internal static List<IndexEntry> Get(FileStream streamToRead, byte[] MFT, int index) { MFTRecord fileRecord = MFTRecord.Get(MFT, index, null, null); NonResident INDX = null; Console.WriteLine("Count: {0}", fileRecord.Attribute.Length); foreach (Attr attr in fileRecord.Attribute) { if (attr.Name == "INDEX_ALLOCATION") { if (attr.NonResident) { INDX = (NonResident)attr; } } } byte[] nonResBytes = NonResident.GetContent(streamToRead, INDX); List<IndexEntry> indxEntryList = new List<IndexEntry>(); for (int offset = 0; offset < nonResBytes.Length; offset += 4096) { byte[] indxBytes = nonResBytes.Skip(offset).Take(4096).ToArray(); INDEX_BLOCK indxBlock = new INDEX_BLOCK(indxBytes.Take(40).ToArray()); byte[] IndexAllocEntryBytes = indxBytes.Skip(64).ToArray(); int offsetIndx = 0; int offsetIndxPrev = 1; while ((offsetIndx < IndexAllocEntryBytes.Length) && (offsetIndx != offsetIndxPrev)) { INDEX_ENTRY indxEntryStruct = new INDEX_ENTRY(IndexAllocEntryBytes.Skip(offsetIndx).ToArray()); offsetIndxPrev = offsetIndx; offsetIndx += indxEntryStruct.Size; if (indxEntryStruct.Stream.Length > 66) { FileName.ATTR_FILE_NAME fileNameStruct = new FileName.ATTR_FILE_NAME(indxEntryStruct.Stream); #region indxFlags StringBuilder indxFlags = new StringBuilder(); if (indxEntryStruct.Flags != 0) { if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.SUBNODE) == (int)INDEX_ENTRY_FLAG.SUBNODE) { indxFlags.Append("Subnode, "); } if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.LAST) == (int)INDEX_ENTRY_FLAG.LAST) { indxFlags.Append("Last Entry, "); } indxFlags.Length -= 2; } #endregion indxFlags string Name = System.Text.Encoding.Unicode.GetString(fileNameStruct.Name); IndexEntry indxEntry = new IndexEntry(indxEntryStruct, indxFlags.ToString(), Name); indxEntryList.Add(indxEntry); } } } return indxEntryList; }
internal IndexEntry(INDEX_ENTRY indxEntry, string flag, string name) { FileIndex = (indxEntry.FileReference & 0x0000FFFFFFFFFFFF); Flags = flag; Name = name; }