private LfsRestartPage ReadRestartPage()
{
byte[] firstPageBytes = ReadData(0, Volume.BytesPerSector);
uint systemPageSize = LfsRestartPage.GetSystemPageSize(firstPageBytes, 0);
int bytesToRead = (int)systemPageSize - firstPageBytes.Length;
if (bytesToRead > 0)
{
byte[] temp = ReadData((ulong)firstPageBytes.Length, bytesToRead);
firstPageBytes = ByteUtils.Concatenate(firstPageBytes, temp);
}
MultiSectorHelper.RevertUsaProtection(firstPageBytes, 0);
LfsRestartPage firstRestartPage = new LfsRestartPage(firstPageBytes, 0);
byte[] secondPageBytes = ReadData(systemPageSize, (int)systemPageSize);
MultiSectorHelper.RevertUsaProtection(secondPageBytes, 0);
LfsRestartPage secondRestartPage = new LfsRestartPage(secondPageBytes, 0);
if (secondRestartPage.RestartArea.CurrentLsn > firstRestartPage.RestartArea.CurrentLsn)
{
m_restartPage = secondRestartPage;
m_isFirstRestartPageTurn = true;
}
else
{
m_restartPage = firstRestartPage;
}
return(m_restartPage);
}
private IndexRecord ReadIndexRecord(long subnodeVBN)
{
long sectorIndex = ConvertToSectorIndex(subnodeVBN);
byte[] recordBytes = m_indexAllocationData.ReadSectors(sectorIndex, this.SectorsPerIndexRecord);
MultiSectorHelper.RevertUsaProtection(recordBytes, 0);
IndexRecord record = new IndexRecord(recordBytes, 0);
return(record);
}
/// <summary>
/// This method is used to read the record segment(s) of the MFT itself.
/// Only after strapping the MFT we can use GetFileRecordSegment which relies on the MFT file record.
/// </summary>
private FileRecordSegment ReadMftRecordSegment(long mftStartLCN, long segmentNumber)
{
long sectorIndex = mftStartLCN * m_volume.SectorsPerCluster + segmentNumber * m_volume.SectorsPerFileRecordSegment;
byte[] segmentBytes = m_volume.ReadSectors(sectorIndex, m_volume.SectorsPerFileRecordSegment, ContentType.MftData);
MultiSectorHelper.RevertUsaProtection(segmentBytes, 0);
FileRecordSegment result = new FileRecordSegment(segmentBytes, 0, segmentNumber);
return(result);
}
private LfsRestartPage ReadRestartPage()
{
byte[] pageBytes = ReadData(0, Volume.BytesPerSector);
uint systemPageSize = LfsRestartPage.GetSystemPageSize(pageBytes, 0);
int bytesToRead = (int)systemPageSize - pageBytes.Length;
if (bytesToRead > 0)
{
byte[] temp = ReadData((ulong)pageBytes.Length, bytesToRead);
pageBytes = ByteUtils.Concatenate(pageBytes, temp);
}
MultiSectorHelper.RevertUsaProtection(pageBytes, 0);
m_restartPage = new LfsRestartPage(pageBytes, 0);
return(m_restartPage);
}
private LfsRecordPage ReadPageFromFile(ulong pageOffset)
{
if (m_restartPage == null)
{
m_restartPage = ReadRestartPage();
}
byte[] pageBytes = ReadData(pageOffset, (int)m_restartPage.LogPageSize);
uint pageSignature = LittleEndianConverter.ToUInt32(pageBytes, 0);
if (pageSignature == LfsRecordPage.UninitializedPageSignature)
{
return(null);
}
MultiSectorHelper.RevertUsaProtection(pageBytes, 0);
return(new LfsRecordPage(pageBytes, m_restartPage.LogRestartArea.LogPageDataOffset));
}
private FileRecordSegment GetFileRecordSegment(long segmentNumber)
{
NTFSBootRecord bootRecord = m_volume.BootRecord;
// Note: File record always start at the beginning of a sector
// Note: Record can span multiple clusters, or alternatively, several records can be stored in the same cluster
long firstSectorIndex = segmentNumber * m_volume.SectorsPerFileRecordSegment;
byte[] segmentBytes = m_mftFile.Data.ReadSectors(firstSectorIndex, m_volume.SectorsPerFileRecordSegment);
if (FileRecordSegment.ContainsFileRecordSegment(segmentBytes))
{
MultiSectorHelper.RevertUsaProtection(segmentBytes, 0);
FileRecordSegment recordSegment = new FileRecordSegment(segmentBytes, 0, segmentNumber);
return(recordSegment);
}
else
{
return(null);
}
}
private FileRecordSegment GetFileRecordSegment(long segmentNumber)
{
byte[] segmentBytes = GetFileRecordSegmentBytes(segmentNumber);
MultiSectorHelper.RevertUsaProtection(segmentBytes, 0);
return(new FileRecordSegment(segmentBytes, 0, segmentNumber));
}