public List <AttributeListEntry> ReadEntries()
{
byte[] data = ReadClusters(0, (int)ClusterCount);
List <AttributeListEntry> entries = new List <AttributeListEntry>();
int position = 0;
while (position < data.Length)
{
AttributeListEntry entry = new AttributeListEntry(data, position);
entries.Add(entry);
position += entry.LengthOnDisk;
}
return(entries);
}
public AttributeListRecord(NTFSVolume volume, AttributeRecord record)
{
m_volume = volume;
m_record = record;
byte[] data = m_record.GetData(volume);
int position = 0;
while (position < data.Length)
{
AttributeListEntry entry = new AttributeListEntry(data, position);
AttributeList.Add(entry);
position += entry.Length;
if (entry.Length < AttributeListEntry.HeaderLength)
{
string message = String.Format("Invalid attribute list entry, data length: {0}, position: {1}", data.Length, position);
throw new Exception(message);
}
}
}
/// <remarks>
/// An attribute list MUST be sorted by AttributeType with a secondary sort by AttributeName.
/// </remarks>
public static List <AttributeListEntry> BuildAttributeList(List <FileRecordSegment> segments, int bytesPerFileRecordSegment, ushort minorNTFSVersion)
{
int bytesAvailableInSegment = FileRecordSegment.GetNumberOfBytesAvailable(bytesPerFileRecordSegment, minorNTFSVersion);
List <AttributeListEntry> result = new List <AttributeListEntry>();
foreach (FileRecordSegment segment in segments)
{
foreach (AttributeRecord attribute in segment.ImmediateAttributes)
{
AttributeListEntry entry = new AttributeListEntry();
entry.AttributeType = attribute.AttributeType;
if (attribute is NonResidentAttributeRecord)
{
entry.LowestVCN = ((NonResidentAttributeRecord)attribute).LowestVCN;
}
entry.SegmentReference = segment.SegmentReference;
entry.Instance = attribute.Instance;
entry.AttributeName = attribute.Name;
result.Add(entry);
}
}
return(result);
}
