Example #1
0
        private byte[] GetOpenAttributeTableBytes(out byte[] attributeNameTableBytes)
        {
            List <OpenAttributeEntry> openAttributeTable = new List <OpenAttributeEntry>();
            List <AttributeNameEntry> attributeNameTable = new List <AttributeNameEntry>();

            for (int index = 0; index < m_openAttributes.Count; index++)
            {
                OpenAttribute      openAttribute = m_openAttributes[index];
                OpenAttributeEntry entry         = new OpenAttributeEntry(m_majorVersion);
                entry.AllocatedOrNextFree = RestartTableEntry.RestartEntryAllocated;
                // Note: NTFS v5.1 driver calulates AttributeOffset using entry length of 0x28, the reason is unclear but we're immitating this.
                entry.AttributeOffset   = (uint)(RestartTableHeader.Length + index * OpenAttributeEntry.LengthV1);
                entry.FileReference     = openAttribute.FileReference;
                entry.LsnOfOpenRecord   = openAttribute.LsnOfOpenRecord;
                entry.AttributeTypeCode = openAttribute.AttributeType;
                openAttributeTable.Add(entry);
                if (openAttribute.AttributeName != String.Empty)
                {
                    int openAttributeOffset      = OpenAttributeIndexToOffset(index);
                    AttributeNameEntry nameEntry = new AttributeNameEntry();
                    nameEntry.OpenAttributeOffset = (ushort)openAttributeOffset;
                    nameEntry.Name = openAttribute.AttributeName;
                    attributeNameTable.Add(nameEntry);
                }
            }

            attributeNameTableBytes = null;
            if (attributeNameTable.Count > 0)
            {
                attributeNameTableBytes = AttributeNameEntry.GetTableBytes(attributeNameTable);
            }
            return(RestartTableHelper.GetTableBytes <OpenAttributeEntry>(openAttributeTable));
        }
Example #2
0
        public LfsRecord WriteForgetTransactionRecord(uint transactionID, bool flushToDisk)
        {
            NTFSLogRecord ntfsLogRecord = new NTFSLogRecord();

            ntfsLogRecord.RedoOperation = NTFSLogOperation.ForgetTransaction;
            ntfsLogRecord.UndoOperation = NTFSLogOperation.CompensationLogRecord;
            LfsRecord result = WriteLogRecord(ntfsLogRecord, transactionID, flushToDisk);

            DeallocateTransactionID(transactionID);
            // Update the open attribute table and remove any open attribute that no longer has an associated transaction
            for (int index = 0; index < m_openAttributes.Count; index++)
            {
                OpenAttribute openAttribute = m_openAttributes[index];
                openAttribute.AssociatedTransactions.Remove(transactionID);
                if (openAttribute.AssociatedTransactions.Count == 0)
                {
                    m_openAttributes.RemoveAt(index);
                    index--;
                }
            }
            return(result);
        }