static string GetPath(MasterFileTable mft, MasterFileTableEntry entry)
{
if (entry.SequenceNumber == MasterFileTable.RootDirectoryIndex)
{
return "<root>";
}
FileNameAttribute fna = null;
foreach (var attr in entry.Attributes)
{
FileNameAttribute thisFna = attr as FileNameAttribute;
if (thisFna != null)
{
if (fna == null || thisFna.FileNameNamespace == NtfsNamespace.Win32 || thisFna.FileNameNamespace == NtfsNamespace.Win32AndDos)
{
fna = thisFna;
}
}
}
if (fna == null)
{
return "<unknown>";
}
string parentPath = "<unknown>";
MasterFileTableEntry parentEntry = mft[fna.ParentDirectory.RecordIndex];
if (parentEntry != null)
{
if (parentEntry.SequenceNumber == fna.ParentDirectory.RecordSequenceNumber || parentEntry.SequenceNumber == fna.ParentDirectory.RecordSequenceNumber + 1)
{
parentPath = GetPath(mft, parentEntry);
}
}
return parentPath + "\\" + fna.FileName;
}
static long GetSize(MasterFileTableEntry entry)
{
foreach (var attr in entry.Attributes)
{
FileNameAttribute fna = attr as FileNameAttribute;
if (fna != null)
{
return fna.RealSize;
}
}
return 0;
}
static IBuffer GetContent(MasterFileTableEntry entry)
{
foreach (var attr in entry.Attributes)
{
if (attr.AttributeType == AttributeType.Data)
{
return attr.Content;
}
}
return null;
}
