protected NtfsFileEntry(Ntfs ntfs, FileRecord record, AttributeFileName fileName) { this.ntfs = ntfs; MFTRecord = record; FileName = fileName; Init(); }
private void _read() { _code = ((Zip.ExtraCodes)m_io.ReadU2le()); _lenBody = m_io.ReadU2le(); switch (Code) { case Zip.ExtraCodes.Ntfs: { __raw_body = m_io.ReadBytes(LenBody); var io___raw_body = new KaitaiStream(__raw_body); _body = new Ntfs(io___raw_body, this, m_root); break; } case Zip.ExtraCodes.ExtendedTimestamp: { __raw_body = m_io.ReadBytes(LenBody); var io___raw_body = new KaitaiStream(__raw_body); _body = new ExtendedTimestamp(io___raw_body, this, m_root); break; } case Zip.ExtraCodes.InfozipUnixVarSize: { __raw_body = m_io.ReadBytes(LenBody); var io___raw_body = new KaitaiStream(__raw_body); _body = new InfozipUnixVarSize(io___raw_body, this, m_root); break; } default: { _body = m_io.ReadBytes(LenBody); break; } } }
internal override void ParseAttributeNonResidentBody(Ntfs ntfsInfo) { byte[] data = NtfsUtils.ReadFragments(ntfsInfo, NonResidentHeader.Fragments); List <IndexAllocationChunk> indexes = new List <IndexAllocationChunk>(); List <IndexEntry> entries = new List <IndexEntry>(); // Parse for (int i = 0; i < NonResidentHeader.Fragments.Count; i++) { for (int j = 0; j < NonResidentHeader.Fragments[i].Clusters; j++) { int offset = (int)((NonResidentHeader.Fragments[i].StartingVCN - NonResidentHeader.Fragments[0].StartingVCN) * ntfsInfo.BytesPerCluster + j * ntfsInfo.BytesPerCluster); if (!IndexAllocationChunk.IsIndexAllocationChunk(data, offset)) { continue; } IndexAllocationChunk index = IndexAllocationChunk.ParseBody(ntfsInfo, data, offset); indexes.Add(index); foreach (var f in index.Entries) { entries.Add(f); } } } Indexes = indexes; Entries = entries; }
internal void Dump() { Ntfs.Dump(); Console.WriteLine( "Seq {0}, #lnk {1}, aOff {2}, flg {3}, usd {4}, all {5}, bfr 0x{6:X8}, nxA {7}", SequenceNumber, LinkCount, AttributesOffset, Flags, BytesInUse, BytesAllocated, BaseFileRecord, NextAttributeNumber); }
public static IndexAllocationChunk ParseBody(Ntfs ntfsInfo, byte[] data, int offset) { // Debug.Assert(data.Length >= 36); IndexAllocationChunk res = new IndexAllocationChunk(); // Parse res.Signature = Encoding.ASCII.GetString(data, offset + 0, 4); // Debug.Assert(res.Signature == "INDX"); res.OffsetToUSN = BitConverter.ToUInt16(data, offset + 4); res.USNSizeWords = BitConverter.ToUInt16(data, offset + 6); res.LogFileUSN = BitConverter.ToUInt64(data, offset + 8); res.VCNInIndexAllocation = BitConverter.ToUInt64(data, offset + 16); res.OffsetToFirstIndex = BitConverter.ToUInt32(data, offset + 24); res.SizeOfIndexTotal = BitConverter.ToUInt32(data, offset + 28); res.SizeOfIndexAllocated = BitConverter.ToUInt32(data, offset + 32); res.HasChildren = data[36]; // Debug.Assert(data.Length >= offset + res.OffsetToUSN + 2 + res.USNSizeWords * 2); res.USNNumber = new byte[2]; Array.Copy(data, offset + res.OffsetToUSN, res.USNNumber, 0, 2); res.USNData = new byte[res.USNSizeWords * 2 - 2]; Array.Copy(data, offset + res.OffsetToUSN + 2, res.USNData, 0, res.USNData.Length); // Patch USN Data NtfsUtils.ApplyUSNPatch(data, offset, (res.SizeOfIndexAllocated + 24) / ntfsInfo.BytesPerSector, (ushort)ntfsInfo.BytesPerSector, res.USNNumber, res.USNData); // Debug.Assert(offset + res.SizeOfIndexTotal <= data.Length); // Parse entries List <IndexEntry> entries = new List <IndexEntry>(); int pointer = offset + (int)(res.OffsetToFirstIndex + 24); // Offset is relative to 0x18 while (pointer <= offset + res.SizeOfIndexTotal + 24) { IndexEntry entry = IndexEntry.ParseData(data, offset + (int)res.SizeOfIndexTotal - pointer + 24, pointer); if ((entry.Flags & MFTIndexEntryFlags.LastEntry) != 0) { break; } entries.Add(entry); pointer += entry.Size; } res.Entries = entries; return(res); }
internal static NtfsFileEntry CreateEntry(Ntfs ntfs, uint fileId, AttributeFileName fileName = null) { var record = ntfs.ReadMftRecord(fileId); if (fileName == null) { fileName = NtfsUtils.GetPreferredDisplayName(record); } if ((record.Flags & FileEntryFlags.Directory) != 0) { return(new NtfsDirectory(ntfs, record, fileName)); } return(new NtfsFile(ntfs, record, fileName)); }
public static byte[] ReadFragments(Ntfs ntfsInfo, List <DataFragment> fragments) { long totalLength = 0; foreach (var frag in fragments) { totalLength += frag.Clusters * ntfsInfo.BytesPerCluster; } var data = new byte[totalLength]; Stream diskStream = ntfsInfo.DiskStream; using (NtfsDiskStream stream = new NtfsDiskStream(diskStream, false, fragments, ntfsInfo.BytesPerCluster, 0, totalLength)) { stream.Read(data, 0, data.Length); } // Return the data return(data); }
internal override void ParseAttributeNonResidentBody(Ntfs ntfsInfo) { base.ParseAttributeNonResidentBody(ntfsInfo); // Get all chunks byte[] data = NtfsUtils.ReadFragments(ntfsInfo, NonResidentHeader.Fragments); // Parse List <AttributeListItem> results = new List <AttributeListItem>(); int pointer = 0; int contentSize = (int)NonResidentHeader.ContentSize; while (pointer + 26 <= contentSize) // 26 is the smallest possible MFTAttributeListItem { AttributeListItem item = AttributeListItem.ParseListItem(data, data.Length - pointer, pointer); if (item.Type == AttributeType.EndOfAttributes) { break; } if (item.Length == 0) { break; } results.Add(item); pointer += item.Length; } // Debug.Assert(pointer == contentSize); Items = results; }
internal NtfsDirectory(Ntfs ntfs, FileRecord record, AttributeFileName fileName) : base(ntfs, record, fileName) { }
internal virtual void ParseAttributeNonResidentBody(Ntfs ntfsInfo) { // Debug.Assert(NonResidentFlag == ResidentFlag.NonResident); // Debug.Assert((AllowedResidentStates & AttributeResidentAllow.NonResident) != 0); // Debug.Assert(ntfsInfo != null); }
internal unsafe void ApplyFixups() { Ntfs.ApplyFixups(); }
private void Initialize() { Console.WriteLine("[NTFSDRV2] Initializing NTFS file system on drive " + rootPath); ntfs = Ntfs.Create(new BlockDeviceStream(device, size)); }