public static FileRecord[] GetInstances(string volume)
        {
            FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);

            byte[] mftBytes = record.GetBytes();
            return(GetInstances(mftBytes, volume));
        }
 internal byte[] GetBytes(VolumeBootRecord VBR)
 {
     foreach (Attr attr in this.Attribute)
     {
         if (attr.Name == Attr.ATTR_TYPE.DATA)
         {
             if (attr.NonResident)
             {
                 return((attr as NonResident).GetBytes(this.VolumePath, VBR));
             }
             else
             {
                 return((attr as Data).RawData);
             }
         }
         else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
         {
             AttributeList attrlist = attr as AttributeList;
             foreach (AttrRef ar in attrlist.AttributeReference)
             {
                 if (ar.Name == "DATA")
                 {
                     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
                     return(record.GetBytes());
                 }
             }
         }
     }
     throw new Exception("Could not locate file contents");
 }
        public static FileRecord[] GetInstancesByPath(string path)
        {
            string     volume = NativeMethods.GetVolumeFromPath(path);
            FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);

            byte[] mftBytes = record.GetBytes();
            return(GetInstances(mftBytes, volume));
        }
        public static AttrDef[] GetInstancesByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            return(AttrDef.GetInstances(record.GetBytes()));
        }
        public static AttrDef[] GetInstances(string volume)
        {
            FileRecord record = FileRecord.Get(volume, ATTRDEF_INDEX, true);

            return(AttrDef.GetInstances(record.GetBytes()));
        }
        public static byte[] GetBytesByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            return(record.GetBytes());
        }
 internal byte[] GetBytes(VolumeBootRecord VBR)
 {
     foreach (Attr attr in this.Attribute)
     {
         if (attr.Name == Attr.ATTR_TYPE.DATA)
         {
             if (attr.NonResident)
             {
                 return (attr as NonResident).GetBytes(this.VolumePath, VBR);
             }
             else
             {
                 return (attr as Data).RawData;
             }
         }
         else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
         {
             AttributeList attrlist = attr as AttributeList;
             foreach (AttrRef ar in attrlist.AttributeReference)
             {
                 if (ar.Name == "DATA")
                 {
                     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
                     return record.GetBytes();
                 }
             }
         }
     }
     throw new Exception("Could not locate file contents");
 }
 public static FileRecord[] GetInstancesByPath(string path)
 {
     string volume = NativeMethods.GetVolumeFromPath(path);
     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
     byte[] mftBytes = record.GetBytes();
     return GetInstances(mftBytes, volume);
 }
 public static FileRecord[] GetInstances(string volume)
 {
     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
     byte[] mftBytes = record.GetBytes();
     return GetInstances(mftBytes, volume);
 }