internal static NTFS_FILE_RECORD_OUTPUT_BUFFER FromPtr(System.IntPtr ptr)
{
NTFS_FILE_RECORD_OUTPUT_BUFFER result = default(NTFS_FILE_RECORD_OUTPUT_BUFFER);
result = (NTFS_FILE_RECORD_OUTPUT_BUFFER)Marshal.PtrToStructure(ptr, typeof(NTFS_FILE_RECORD_OUTPUT_BUFFER));
unsafe {
byte *pFileRecord = (byte *)ptr + (int)Marshal.OffsetOf(typeof(NTFS_FILE_RECORD_OUTPUT_BUFFER), "FileRecordBuffer");
result.FileRecordBuffer = new BYTE[result.FileRecordLength];
Marshal.Copy(new System.IntPtr(pFileRecord), result.FileRecordBuffer, 0, (int)result.FileRecordLength);
}
return(result);
}
//FsctlGetHfsInformation
/// <summary><see cref="http://msdn.microsoft.com/en-us/library/aa364568(v=vs.85).aspx"/></summary>
public NTFS_FILE_RECORD_OUTPUT_BUFFER FileSystemGetNtfsFileRecord(ulong fileId)
{
NTFS_FILE_RECORD_INPUT_BUFFER input = new NTFS_FILE_RECORD_INPUT_BUFFER();
input.FileReferenceNumber = fileId;
byte[] data = DeviceIoControlHelper.InvokeIoControlUnknownSize(Handle, IOControlCode.FsctlGetNtfsFileRecord, input, 1024); // NTFS File records are in 1K chunks
NTFS_FILE_RECORD_OUTPUT_BUFFER res = new NTFS_FILE_RECORD_OUTPUT_BUFFER();
res.FileReferenceNumber = BitConverter.ToUInt64(data, 0);
res.FileRecordLength = BitConverter.ToUInt32(data, 8);
res.FileRecordBuffer = new byte[res.FileRecordLength];
Array.Copy(data, 8 + 4, res.FileRecordBuffer, 0, (int)res.FileRecordLength);
return(res);
}
