(IFileSystemStore store) {
Store = store;
LoadBPB();
_mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
_MFT = new FileNTFS(MFTRecord.Load(0, this), "");
_root = new FolderNTFS(MFTRecord.Load(5, this), "", true);
_bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
_bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
}
public static bool HasFileSystem(IFileSystemStore store)
{
if (store == null || store.StreamLength == 0)
{
return(false);
}
switch (store.StorageType)
{
case StorageType.PhysicalDiskPartition: {
PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
if (attributes.PartitionType == PartitionType.NTFS)
{
return(true);
}
else if (attributes.PartitionType == PartitionType.FAT16 ||
attributes.PartitionType == PartitionType.FAT32)
{
return(true);
}
else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support)
{
return(true);
}
else
{
return(false);
}
}
case StorageType.LogicalVolume: {
LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
if (attributes.FileSystem == "NTFS")
{
return(true);
}
else if (attributes.FileSystem == "FAT16")
{
return(true);
}
else if (attributes.FileSystem == "FAT32")
{
return(true);
}
else
{
return(false);
}
}
default:
return(false);
}
}
public FileSystemNTFS(IFileSystemStore store)
{
Store = store;
LoadBPB();
_mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
_MFT = new FileNTFS(MFTRecord.Load(0, this), "");
_root = new FolderNTFS(MFTRecord.Load(5, this), "", true);
_bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
_bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
}
private void SetFileSystem(IFileSystemStore logicalDisk)
{
if (logicalDisk.FS != null)
{
if (!_scanners.ContainsKey(logicalDisk.FS))
{
_scanners[logicalDisk.FS] = new Scanner(logicalDisk.ToString(), logicalDisk.FS);
_deletedViewers[logicalDisk.FS] = new DeletedFileViewer(_scanners[logicalDisk.FS]);
AddDeletedFileViewer(_deletedViewers[logicalDisk.FS]);
}
if (_fileSystem != null && _scanners.ContainsKey(_fileSystem))
{
_deletedViewers[_fileSystem].Hide();
}
_fileSystem = logicalDisk.FS;
_deletedViewers[logicalDisk.FS].Show();
}
}
public FileSystemFAT(IFileSystemStore store, PartitionType type)
{
Store = store;
Type = type;
LoadBPB();
_FATLocation = BPB_RsvdSecCnt * BPB_BytsPerSec;
// Load the FAT.
_fileAllocationTable = new FileAllocationTable(store, _FATLocation, FATSize * BytesPerSector, type);
long rootDirSectors = ((BPB_RootEntCnt * 32) + (BPB_BytsPerSec - 1)) / BPB_BytsPerSec;
long afterFAT = _FATLocation + BPB_NumFATs * FATSize * BPB_BytsPerSec;
_dataLocation = afterFAT + rootDirSectors * BPB_BytsPerSec;
if (Type == PartitionType.FAT32)
{
_rootDirLocation = GetDiskOffsetOfFATCluster(BPB_RootClus);
}
else
{
_rootDirLocation = afterFAT;
}
_root = new FolderFAT(this, _rootDirLocation, 2);
}
public static IFileSystem TryLoad(IFileSystemStore store, string FSType = null)
{
if (store == null || store.StreamLength == 0)
{
return(null);
}
if (FSType == "NTFS")
{
return(new FileSystemNTFS(store));
}
else if (FSType == "FAT16")
{
return(new FileSystemFAT(store, PartitionType.FAT16));
}
else if (FSType == "FAT32")
{
return(new FileSystemFAT(store, PartitionType.FAT32));
}
// TODO: Autodetect based on FS signatures if possible?
switch (store.StorageType)
{
case StorageType.PhysicalDiskPartition: {
PhysicalDiskPartitionAttributes attributes = (PhysicalDiskPartitionAttributes)store.Attributes;
if (attributes.PartitionType == PartitionType.NTFS)
{
return(new FileSystemNTFS(store));
}
else if (attributes.PartitionType == PartitionType.FAT16 ||
attributes.PartitionType == PartitionType.FAT32)
{
return(new FileSystemFAT(store, attributes.PartitionType));
}
else if (attributes.PartitionType == PartitionType.FAT32WithInt13Support)
{
return(new FileSystemFAT(store, PartitionType.FAT32));
}
else
{
return(null);
}
}
case StorageType.LogicalVolume: {
LogicalDiskAttributes attributes = (LogicalDiskAttributes)store.Attributes;
if (attributes.FileSystem == "NTFS")
{
return(new FileSystemNTFS(store));
}
else if (attributes.FileSystem == "FAT16")
{
return(new FileSystemFAT(store, PartitionType.FAT16));
}
else if (attributes.FileSystem == "FAT32")
{
return(new FileSystemFAT(store, PartitionType.FAT32));
}
else
{
return(null);
}
}
default:
return(null);
}
}