public void SetExtent(FileRecordReference containingFile, AttributeRecord record)
{
_containingFile = containingFile;
_record = record;
_extents.Clear();
_extents.Add(new AttributeReference(containingFile, record.AttributeId), record);
}
protected NtfsAttribute(File file, FileRecordReference containingFile, AttributeRecord record)
{
_file = file;
_containingFile = containingFile;
_primaryRecord = record;
_extents = new Dictionary<AttributeReference, AttributeRecord>();
_extents.Add(new AttributeReference(containingFile, record.AttributeId), _primaryRecord);
}
internal void Remove(uint tag, FileRecordReference file)
{
Key key = new Key();
key.Tag = tag;
key.File = file;
_index.Remove(key);
_file.UpdateRecordInMft();
}
public int ReadFrom(byte[] buffer, int offset)
{
MftReference = new FileRecordReference();
MftReference.ReadFrom(buffer, offset);
BirthVolumeId = Utilities.ToGuidLittleEndian(buffer, offset + 0x08);
BirthObjectId = Utilities.ToGuidLittleEndian(buffer, offset + 0x18);
BirthDomainId = Utilities.ToGuidLittleEndian(buffer, offset + 0x28);
return 0x38;
}
internal void Add(uint tag, FileRecordReference file)
{
Key newKey = new Key();
newKey.Tag = tag;
newKey.File = file;
Data data = new Data();
_index[newKey] = data;
_file.UpdateRecordInMft();
}
internal void Add(Guid objId, FileRecordReference mftRef, Guid birthId, Guid birthVolumeId, Guid birthDomainId)
{
IndexKey newKey = new IndexKey();
newKey.Id = objId;
ObjectIdRecord newData = new ObjectIdRecord();
newData.MftReference = mftRef;
newData.BirthObjectId = birthId;
newData.BirthVolumeId = birthVolumeId;
newData.BirthDomainId = birthDomainId;
_index[newKey] = newData;
_file.UpdateRecordInMft();
}
public void ReInitialize(int sectorSize, int recordLength, uint index)
{
Initialize("FILE", sectorSize, recordLength);
_sequenceNumber++;
_flags = FileRecordFlags.None;
_recordAllocatedSize = (uint)recordLength;
_nextAttributeId = 0;
_index = index;
_hardLinkCount = 0;
_baseFile = new FileRecordReference(0);
_attributes = new List<AttributeRecord>();
_haveIndex = true;
}
public bool ReplaceExtent(AttributeReference oldRef, AttributeReference newRef, AttributeRecord record)
{
if (!_extents.Remove(oldRef))
{
return false;
}
else
{
if (oldRef.Equals(Reference) || _extents.Count == 0)
{
_record = record;
_containingFile = newRef.File;
}
_extents.Add(newRef, record);
return true;
}
}
public void RemoveRecord(FileRecordReference fileRef)
{
FileRecord record = GetRecord(fileRef.MftIndex, false);
record.Reset();
WriteRecord(record);
_recordCache.Remove(fileRef.MftIndex);
_bitmap.MarkAbsent(fileRef.MftIndex);
_self.UpdateRecordInMft();
}
public int ReadFrom(byte[] buffer, int offset)
{
Tag = Utilities.ToUInt32LittleEndian(buffer, offset);
File = new FileRecordReference(Utilities.ToUInt64LittleEndian(buffer, offset + 4));
return 12;
}
public DirectoryEntry(Directory directory, FileRecordReference fileReference, FileNameRecord fileDetails)
{
_directory = directory;
_fileReference = fileReference;
_fileDetails = fileDetails;
}
private FileRecord GetFileRecord(FileRecordReference fileReference)
{
foreach (var record in _records)
{
if (record.MasterFileTableIndex == fileReference.MftIndex)
{
return record;
}
}
return null;
}
internal Directory GetDirectory(FileRecordReference fileReference)
{
return (Directory)GetFile(fileReference);
}
internal MasterFileTableReference(FileRecordReference recordRef)
{
_ref = recordRef;
}
public FileRecord GetRecord(FileRecordReference fileReference)
{
FileRecord result = GetRecord(fileReference.MftIndex, false);
if (result != null)
{
if (fileReference.SequenceNumber != 0 && result.SequenceNumber != 0)
{
if (fileReference.SequenceNumber != result.SequenceNumber)
{
throw new IOException("Attempt to get an MFT record with an old reference");
}
}
}
return result;
}
public void AddExtent(FileRecordReference containingFile, AttributeRecord record)
{
_cachedRawBuffer = null;
_extents.Add(new AttributeReference(containingFile, record.AttributeId), record);
}
public void SetExtent(FileRecordReference containingFile, AttributeRecord record)
{
_cachedRawBuffer = null;
_containingFile = containingFile;
_primaryRecord = record;
_extents.Clear();
_extents.Add(new AttributeReference(containingFile, record.AttributeId), record);
}
public static NtfsAttribute FromRecord(File file, FileRecordReference recordFile, AttributeRecord record)
{
switch (record.AttributeType)
{
case AttributeType.StandardInformation:
return new StructuredNtfsAttribute<StandardInformation>(file, recordFile, record);
case AttributeType.FileName:
return new StructuredNtfsAttribute<FileNameRecord>(file, recordFile, record);
case AttributeType.SecurityDescriptor:
return new StructuredNtfsAttribute<SecurityDescriptor>(file, recordFile, record);
case AttributeType.Data:
return new NtfsAttribute(file, recordFile, record);
case AttributeType.Bitmap:
return new NtfsAttribute(file, recordFile, record);
case AttributeType.VolumeName:
return new StructuredNtfsAttribute<VolumeName>(file, recordFile, record);
case AttributeType.VolumeInformation:
return new StructuredNtfsAttribute<VolumeInformation>(file, recordFile, record);
case AttributeType.IndexRoot:
return new NtfsAttribute(file, recordFile, record);
case AttributeType.IndexAllocation:
return new NtfsAttribute(file, recordFile, record);
case AttributeType.ObjectId:
return new StructuredNtfsAttribute<ObjectId>(file, recordFile, record);
case AttributeType.ReparsePoint:
return new StructuredNtfsAttribute<ReparsePointRecord>(file, recordFile, record);
case AttributeType.AttributeList:
return new StructuredNtfsAttribute<AttributeList>(file, recordFile, record);
default:
return new NtfsAttribute(file, recordFile, record);
}
}
public long GetRecordOffset(FileRecordReference fileReference)
{
return fileReference.MftIndex * _recordLength;
}
internal MasterFileTableReference(FileRecordReference recordRef)
{
_ref = recordRef;
}
internal static string EntryAsString(IndexEntry entry, string fileName, string indexName)
{
IByteArraySerializable keyValue = null;
IByteArraySerializable dataValue = null;
// Try to guess the type of data in the key and data fields from the filename and index name
if (indexName == "$I30")
{
keyValue = new FileNameRecord();
dataValue = new FileRecordReference();
}
else if (fileName == "$ObjId" && indexName == "$O")
{
keyValue = new ObjectIds.IndexKey();
dataValue = new ObjectIdRecord();
}
else if (fileName == "$Reparse" && indexName == "$R")
{
keyValue = new ReparsePoints.Key();
dataValue = new ReparsePoints.Data();
}
else if (fileName == "$Quota")
{
if (indexName == "$O")
{
keyValue = new Quotas.OwnerKey();
dataValue = new Quotas.OwnerRecord();
}
else if (indexName == "$Q")
{
keyValue = new Quotas.OwnerRecord();
dataValue = new Quotas.QuotaRecord();
}
}
else if (fileName == "$Secure")
{
if (indexName == "$SII")
{
keyValue = new SecurityDescriptors.IdIndexKey();
dataValue = new SecurityDescriptors.IdIndexData();
}
else if (indexName == "$SDH")
{
keyValue = new SecurityDescriptors.HashIndexKey();
dataValue = new SecurityDescriptors.IdIndexData();
}
}
try
{
if (keyValue != null && dataValue != null)
{
keyValue.ReadFrom(entry.KeyBuffer, 0);
dataValue.ReadFrom(entry.DataBuffer, 0);
return "{" + keyValue + "-->" + dataValue + "}";
}
}
catch
{
return "{Parsing-Error}";
}
return "{Unknown-Index-Type}";
}
public DirectoryEntry(Directory directory, FileRecordReference fileReference, FileNameRecord fileDetails)
{
_directory = directory;
_fileReference = fileReference;
_fileDetails = fileDetails;
}
private void RemoveFileRecord(FileRecordReference fileReference)
{
for (int i = 0; i < _records.Count; ++i)
{
if (_records[i].MasterFileTableIndex == fileReference.MftIndex)
{
FileRecord record = _records[i];
if (record.Attributes.Count > 0)
{
throw new IOException("Attempting to remove non-empty MFT record");
}
_context.Mft.RemoveRecord(fileReference);
_records.Remove(record);
if (_records.Count == 1)
{
NtfsAttribute attrListAttr = GetAttribute(AttributeType.AttributeList, null);
if (attrListAttr != null)
{
RemoveAttribute(attrListAttr);
}
}
}
}
}
protected override void Read(byte[] buffer, int offset)
{
_logFileSequenceNumber = Utilities.ToUInt64LittleEndian(buffer, offset + 0x08);
_sequenceNumber = Utilities.ToUInt16LittleEndian(buffer, offset + 0x10);
_hardLinkCount = Utilities.ToUInt16LittleEndian(buffer, offset + 0x12);
_firstAttributeOffset = Utilities.ToUInt16LittleEndian(buffer, offset + 0x14);
_flags = (FileRecordFlags)Utilities.ToUInt16LittleEndian(buffer, offset + 0x16);
_recordRealSize = Utilities.ToUInt32LittleEndian(buffer, offset + 0x18);
_recordAllocatedSize = Utilities.ToUInt32LittleEndian(buffer, offset + 0x1C);
_baseFile = new FileRecordReference(Utilities.ToUInt64LittleEndian(buffer, offset + 0x20));
_nextAttributeId = Utilities.ToUInt16LittleEndian(buffer, offset + 0x28);
if (UpdateSequenceOffset >= 0x30)
{
_index = Utilities.ToUInt32LittleEndian(buffer, offset + 0x2C);
_haveIndex = true;
}
_attributes = new List<AttributeRecord>();
int focus = _firstAttributeOffset;
while (true)
{
int length;
AttributeRecord attr = AttributeRecord.FromBytes(buffer, focus, out length);
if (attr == null)
{
break;
}
_attributes.Add(attr);
focus += (int)length;
}
}
internal File GetFile(FileRecordReference fileReference)
{
FileRecord record = _context.Mft.GetRecord(fileReference);
if (record == null)
{
return null;
}
// Don't create file objects for file record segments that are part of another
// logical file.
if (record.BaseFile.Value != 0)
{
return null;
}
File file = _fileCache[fileReference.MftIndex];
if (file != null && file.MftReference.SequenceNumber != fileReference.SequenceNumber)
{
file = null;
}
if (file == null)
{
if ((record.Flags & FileRecordFlags.IsDirectory) != 0)
{
file = new Directory(_context, record);
}
else
{
file = new File(_context, record);
}
_fileCache[fileReference.MftIndex] = file;
}
return file;
}
public string GetFirstName(FileRecordReference dir, FileNameNamespace aliasNamespace)
{
foreach (StructuredNtfsAttribute<FileNameRecord> attr in GetAttributes(AttributeType.FileName))
{
FileNameRecord fnr = attr.Content;
if (fnr.ParentDirectory.Equals(dir) && fnr.FileNameNamespace == aliasNamespace)
{
return fnr.FileName;
}
}
return null;
}