static void TestStream()
{
const string IMAGE_FILE = @"test.jpg";
const string THUMB_STREAM = "thumb";
//List all of the alternative streams for the file:
NTFS.FileStreams FS = new NTFS.FileStreams(IMAGE_FILE);
Console.WriteLine(FS.FileName);
foreach (NTFS.StreamInfo s in FS)
{
Console.WriteLine("\t" + s.Name);
}
//Using an alternative stream to store a thumbnail image:
System.Drawing.Image thm;
System.IO.FileStream FileStream;
int i = FS.IndexOf(THUMB_STREAM);
if (i == -1)
{
//Thumbnail stream not found - create and store the thumbnail:
Console.WriteLine("Creating thumbnail:");
System.Drawing.Image img = System.Drawing.Image.FromFile(IMAGE_FILE);
int Width = 100; int Height = 100;
//Maintain aspect ratio:
int lW = (int)(img.Width * Height / img.Height);
int lH = (int)(img.Height * Width / img.Width);
if (lW > Width)
{
Height = lH;
}
else if (lH > Height)
{
Width = lW;
}
thm = img.GetThumbnailImage(Width, Height, null, IntPtr.Zero);
//Save the thumbnail to the stream
FS.Add(THUMB_STREAM);
FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.OpenOrCreate, System.IO.FileAccess.Write);
thm.Save(FileStream, System.Drawing.Imaging.ImageFormat.Jpeg);
FileStream.Close();
Console.WriteLine("Created thumbnail: Size {0}x{1}", thm.Width, thm.Height);
}
else
{
//Thumbnail stream exists - read the thumbnail back
Console.WriteLine("Thumbnail already exists!");
FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.Open, System.IO.FileAccess.Read);
thm = System.Drawing.Image.FromStream(FileStream);
FileStream.Close();
Console.WriteLine("Read thumbnail: Size {0}x{1}", thm.Width, thm.Height);
//Remove the thumbnail stream, for demo purposes only!
FS.Remove(THUMB_STREAM);
}
}
/// <summary>
/// Exports a streams' content to a file.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void exportStreamToFileToolStripMenuItem_Click(object sender, EventArgs e)
{
DataRowView drv = dataGridResult.SelectedRows[0].DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
{
if (s.Name == fir.Stream_Name)
{
if (saveFileDialogExport.ShowDialog() == DialogResult.OK)
{
using (FileStream input = s.Open(FileMode.Open))
{
using (FileStream output =
new FileStream(saveFileDialogExport.FileName, FileMode.Create))
{
int bufferSize = 4096;
byte[] buffer = new byte[bufferSize];
while (true)
{
int read = input.Read(buffer, 0, buffer.Length);
if (read <= 0)
{
return;
}
output.Write(buffer, 0, read);
}
}
}
}
}
}
}
static void TestStream()
{
const string IMAGE_FILE = @"..\..\test.jpg";
const string THUMB_STREAM = "thumb";
//List all of the alternative streams for the file:
NTFS.FileStreams FS = new NTFS.FileStreams(IMAGE_FILE);
Console.WriteLine(FS.FileName);
foreach(NTFS.StreamInfo s in FS) Console.WriteLine("\t" + s.Name);
//Using an alternative stream to store a thumbnail image:
System.Drawing.Image thm;
System.IO.FileStream FileStream;
int i = FS.IndexOf(THUMB_STREAM);
if (i==-1)
{
//Thumbnail stream not found - create and store the thumbnail:
Console.WriteLine("Creating thumbnail:");
System.Drawing.Image img = System.Drawing.Image.FromFile(IMAGE_FILE);
int Width = 100; int Height = 100;
//Maintain aspect ratio:
int lW = (int)(img.Width * Height / img.Height);
int lH = (int)(img.Height * Width / img.Width);
if (lW>Width) Height = lH;
else if (lH>Height) Width = lW;
thm = img.GetThumbnailImage(Width, Height, null, IntPtr.Zero);
//Save the thumbnail to the stream
FS.Add(THUMB_STREAM);
FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.OpenOrCreate, System.IO.FileAccess.Write);
thm.Save(FileStream, System.Drawing.Imaging.ImageFormat.Jpeg);
FileStream.Close();
Console.WriteLine("Created thumbnail: Size {0}x{1}", thm.Width, thm.Height);
}
else
{
//Thumbnail stream exists - read the thumbnail back
Console.WriteLine("Thumbnail already exists!");
FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.Open, System.IO.FileAccess.Read);
thm = System.Drawing.Image.FromStream(FileStream);
FileStream.Close();
Console.WriteLine("Read thumbnail: Size {0}x{1}", thm.Width, thm.Height);
//Remove the thumbnail stream, for demo purposes only!
FS.Remove(THUMB_STREAM);
}
}
/// <summary>
/// If the user deletes one or more rows, delete the streams on the file system.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void dataGridResult_UserDeletingRow(object sender, DataGridViewRowCancelEventArgs e)
{
DataRowView drv = e.Row.DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
{
if (s.Name == fir.Stream_Name)
{
s.Delete();
}
}
}
/// <summary>
/// Scans a given directory for alternate data streams.
/// </summary>
/// <param name="sDir">The directory root.</param>
/// <param name="subFolders">Scan subdirectories recursive?</param>
private void DirSearch(string sDir, bool subFolders)
{
try
{
foreach (string f in Directory.GetFiles(sDir))
{
ReportDirName(f);
FileInfo FSInfo = new FileInfo(f);
NTFS.FileStreams FS = new NTFS.FileStreams(f);
foreach (NTFS.StreamInfo s in FS)
{
if (backgroundWorkerScan.CancellationPending)
{
return;
}
FileInfoStruct fis;
fis.File_Name = FS.FileName;
fis.Stream_Name = s.Name;
fis.Stream_Size = s.Size;
fis.Location = FSInfo.DirectoryName;
fis.Creation_Date = FSInfo.CreationTime;
ArrayFileInfo.Add(fis);
}
}
// update the results label
backgroundWorkerScan.ReportProgress(this.ArrayFileInfo.Count);
if (subFolders)
{
foreach (string d in Directory.GetDirectories(sDir))
{
if (backgroundWorkerScan.CancellationPending)
{
return;
}
DirSearch(d, subFolders);
}
}
}
catch
{
}
}
/// <summary>
/// Opens hex editor on row double click.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void dataGridResult_CellDoubleClick(object sender, DataGridViewCellEventArgs e)
{
DataGridView dgv = sender as DataGridView;
DataRowView drv = dgv.Rows[e.RowIndex].DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
HexEditor he = new HexEditor();
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
{
if (s.Name == fir.Stream_Name)
{
using (FileStream fs = s.Open(FileMode.Open))
{
if (fs == null)
{
MessageBox.Show("Accessing acquired file failed, " +
"maybe you have insufficient rights or the file is in use.",
"Access failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
he.labelFileName.Text = fir.File_Name;
he.labelStreamName.Text = fir.Stream_Name;
he.fileStream = fs;
he.hexBoxFileContent.ByteProvider = new DynamicFileByteProvider(fs);
he.ShowDialog();
}
}
}
he.Dispose();
he = null;
}
/// <summary>
/// Exports a streams' content to a file.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void exportStreamToFileToolStripMenuItem_Click(object sender, EventArgs e)
{
DataRowView drv = dataGridResult.SelectedRows[0].DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
{
if (s.Name == fir.Stream_Name)
{
if (saveFileDialogExport.ShowDialog() == DialogResult.OK)
{
using (FileStream input = s.Open(FileMode.Open))
{
using (FileStream output =
new FileStream(saveFileDialogExport.FileName, FileMode.Create))
{
int bufferSize = 4096;
byte[] buffer = new byte[bufferSize];
while (true)
{
int read = input.Read(buffer, 0, buffer.Length);
if (read <= 0)
{
return;
}
output.Write(buffer, 0, read);
}
}
}
}
}
}
}
/// <summary>
/// Scans a given directory for alternate data streams.
/// </summary>
/// <param name="sDir">The directory root.</param>
/// <param name="subFolders">Scan subdirectories recursive?</param>
private void DirSearch(string sDir, bool subFolders)
{
try
{
foreach (string f in Directory.GetFiles(sDir))
{
ReportDirName(f);
FileInfo FSInfo = new FileInfo(f);
NTFS.FileStreams FS = new NTFS.FileStreams(f);
foreach (NTFS.StreamInfo s in FS)
{
if (backgroundWorkerScan.CancellationPending)
return;
FileInfoStruct fis;
fis.File_Name = FS.FileName;
fis.Stream_Name = s.Name;
fis.Stream_Size = s.Size;
fis.Location = FSInfo.DirectoryName;
fis.Creation_Date = FSInfo.CreationTime;
ArrayFileInfo.Add(fis);
}
}
// update the results label
backgroundWorkerScan.ReportProgress(this.ArrayFileInfo.Count);
if (subFolders)
{
foreach (string d in Directory.GetDirectories(sDir))
{
if (backgroundWorkerScan.CancellationPending)
return;
DirSearch(d, subFolders);
}
}
}
catch
{
}
}
/// <summary>
/// If the user deletes one or more rows, delete the streams on the file system.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void dataGridResult_UserDeletingRow(object sender, DataGridViewRowCancelEventArgs e)
{
DataRowView drv = e.Row.DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
if (s.Name == fir.Stream_Name)
s.Delete();
}
/// <summary>
/// Opens hex editor on row double click.
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void dataGridResult_CellDoubleClick(object sender, DataGridViewCellEventArgs e)
{
DataGridView dgv = sender as DataGridView;
DataRowView drv = dgv.Rows[e.RowIndex].DataBoundItem as DataRowView;
FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow;
HexEditor he = new HexEditor();
NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name);
foreach (NTFS.StreamInfo s in FS)
{
if (s.Name == fir.Stream_Name)
{
using (FileStream fs = s.Open(FileMode.Open))
{
if (fs == null)
{
MessageBox.Show("Accessing acquired file failed, " +
"maybe you have insufficient rights or the file is in use.",
"Access failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
return;
}
he.labelFileName.Text = fir.File_Name;
he.labelStreamName.Text = fir.Stream_Name;
he.fileStream = fs;
he.hexBoxFileContent.ByteProvider = new DynamicFileByteProvider(fs);
he.ShowDialog();
}
}
}
he.Dispose();
he = null;
}
