public void GetFileLength() { NtfsFileSystem ntfs = FileSystemSource.NtfsFileSystem(); ntfs.OpenFile(@"AFILE.TXT", FileMode.Create).Dispose(); Assert.Equal(0, ntfs.GetFileLength("AFILE.TXT")); using (var stream = ntfs.OpenFile(@"AFILE.TXT", FileMode.Open)) { stream.Write(new byte[14325], 0, 14325); } Assert.Equal(14325, ntfs.GetFileLength("AFILE.TXT")); using (var attrStream = ntfs.OpenFile(@"AFILE.TXT:altstream", FileMode.Create)) { attrStream.Write(new byte[122], 0, 122); } Assert.Equal(122, ntfs.GetFileLength("AFILE.TXT:altstream")); // Test NTFS options for hardlink behaviour ntfs.CreateDirectory("Dir"); ntfs.CreateHardLink("AFILE.TXT", @"Dir\OtherLink.txt"); using (var stream = ntfs.OpenFile("AFILE.TXT", FileMode.Open, FileAccess.ReadWrite)) { stream.SetLength(50); } Assert.Equal(50, ntfs.GetFileLength("AFILE.TXT")); Assert.Equal(14325, ntfs.GetFileLength(@"Dir\OtherLink.txt")); ntfs.NtfsOptions.FileLengthFromDirectoryEntries = false; Assert.Equal(50, ntfs.GetFileLength(@"Dir\OtherLink.txt")); }
public static void GetDirListing(string VMDKpath, string directory) { if (File.Exists(VMDKpath)) { try { using (VirtualDisk vhdx = VirtualDisk.OpenDisk(VMDKpath, FileAccess.Read)) { if (vhdx.Partitions.Count > 1) { Console.WriteLine("Target has more than one partition"); for (var i = 0; i <= vhdx.Partitions.Count; i++) { NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[i].Open()); if (vhdbNtfs.DirectoryExists("\\\\" + directory)) { string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory); string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory); foreach (var file in filelist) { Console.WriteLine("[F] {0}", file); } foreach (var dir in dirlist) { Console.WriteLine("[D] {0}", dir); } } else { Console.WriteLine("\r\n[*] Directory does not exist"); } } } else { NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open()); if (vhdbNtfs.DirectoryExists("\\\\" + directory)) { string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory); string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory); foreach (var file in filelist) { Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file)); } foreach (var dir in dirlist) { Console.WriteLine("[D] {0}", dir); } } else { Console.WriteLine("\r\n[*] Directory does not exist"); } } } } catch (Exception ex) { Console.WriteLine("\r\n [!] Virtual Disk provided is not supported"); Console.WriteLine("\r\n [!] An exception occured: {0}", ex); Environment.Exit(1); } } else { Console.WriteLine("\r\n [!] The provided VMDK image does not exist or can not be accessed"); } }
public static void GetFile(string VMDKpath, string filepath, string destinationfile) { if (File.Exists(VMDKpath) && Directory.Exists(Path.GetDirectoryName(destinationfile))) { try { if (Path.GetFileName(destinationfile) == "") { destinationfile += Path.GetFileName(filepath); } using (VirtualDisk vhdx = VirtualDisk.OpenDisk(VMDKpath, FileAccess.Read)) { if (vhdx.Partitions.Count > 1) { Console.WriteLine("Target has more than one partition"); for (var i = 0; i <= vhdx.Partitions.Count; i++) { try { NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[i].Open()); if (vhdbNtfs.FileExists("\\\\" + filepath)) { long fileLength = vhdbNtfs.GetFileLength("\\\\" + filepath); using (Stream bootStream = vhdbNtfs.OpenFile("\\\\" + filepath, FileMode.Open, FileAccess.Read)) { byte[] file = new byte[bootStream.Length]; int totalRead = 0; while (totalRead < file.Length) { totalRead += bootStream.Read(file, totalRead, file.Length - totalRead); FileStream fileStream = File.Create(destinationfile, (int)bootStream.Length); bootStream.CopyTo(fileStream); fileStream.Write(file, 0, (int)bootStream.Length); } } long destinationLength = new FileInfo(destinationfile).Length; if (fileLength != destinationLength) { Console.WriteLine("[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength); } else { Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", filepath, destinationfile); } } else { Console.WriteLine("\r\n [!] File {0} can not be found", filepath); } } catch (Exception ex) { Console.WriteLine("\r\n [!] An exception occured: {0}", ex); Environment.Exit(1); throw; } } } else { try { NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open()); if (vhdbNtfs.FileExists("\\\\" + filepath)) { //vhdbNtfs.CopyFile(); long fileLength = vhdbNtfs.GetFileLength("\\\\" + filepath); using (Stream bootStream = vhdbNtfs.OpenFile("\\\\" + filepath, FileMode.Open, FileAccess.Read)) { byte[] file = new byte[bootStream.Length]; int totalRead = 0; while (totalRead < file.Length) { totalRead += bootStream.Read(file, totalRead, file.Length - totalRead); FileStream fileStream = File.Create(destinationfile, (int)bootStream.Length); bootStream.CopyTo(fileStream); fileStream.Write(file, 0, (int)bootStream.Length); } } long destinationLength = new FileInfo(destinationfile).Length; if (fileLength != destinationLength) { Console.WriteLine("[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength); } else { Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", filepath, destinationfile); } } else { Console.WriteLine("\r\n [!] File {0} can not be found", filepath); } } catch (Exception ex) { Console.WriteLine("\r\n [!] An exception occured: {0}", ex); Environment.Exit(1); throw; } } } } catch (Exception ex) { Console.WriteLine("\r\n [!] An exception occured: {0}", ex); Environment.Exit(1); throw; } } else { Console.WriteLine("\r\n [!] The provided VMDK image does not exist / can not be accessed or the destination folder does not exist"); } }
public static void GetDirListing(string DiskPath, string directory) { if (File.Exists(DiskPath)) { try { VolumeManager volMgr = new VolumeManager(); VirtualDisk vhdx = VirtualDisk.OpenDisk(DiskPath, FileAccess.Read); volMgr.AddDisk(vhdx); VolumeInfo volInfo = null; if (vhdx.Partitions.Count > 1) { Console.WriteLine("\r\n[*] Target has more than one partition\r\n"); foreach (var physVol in volMgr.GetPhysicalVolumes()) { Console.WriteLine(" Identity: " + physVol.Identity); Console.WriteLine(" Type: " + physVol.VolumeType); Console.WriteLine(" Disk Id: " + physVol.DiskIdentity); Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8")); Console.WriteLine(" Part Id: " + physVol.PartitionIdentity); Console.WriteLine(" Length: " + physVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector); Console.WriteLine(); if (!string.IsNullOrEmpty(physVol.Identity)) { volInfo = volMgr.GetVolume(physVol.Identity); } using (NtfsFileSystem vhdbNtfs = new NtfsFileSystem(physVol.Partition.Open())) { if (vhdbNtfs.DirectoryExists("\\\\" + directory)) { string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory); string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory); foreach (var file in filelist) { Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file)); } foreach (var dir in dirlist) { Console.WriteLine("[D] {0}", dir); } } else { Console.WriteLine("\r\n[*] Directory does not exist in partition {0}\r\n", physVol.Identity); } } } } else //No partitions { Console.WriteLine("\r\n[*] Found only one partition\r\n"); Console.WriteLine("LOGICAL VOLUMES"); foreach (var logVol in volMgr.GetLogicalVolumes()) { Console.WriteLine(" Identity: " + logVol.Identity); Console.WriteLine(" Length: " + logVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + logVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + logVol.PhysicalStartSector); Console.WriteLine(); } using (NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open())) { if (vhdbNtfs.DirectoryExists("\\\\" + directory)) { string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory); string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory); foreach (var file in filelist) { Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file)); } foreach (var dir in dirlist) { Console.WriteLine("[D] {0}", dir); } } else { Console.WriteLine("\r\n[*] Directory does not exist"); } } } } catch (Exception ex) { Console.WriteLine("Exception {0}", ex); } } }
public static void GetFile(string DiskPath, string FilePath, string DestinationFile) { if (File.Exists(DiskPath) && Directory.Exists(Path.GetDirectoryName(DestinationFile))) { if (Path.GetFileName(DestinationFile) == "") { DestinationFile += Path.GetFileName(FilePath); } VolumeManager volMgr = new VolumeManager(); VirtualDisk disk = VirtualDisk.OpenDisk(DiskPath, FileAccess.Read); volMgr.AddDisk(disk); VolumeInfo volInfo = null; if (disk.Partitions.Count > 1) { Console.WriteLine("\r\n[*] Target has more than one partition\r\n"); foreach (var physVol in volMgr.GetPhysicalVolumes()) { Console.WriteLine(" Identity: " + physVol.Identity); Console.WriteLine(" Type: " + physVol.VolumeType); Console.WriteLine(" Disk Id: " + physVol.DiskIdentity); Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8")); Console.WriteLine(" Part Id: " + physVol.PartitionIdentity); Console.WriteLine(" Length: " + physVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector); Console.WriteLine(); if (!string.IsNullOrEmpty(physVol.Identity)) { volInfo = volMgr.GetVolume(physVol.Identity); } DiscUtils.FileSystemInfo fsInfo = FileSystemManager.DetectFileSystems(volInfo)[0]; using (NtfsFileSystem diskntfs = new NtfsFileSystem(physVol.Partition.Open())) { if (diskntfs.FileExists("\\\\" + FilePath)) { long fileLength = diskntfs.GetFileLength("\\\\" + FilePath); using (Stream bootStream = diskntfs.OpenFile("\\\\" + FilePath, FileMode.Open, FileAccess.Read)) { byte[] file = new byte[bootStream.Length]; int totalRead = 0; while (totalRead < file.Length) { totalRead += bootStream.Read(file, totalRead, file.Length - totalRead); FileStream fileStream = File.Create(DestinationFile, (int)bootStream.Length); bootStream.CopyTo(fileStream); fileStream.Write(file, 0, (int)bootStream.Length); } long destinationLength = new FileInfo(DestinationFile).Length; if (fileLength != destinationLength) { Console.WriteLine( "[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength); } else { Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", FilePath, DestinationFile); } } } else { Console.WriteLine("\r\n [!] File {0} can not be found", FilePath); } } } } else { foreach (var physVol in volMgr.GetPhysicalVolumes()) { Console.WriteLine(" Identity: " + physVol.Identity); Console.WriteLine(" Type: " + physVol.VolumeType); Console.WriteLine(" Disk Id: " + physVol.DiskIdentity); Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8")); Console.WriteLine(" Part Id: " + physVol.PartitionIdentity); Console.WriteLine(" Length: " + physVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector); Console.WriteLine(); NtfsFileSystem diskntfs = new NtfsFileSystem(disk.Partitions[0].Open()); if (diskntfs.FileExists("\\\\" + FilePath)) { long fileLength = diskntfs.GetFileLength("\\\\" + FilePath); using (Stream bootStream = diskntfs.OpenFile("\\\\" + FilePath, FileMode.Open, FileAccess.Read)) { byte[] file = new byte[bootStream.Length]; int totalRead = 0; while (totalRead < file.Length) { totalRead += bootStream.Read(file, totalRead, file.Length - totalRead); FileStream fileStream = File.Create(DestinationFile, (int)bootStream.Length); bootStream.CopyTo(fileStream); fileStream.Write(file, 0, (int)bootStream.Length); } } long destinationLength = new FileInfo(DestinationFile).Length; if (fileLength != destinationLength) { Console.WriteLine( "[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength); } else { Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", FilePath, DestinationFile); } } else { Console.WriteLine("\r\n [!] File {0} can not be found", FilePath); } } } } else { Console.WriteLine( "\r\n [!] The provided VMDK image does not exist / can not be accessed or the destination folder does not exist"); } }