Exemple #1
0
        private void ParseBootSector()
        {
            var data = new byte[512];

            DiskStream.Seek(0, SeekOrigin.Begin);
            DiskStream.Read(data, 0, data.Length);

            BootSector         = BootSector.ParseData(data, data.Length, 0);
            BytesPerFileRecord = BootSector.MftRecordSizeBytes;
            SectorsPerRecord   = BootSector.MftRecordSizeBytes / BootSector.BytesPerSector;
        }
Exemple #2
0
        public static BootSector ParseData(byte[] data, int maxLength, int offset)
        {
            //// Debug.Assert(data.Length - offset >= 512);
            //// Debug.Assert(0 <= offset && offset <= data.Length);

            BootSector res = new BootSector();

            res.JmpInstruction = new byte[3];
            Array.Copy(data, offset, res.JmpInstruction, 0, 3);

            res.OemCode            = Encoding.ASCII.GetString(data, offset + 3, 8).Trim();
            res.BytesPerSector     = BitConverter.ToUInt16(data, offset + 11);
            res.SectorsPerCluster  = data[offset + 13];
            res.ReservedSectors    = BitConverter.ToUInt16(data, offset + 14);
            res.MediaDescriptor    = data[offset + 21];
            res.SectorsPerTrack    = BitConverter.ToUInt16(data, offset + 24);
            res.NumberOfHeads      = BitConverter.ToUInt16(data, offset + 26);
            res.HiddenSectors      = BitConverter.ToUInt32(data, offset + 28);
            res.Usually80008000    = BitConverter.ToUInt32(data, offset + 36);
            res.TotalSectors       = BitConverter.ToUInt64(data, offset + 40);
            res.MftCluster         = BitConverter.ToUInt64(data, offset + 48);
            res.MftMirrCluster     = BitConverter.ToUInt64(data, offset + 56);
            res.MftRecordSizeBytes = BitConverter.ToUInt32(data, offset + 64);
            res.MftIndexSizeBytes  = BitConverter.ToUInt32(data, offset + 68);
            res.SerialNumber       = BitConverter.ToUInt64(data, offset + 72);
            res.Checksum           = BitConverter.ToUInt32(data, offset + 80);

            res.MftRecordSizeBytes = InterpretClusterCount(res.MftRecordSizeBytes);
            res.MftIndexSizeBytes  = InterpretClusterCount(res.MftRecordSizeBytes);

            res.BootstrapCode = new byte[426];
            Array.Copy(data, offset + 84, res.BootstrapCode, 0, 426);

            res.Signature = new byte[2];
            Array.Copy(data, offset + 510, res.Signature, 0, 2);

            // Signature should always be this
            //// Debug.Assert(res.Signature[0] == 0x55);
            //// Debug.Assert(res.Signature[1] == 0xAA);

            return(res);
        }