public static void GetBytes(byte[] buffer, int offset, DateTime value, DatetimeBinaryFormat format = DatetimeBinaryFormat.WinFileTime)
        {
            Debug.Assert(buffer.Length - offset >= 8);      // WinFileTime requires 8 bytes
            Debug.Assert(offset >= 0);

            switch (format)
            {
            case DatetimeBinaryFormat.WinFileTime:
                NtfsHelper.ToWinFileTime(buffer, offset, value);
                break;

            default:
                throw new ArgumentOutOfRangeException("format");
            }
        }
Exemple #2
0
        public static FileRecordSegmentHeader ReadFileRecord(byte[] data, int offset, ushort bytesPerSector, uint sectors)
        {
            uint length = bytesPerSector * sectors;

            if (data.Length - offset < length || length < 50 || !(bytesPerSector % 512 == 0 && bytesPerSector > 0) || sectors < 0)
            {
                throw new Exception("Error in parsing the 'FILE_RECORD_SEGMENT_HEADER'!\n");
            }

            FileRecordSegmentHeader record = new FileRecordSegmentHeader();

            //                                                                                                          offset      size
            record.MSH                      = new MultiSectorHeader(data, offset);                                      //  0      4+2+2=8
            record.LSN                      = BitConverter.ToUInt64(data, offset + 8);                                  //  8         8
            record.SequenceNumber           = BitConverter.ToUInt16(data, offset + 16);                                 // 16         2
            record.ReferenceLinkCount       = BitConverter.ToInt16(data, offset + 18);                                  // 18         2
            record.FirstAttributeOffset     = BitConverter.ToUInt16(data, offset + 20);                                 // 20         2
            record.Flags                    = (MFTEntryFlags)BitConverter.ToUInt16(data, offset + 22);                  // 22         2
            record.UsedEntrySize            = BitConverter.ToUInt32(data, offset + 24);                                 // 24         4
            record.TotalEntrySize           = BitConverter.ToUInt32(data, offset + 32);                                 // 28         4
            record.BaseFileRecordSegment    = new MFTSegmentReference(BitConverter.ToUInt64(data, offset + 32));        // 32         8
            record.FirstNextFreeAttributeId = BitConverter.ToUInt16(data, offset + 40);                                 // 40         2
            // Used to align to 4-byte boundary (only since NTFS version 3.1) [offset : 0x2A]                           // 42         2
            record.MFTNumber = BitConverter.ToUInt16(data, offset + 44);                                                // 44         4

            record.UpdateSequenceArray = new byte[2];
            Array.Copy(data, offset + record.MSH.UpdateSequenceArrayOffset, record.UpdateSequenceArray, 0, 2);

            record.SequenceArray = new byte[record.MSH.SequenceArraySize * 2 - 2];
            Array.Copy(data, offset + record.MSH.UpdateSequenceArrayOffset + 2, record.SequenceArray, 0, record.SequenceArray.Length);

            record.MftSegmentReference = new MFTSegmentReference(record.MFTNumber, record.SequenceNumber);

            NtfsHelper.ApplyUpdateSequenceNumberPatch(data, offset, sectors, bytesPerSector, record.UpdateSequenceArray, record.SequenceArray);

            record.attributes = new List <AttributeRecord>();
            //record.externalAttributes = new List<AttributeRecord>();

            record.ReadAttributes(data, record.UsedEntrySize - record.FirstAttributeOffset, offset + record.FirstAttributeOffset);

            return(record);
        }