C# (CSharp) SingularityForensic.Drive LocalHDD Examples

Example #1

        /// <summary>
        /// 添加硬盘;
        /// </summary>
        /// <param name="hdd">硬盘实体</param>
        public void AddHdd(LocalHDD hdd)
        {
            if (hdd == null)
            {
                throw new ArgumentNullException(nameof(hdd));
            }

            var csEvidence = CaseService.Current.
                             CreateNewCaseEvidence(
                new string[] {
                EvidenceType_LocalHDD
            },
                hdd.DevName,
                hdd.SerialNumber
                );

            csEvidence[nameof(hdd.SerialNumber)] = hdd.SerialNumber;

            CaseService.Current.CurrentCase.AddNewCaseEvidence(csEvidence);
            CaseService.Current.CurrentCase.LoadCaseEvidence(csEvidence);
        }

Example #2

File: ComObject.cs Project: nykiez/SingularityForensic

        //初始化本地硬盘;
        private void InitilizeHdds()
        {
            LoggerService.Current?.WriteCallerLine("开始加载设备基本信息");
            _partitionInDeviceStructs.Clear();

            bool res = false;

            try {
#if DEBUG
                LoggerService.Current?.WriteCallerLine("开始执行八爷初始化");
#endif
                res = cdfc_devices_init();
#if DEBUG
                LoggerService.Current?.WriteCallerLine("八爷初始化执行返回");
#endif
            }
            catch (AccessViolationException ex) {
                LoggerService.Current?.WriteCallerLine("cdfc_devices_init()错误!" + ex.Message);
                throw;
            }
            catch (Exception ex) {
                LoggerService.Current?.WriteCallerLine("cdfc_devices_init()未知错误!" + ex.Message);
                throw;
            }

            if (!res)
            {
                throw new Exception($"{nameof(cdfc_devices_init)} returned false");
            }


            LoggerService.Current?.WriteCallerLine("设备初始化成功!");

            var hddPtr    = get_hdd_vender();
            var devicePtr = cdfc_devices_devicelist();

            var deviceNode = devicePtr;

            while (deviceNode != IntPtr.Zero)
            {
                var deviceStructList = deviceNode.GetStructure <DeviceListStruct>();
                PhysicsDeviceStruct deviceStruct;
                try {
                    deviceStruct = deviceStructList.m_ThisDevice.GetStructure <PhysicsDeviceStruct>();
                }
                catch (Exception ex) {
                    LoggerService.Current?.WriteCallerLine("ComObject->LocalObject->deviceStructList.m_ThisDevice.GetStructure<PhysicsDeviceStruct>错误:" + ex.Message);
                    break;
                }
                LoggerService.Current?.WriteCallerLine("获得设备" + deviceStruct.DevName + "大小:" + deviceStruct.DevSize);
                //若ObjectID为16，则为分区(已废弃)，否则为设备；
                if (deviceStruct.ObjectID != 16)
                {
                    var device = new LocalHDD(deviceStruct);
                    for (var hddNode = hddPtr; hddNode != IntPtr.Zero;)
                    {
                        var hddInfoStruct = hddNode.GetStructure <HDDInfoStruct>();
                        if (hddInfoStruct.ID == device.DeviceID)
                        {
                            device.InternalHDDInfo = new HddInfo(hddInfoStruct);
                        }
                        hddNode = hddInfoStruct.Next;
                    }

                    _localHdds.Add(device);
                }
                else
                {
                    _partitionInDeviceStructs.Add(deviceStruct);
                }
                LoggerService.Current?.WriteCallerLine("Device:" + deviceNode);
                deviceNode = deviceStructList.m_next;
            }
        }