public Index(File file, string name, BiosParameterBlock bpb, UpperCase upCase)
{
_file = file;
_name = name;
_bpb = bpb;
_isFileIndex = name == "$I30";
_blockCache = new ObjectCache<long, IndexBlock>();
_root = _file.GetStream(AttributeType.IndexRoot, _name).GetContent<IndexRoot>();
_comparer = _root.GetCollator(upCase);
using (Stream s = _file.OpenStream(AttributeType.IndexRoot, _name, FileAccess.Read))
{
byte[] buffer = Utilities.ReadFully(s, (int)s.Length);
_rootNode = new IndexNode(WriteRootNodeToDisk, 0, this, true, buffer, IndexRoot.HeaderOffset);
// Give the attribute some room to breathe, so long as it doesn't squeeze others out
// BROKEN, BROKEN, BROKEN - how to figure this out? Query at the point of adding entries to the root node?
_rootNode.TotalSpaceAvailable += _file.MftRecordFreeSpace(AttributeType.IndexRoot, _name) - 100;
}
if (_file.StreamExists(AttributeType.IndexAllocation, _name))
{
_indexStream = _file.OpenStream(AttributeType.IndexAllocation, _name, FileAccess.ReadWrite);
}
if (_file.StreamExists(AttributeType.Bitmap, _name))
{
_indexBitmap = new Bitmap(_file.OpenStream(AttributeType.Bitmap, _name, FileAccess.ReadWrite), long.MaxValue);
}
}
public ClusterBitmap(File file)
{
_file = file;
_bitmap = new Bitmap(
_file.OpenStream(AttributeType.Data, null, FileAccess.ReadWrite),
Utilities.Ceil(file.Context.BiosParameterBlock.TotalSectors64, file.Context.BiosParameterBlock.SectorsPerCluster));
}
public File InitializeNew(INtfsContext context, long firstBitmapCluster, ulong numBitmapClusters, long firstRecordsCluster, ulong numRecordsClusters)
{
BiosParameterBlock bpb = context.BiosParameterBlock;
FileRecord fileRec = new FileRecord(bpb.BytesPerSector, bpb.MftRecordSize, (uint)MftIndex);
fileRec.Flags = FileRecordFlags.InUse;
fileRec.SequenceNumber = 1;
_recordCache[MftIndex] = fileRec;
_self = new File(context, fileRec);
StandardInformation.InitializeNewFile(_self, FileAttributeFlags.Hidden | FileAttributeFlags.System);
NtfsStream recordsStream = _self.CreateStream(AttributeType.Data, null, firstRecordsCluster, numRecordsClusters, (uint)bpb.BytesPerCluster);
_recordStream = recordsStream.Open(FileAccess.ReadWrite);
Wipe(_recordStream);
NtfsStream bitmapStream = _self.CreateStream(AttributeType.Bitmap, null, firstBitmapCluster, numBitmapClusters, (uint)bpb.BytesPerCluster);
using (Stream s = bitmapStream.Open(FileAccess.ReadWrite))
{
Wipe(s);
s.SetLength(8);
_bitmap = new Bitmap(s, long.MaxValue);
}
_recordLength = context.BiosParameterBlock.MftRecordSize;
_bytesPerSector = context.BiosParameterBlock.BytesPerSector;
_bitmap.MarkPresentRange(0, 1);
// Write the MFT's own record to itself
byte[] buffer = new byte[_recordLength];
fileRec.ToBytes(buffer, 0);
_recordStream.Position = 0;
_recordStream.Write(buffer, 0, _recordLength);
_recordStream.Flush();
return _self;
}
public void Initialize(File file)
{
_self = file;
if (_recordStream != null)
{
_recordStream.Dispose();
}
NtfsStream bitmapStream = _self.GetStream(AttributeType.Bitmap, null);
_bitmap = new Bitmap(bitmapStream.Open(FileAccess.ReadWrite), long.MaxValue);
NtfsStream recordsStream = _self.GetStream(AttributeType.Data, null);
_recordStream = recordsStream.Open(FileAccess.ReadWrite);
}
internal IndexBlock AllocateBlock(IndexEntry parentEntry)
{
if (_indexStream == null)
{
_file.CreateStream(AttributeType.IndexAllocation, _name);
_indexStream = _file.OpenStream(AttributeType.IndexAllocation, _name, FileAccess.ReadWrite);
}
if (_indexBitmap == null)
{
_file.CreateStream(AttributeType.Bitmap, _name);
_indexBitmap = new Bitmap(_file.OpenStream(AttributeType.Bitmap, _name, FileAccess.ReadWrite), long.MaxValue);
}
long idx = _indexBitmap.AllocateFirstAvailable(0);
parentEntry.ChildrenVirtualCluster = idx * Utilities.Ceil(_bpb.IndexBufferSize, _bpb.SectorsPerCluster * _bpb.BytesPerSector);
parentEntry.Flags |= IndexEntryFlags.Node;
IndexBlock block = IndexBlock.Initialize(this, false, parentEntry, _bpb);
_blockCache[parentEntry.ChildrenVirtualCluster] = block;
return block;
}
private void PreVerifyMft(File file)
{
int recordLength = _context.BiosParameterBlock.MftRecordSize;
int bytesPerSector = _context.BiosParameterBlock.BytesPerSector;
// Check out the MFT's clusters
foreach (var range in file.GetAttribute(AttributeType.Data, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT data attribute {0}", range.ToString());
Abort();
}
}
foreach (var range in file.GetAttribute(AttributeType.Bitmap, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT bitmap attribute {0}", range.ToString());
Abort();
}
}
using (Stream mftStream = file.OpenStream(AttributeType.Data, null, FileAccess.Read))
using (Stream bitmapStream = file.OpenStream(AttributeType.Bitmap, null, FileAccess.Read))
{
Bitmap bitmap = new Bitmap(bitmapStream, long.MaxValue);
long index = 0;
while (mftStream.Position < mftStream.Length)
{
byte[] recordData = Utilities.ReadFully(mftStream, recordLength);
string magic = Utilities.BytesToString(recordData, 0, 4);
if (magic != "FILE")
{
if (bitmap.IsPresent(index))
{
ReportError("Invalid MFT record magic at index {0} - was ({2},{3},{4},{5}) \"{1}\"", index, magic.Trim('\0'), (int)magic[0], (int)magic[1], (int)magic[2], (int)magic[3]);
}
}
else
{
if (!VerifyMftRecord(recordData, bitmap.IsPresent(index), bytesPerSector))
{
ReportError("Invalid MFT record at index {0}", index);
StringBuilder bldr = new StringBuilder();
for (int i = 0; i < recordData.Length; ++i)
{
bldr.Append(string.Format(CultureInfo.InvariantCulture, " {0:X2}", recordData[i]));
}
ReportInfo("MFT record binary data for index {0}:{1}", index, bldr.ToString());
}
}
index++;
}
}
}
private bool SelfCheckIndexNode(byte[] buffer, int offset, Bitmap bitmap, IndexRoot root, string fileName, string indexName)
{
bool ok = true;
IndexHeader header = new IndexHeader(buffer, offset);
IndexEntry lastEntry = null;
IComparer<byte[]> collator = root.GetCollator(_context.UpperCase);
int pos = (int)header.OffsetToFirstEntry;
while (pos < header.TotalSizeOfEntries)
{
IndexEntry entry = new IndexEntry(indexName == "$I30");
entry.Read(buffer, offset + pos);
pos += entry.Size;
if ((entry.Flags & IndexEntryFlags.Node) != 0)
{
long bitmapIdx = entry.ChildrenVirtualCluster / Utilities.Ceil(root.IndexAllocationSize, _context.BiosParameterBlock.SectorsPerCluster * _context.BiosParameterBlock.BytesPerSector);
if (!bitmap.IsPresent(bitmapIdx))
{
ReportError("Index entry {0} is non-leaf, but child vcn {1} is not in bitmap at index {2}", Index.EntryAsString(entry, fileName, indexName), entry.ChildrenVirtualCluster, bitmapIdx);
}
}
if ((entry.Flags & IndexEntryFlags.End) != 0)
{
if (pos != header.TotalSizeOfEntries)
{
ReportError("Found END index entry {0}, but not at end of node", Index.EntryAsString(entry, fileName, indexName));
ok = false;
}
}
if (lastEntry != null && collator.Compare(lastEntry.KeyBuffer, entry.KeyBuffer) >= 0)
{
ReportError("Found entries out of order {0} was before {1}", Index.EntryAsString(lastEntry, fileName, indexName), Index.EntryAsString(entry, fileName, indexName));
ok = false;
}
lastEntry = entry;
}
return ok;
}
private void SelfCheckIndex(File file, string name)
{
ReportInfo("About to self-check index {0} in file {1} (MFT:{2})", name, file.BestName, file.IndexInMft);
IndexRoot root = file.GetStream(AttributeType.IndexRoot, name).GetContent<IndexRoot>();
byte[] rootBuffer;
using (Stream s = file.OpenStream(AttributeType.IndexRoot, name, FileAccess.Read))
{
rootBuffer = Utilities.ReadFully(s, (int)s.Length);
}
Bitmap indexBitmap = null;
if (file.GetStream(AttributeType.Bitmap, name) != null)
{
indexBitmap = new Bitmap(file.OpenStream(AttributeType.Bitmap, name, FileAccess.Read), long.MaxValue);
}
if (!SelfCheckIndexNode(rootBuffer, IndexRoot.HeaderOffset, indexBitmap, root, file.BestName, name))
{
ReportError("Index {0} in file {1} (MFT:{2}) has corrupt IndexRoot attribute", name, file.BestName, file.IndexInMft);
}
else
{
ReportInfo("Self-check of index {0} in file {1} (MFT:{2}) complete", name, file.BestName, file.IndexInMft);
}
}