public RecordHeader(BinaryReader reader) { Type = reader.ReadId4(); Size = reader.ReadUInt32(); Flags = (RecordFlags)reader.ReadUInt32(); Id = new FormId(reader.ReadUInt32()); Revision = reader.ReadUInt32(); Version = reader.ReadUInt16(); Unknown = reader.ReadUInt16(); StartOffset = reader.BaseStream.Position; }
public Record(Byte[] bytes, int offset = 0) { type = Encoding.UTF8.GetString(bytes, offset + 0, 4); dataSize = BitConverter.ToUInt32(bytes, offset + 4); flags = (RecordFlags)BitConverter.ToUInt32(bytes, offset + 8); id = new LocalFormID(bytes, offset + 12); versionControlInfo = VersionControlInfo.Parse(bytes, offset + 16); version = BitConverter.ToUInt16(bytes, offset + 20); unknown = BitConverter.ToUInt16(bytes, offset + 22); if ((flags & RecordFlags.Compressed) == RecordFlags.Compressed) { data = new List <Field>(); } else { data = Field.ParseAll(bytes, (uint)(offset + FixedSize), dataSize); } }
private MFTRecord(ulong recordNum, FileSystemNTFS fileSystem, byte[] data, MFTLoadDepth loadDepth, string path) { this.RecordNum = recordNum; this.FileSystem = fileSystem; this.BytesPerSector = fileSystem.BytesPerSector; this.SectorsPerCluster = fileSystem.SectorsPerCluster; this.PartitionStream = fileSystem.Store; Valid = true; _data = data; _path = path; Flags = (RecordFlags)BitConverter.ToUInt16(_data, 22); if (loadDepth != MFTLoadDepth.None) { LoadData(loadDepth); } }