internal byte[] GetContent(NtfsVolumeBootRecord VBR)
{
foreach (FileRecordAttribute attr in this.Attribute)
{
if (attr.Name == FileRecordAttribute.ATTR_TYPE.DATA)
{
if (attr.NonResident)
{
return((attr as NonResident).GetBytes(VBR));
}
else
{
return((attr as Data).RawData);
}
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST)
{
AttributeList attrlist = attr as AttributeList;
foreach (AttrRef ar in attrlist.AttributeReference)
{
if (ar.Name == "DATA")
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, (int)VBR.BytesPerFileRecord, true);
return(record.GetContent());
}
}
}
}
throw new Exception("Could not locate file contents");
}
/// <summary>
///
/// </summary>
/// <returns></returns>
public byte[] GetMftSlack()
{
byte[] bytes = FileRecord.GetRecordBytes(this.VolumePath, (int)this.RecordNumber);
return(Helper.GetSubArray(bytes, this.RealSize - 1, this.AllocatedSize - this.RealSize));
}