Exemple #1
0
        private static UsnJrnl[] GetInstances(string volume, int recordnumber)
        {
            // Get VolumeBootRecord object for logical addressing
            VolumeBootRecord VBR = VolumeBootRecord.Get(volume);

            // Get FileRecord for C:\$Extend\$UsnJrnl
            FileRecord record = FileRecord.Get(volume, recordnumber, true);

            // Get the $J Data attribute (contains UsnJrnl records)
            NonResident J = UsnJrnl.GetJStream(record);

            // Instatiate a List of UsnJrnl entries
            List <UsnJrnl> usnList = new List <UsnJrnl>();

            for (int i = 0; i < J.DataRun.Length; i++)
            {
                if (!(J.DataRun[i].Sparse))
                {
                    long clusterCount = J.DataRun[i].ClusterLength;

                    byte[] fragmentBytes = Helper.readDrive(volume, (J.DataRun[i].StartCluster * VBR.BytesPerCluster), (clusterCount * VBR.BytesPerCluster));

                    byte[] clusterBytes = new byte[VBR.BytesPerCluster];

                    for (int j = 0; j < clusterCount; j++)
                    {
                        Array.Copy(fragmentBytes, (int)(j * VBR.BytesPerCluster), clusterBytes, 0, clusterBytes.Length);

                        int offset = 0;

                        do
                        {
                            if (clusterBytes[offset] == 0)
                            {
                                break;
                            }

                            try
                            {
                                UsnJrnl usn = new UsnJrnl(clusterBytes, volume, ref offset);
                                if (usn.Version > USN40Version)
                                {
                                    break;
                                }
                                usnList.Add(usn);
                            }
                            catch
                            {
                                break;
                            }
                        } while (offset >= 0 && offset < clusterBytes.Length);
                    }
                }
            }

            // Return usnList as a UsnJrnl[]
            return(usnList.ToArray());
        }
 public UsnJrnl GetUsnJrnl()
 {
     foreach (Attr attr in this.Attribute)
     {
         if (attr.Name == Attr.ATTR_TYPE.STANDARD_INFORMATION)
         {
             StandardInformation stdInfo = attr as StandardInformation;
             return(UsnJrnl.Get(this.VolumePath, stdInfo.UpdateSequenceNumber));
         }
     }
     throw new Exception("No $STANDARD_INFORMATION Attirbute found");
 }
Exemple #3
0
 /// <summary>
 ///
 /// </summary>
 /// <returns></returns>
 public UsnJrnl GetUsnJrnl()
 {
     foreach (FileRecordAttribute attr in this.Attribute)
     {
         StandardInformation SI = attr as StandardInformation;
         if (SI != null)
         {
             return(UsnJrnl.Get(this.VolumePath, SI.UpdateSequenceNumber));
         }
     }
     throw new Exception("No $STANDARD_INFORMATION Attirbute found");
 }
 public UsnJrnl GetUsnJrnl()
 {
     foreach (Attr attr in this.Attribute)
     {
         StandardInformation SI = attr as StandardInformation;
         if (SI != null)
         {
             return(UsnJrnl.Get(this.VolumePath.Split('\\') + @"\$Extend\$UsnJrnl", SI.UpdateSequenceNumber));
         }
     }
     throw new Exception("No $STANDARD_INFORMATION Attirbute found");
 }
Exemple #5
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="path"></param>
        /// <returns></returns>
        public static UsnJrnl[] GetTestInstances(string path)
        {
            byte[] bytes = FileRecord.GetContentBytes(path, "$J");

            string volume = Helper.GetVolumeFromPath(path);

            VolumeBootRecord VBR = VolumeBootRecord.Get(volume);

            List <UsnJrnl> usnList = new List <UsnJrnl>();

            for (int i = 0; i < bytes.Length; i += VBR.BytesPerCluster)
            {
                int clusteroffset = i;

                do
                {
                    // Break if there are no more UsnJrnl entries in cluster
                    if (bytes[clusteroffset] == 0)
                    {
                        break;
                    }

                    try
                    {
                        UsnJrnl usn = new UsnJrnl(bytes, volume, ref clusteroffset);
                        if (usn.Version > USN40Version)
                        {
                            break;
                        }
                        usnList.Add(usn);
                    }
                    catch
                    {
                        break;
                    }
                } while (clusteroffset >= 0 && clusteroffset < bytes.Length);
            }
            return(usnList.ToArray());
        }
Exemple #6
0
        private static UsnJrnl[] GetInstances(string volume, int recordnumber)
        {
            // Check for valid Volume name
            NativeMethods.getVolumeName(ref volume);

            // Set up FileStream to read volume
            IntPtr     hVolume      = NativeMethods.getHandle(volume);
            FileStream streamToRead = NativeMethods.getFileStream(hVolume);

            // Get VolumeBootRecord object for logical addressing
            VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead);

            FileRecord record = FileRecord.Get(volume, recordnumber, true);

            // Get the $J Data attribute (contains UsnJrnl details
            NonResident J = UsnJrnl.GetJStream(record);

            List <UsnJrnl> usnList = new List <UsnJrnl>();

            for (int i = 0; i < J.DataRun.Length; i++)
            {
                if (!(J.DataRun[i].Sparse))
                {
                    long clusterCount = J.DataRun[i].ClusterLength;

                    byte[] fragmentBytes = NativeMethods.readDrive(streamToRead, ((ulong)J.DataRun[i].StartCluster * VBR.BytesPerCluster), ((ulong)clusterCount * VBR.BytesPerCluster));

                    byte[] clusterBytes = new byte[VBR.BytesPerCluster];

                    for (long j = 0; j < clusterCount; j++)
                    {
                        Array.Copy(fragmentBytes, ((long)j * VBR.BytesPerCluster), clusterBytes, 0, clusterBytes.Length);

                        int offset = 0;

                        do
                        {
                            if (clusterBytes[offset] == 0)
                            {
                                break;
                            }

                            try
                            {
                                UsnJrnl usn = new UsnJrnl(clusterBytes, volume, ref offset);
                                if (usn.Version > USN40Version)
                                {
                                    break;
                                }
                                usnList.Add(usn);
                            }
                            catch
                            {
                                break;
                            }
                        } while (offset >= 0 && offset < clusterBytes.Length);
                    }
                }
            }
            return(usnList.ToArray());
        }
Exemple #7
0
        private static UsnJrnl Get(string volume, int recordnumber, ulong usn)
        {
            // Check for valid Volume name
            NativeMethods.getVolumeName(ref volume);

            // Set up FileStream to read volume
            IntPtr     hVolume      = NativeMethods.getHandle(volume);
            FileStream streamToRead = NativeMethods.getFileStream(hVolume);

            // Get VolumeBootRecord object for logical addressing
            VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead);

            FileRecord record = FileRecord.Get(volume, recordnumber, true);

            // Get the $J Data attribute (contains UsnJrnl details
            NonResident J = UsnJrnl.GetJStream(record);

            // Determine the length of the initial sparse pages
            ulong SparseLength = (ulong)J.DataRun[0].ClusterLength * VBR.BytesPerCluster;

            if (usn > SparseLength)
            {
                // Subtract length of sparse data from desired usn offset
                ulong usnOffset = usn - SparseLength;

                // Iterate through each data run
                for (int i = 1; i < J.DataRun.Length; i++)
                {
                    // Determine length of current DataRun
                    ulong dataRunLength = (ulong)J.DataRun[i].ClusterLength * VBR.BytesPerCluster;

                    // Check if usnOffset resides in current DataRun
                    if (dataRunLength <= usnOffset)
                    {
                        // If not, subtract length of DataRun from usnOffset
                        usnOffset -= dataRunLength;
                    }

                    // If usnOffset resides within DataRun, parse associated UsnJrnl Entry
                    else
                    {
                        // Read DataRun from disk
                        byte[] fragmentBytes = NativeMethods.readDrive(streamToRead, ((ulong)J.DataRun[i].StartCluster * VBR.BytesPerCluster), ((ulong)J.DataRun[i].ClusterLength * VBR.BytesPerCluster));

                        // Instatiate a byte array that is the size of a single cluster
                        byte[] clusterBytes = new byte[VBR.BytesPerCluster];

                        // Iterate through the clusters in the DataRun
                        for (long j = 0; j < J.DataRun[i].ClusterLength; j++)
                        {
                            // If usnOffset is not in current cluster, then subtract cluster size from offset and iterate
                            if (VBR.BytesPerCluster <= usnOffset)
                            {
                                usnOffset -= VBR.BytesPerCluster;
                            }
                            // Else if usnOffset is in current cluster
                            else
                            {
                                // Copy current cluster bytes to clusterBytes variable
                                Array.Copy(fragmentBytes, ((long)j * VBR.BytesPerCluster), clusterBytes, 0, clusterBytes.Length);

                                // Parse desired UsnJrnl entry from cluster
                                int offset = (int)usnOffset;
                                return(new UsnJrnl(clusterBytes, volume, ref offset));
                            }
                        }
                    }
                }
                return(null);
            }
            else
            {
                throw new Exception("UsnJrnl entry has has been overwritten");
            }
        }
Exemple #8
0
        private static UsnJrnl[] GetInstances(string volume, int recordnumber)
        {
            // Check for valid Volume name
            Util.getVolumeName(ref volume);

            // Set up FileStream to read volume
            IntPtr hVolume = Util.getHandle(volume);
            FileStream streamToRead = Util.getFileStream(hVolume);

            // Get VolumeBootRecord object for logical addressing
            VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead);

            FileRecord record = FileRecord.Get(volume, recordnumber, true);

            // Get the $J Data attribute (contains UsnJrnl details
            NonResident J = UsnJrnl.GetJStream(record);

            List<UsnJrnl> usnList = new List<UsnJrnl>();

            for (int i = 0; i < J.DataRun.Length; i++)
            {
                if (!(J.DataRun[i].Sparse))
                {
                    long clusterCount = J.DataRun[i].ClusterLength;

                    byte[] fragmentBytes = Util.readDrive(streamToRead, ((ulong)J.DataRun[i].StartCluster * VBR.BytesPerCluster), ((ulong)clusterCount * VBR.BytesPerCluster));

                    byte[] clusterBytes = new byte[VBR.BytesPerCluster];

                    for (long j = 0; j < clusterCount; j++)
                    {
                        Array.Copy(fragmentBytes, ((long)j * VBR.BytesPerCluster), clusterBytes, 0, clusterBytes.Length);

                        int offset = 0;

                        do
                        {
                            if (clusterBytes[offset] == 0)
                            {
                                break;
                            }

                            try
                            {
                                UsnJrnl usn = new UsnJrnl(clusterBytes, volume, ref offset);
                                if (usn.Version > USN40Version)
                                {
                                    break;
                                }
                                usnList.Add(usn);
                            }
                            catch
                            {
                                break;
                            }

                        } while (offset >= 0 && offset < clusterBytes.Length);
                    }
                }
            }
            return usnList.ToArray();
        }
 public static ForensicTimeline[] GetInstances(UsnJrnl[] input)
 {
     List<ForensicTimeline> list = new List<ForensicTimeline>();
     foreach (UsnJrnl u in input)
     {
         list.Add(Get(u));
     } 
     return list.ToArray();
 }
 public static ForensicTimeline Get(UsnJrnl input)
 {
     return new ForensicTimeline(input.TimeStamp, "MACB", "USNJRNL", "", input.FileName, input.ToString());
 }
Exemple #11
0
        public static UsnJrnl[] GetTestInstances(string path)
        {
            byte[] bytes = FileRecord.GetContentBytes(path, "$J");
            string volume = Helper.GetVolumeFromPath(path);

            VolumeBootRecord VBR = VolumeBootRecord.Get(volume);
            List<UsnJrnl> usnList = new List<UsnJrnl>();

            for(int i = 0;  i < bytes.Length; i += (int)VBR.BytesPerCluster)
            {
                int clusteroffset = i;

                do
                {
                    // Break if there are no more UsnJrnl entries in cluster
                    if (bytes[clusteroffset] == 0)
                    {
                        break;
                    }

                    try
                    {
                        UsnJrnl usn = new UsnJrnl(bytes, volume, ref clusteroffset);
                        if (usn.Version > USN40Version)
                        {
                            break;
                        }
                        usnList.Add(usn);
                    }
                    catch
                    {
                        break;
                    }

                } while (clusteroffset >= 0 && clusteroffset < bytes.Length);
            }
            return usnList.ToArray();
        }