internal FileNameAttribute(INtfsContext context, AttributeRecord record) : base(context, record) { byte[] content = Utilities.ReadAll(Content); _fnr = new FileNameRecord(); _fnr.ReadFrom(content, 0); }
internal AttributeListAttribute(INtfsContext context, AttributeRecord record) : base(context, record) { byte[] content = Utilities.ReadAll(Content); _list = new AttributeList(); _list.ReadFrom(content, 0); }
internal StandardInformationAttribute(INtfsContext context, AttributeRecord record) : base(context, record) { byte[] content = Utilities.ReadAll(Content); _si = new StandardInformation(); _si.ReadFrom(content, 0); }
public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags) { File newFile = context.AllocateFile(flags); FileAttributeFlags fileFlags = FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags) | (dirFlags & FileAttributeFlags.Compressed); AttributeFlags dataAttrFlags = AttributeFlags.None; if ((dirFlags & FileAttributeFlags.Compressed) != 0) { dataAttrFlags |= AttributeFlags.Compressed; } StandardInformation.InitializeNewFile(newFile, fileFlags); if (context.ObjectIds != null) { Guid newId = CreateNewGuid(context); NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null); ObjectId objId = new ObjectId(); objId.Id = newId; stream.SetContent(objId); context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty); } newFile.CreateAttribute(AttributeType.Data, dataAttrFlags); newFile.UpdateRecordInMft(); return(newFile); }
public RawClusterStream(INtfsContext context, CookedDataRuns cookedRuns, bool isMft) { _context = context; _cookedRuns = cookedRuns; _isMft = isMft; _fsStream = _context.RawStream; _bytesPerCluster = context.BiosParameterBlock.BytesPerCluster; }
public CompressedClusterStream(INtfsContext context, NtfsAttribute attr, RawClusterStream rawStream) { _context = context; _attr = attr; _rawStream = rawStream; _bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster; _cacheBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster]; _ioBuffer = new byte[_attr.CompressionUnitSize * context.BiosParameterBlock.BytesPerCluster]; }
public File(INtfsContext context, FileRecord baseRecord) { _context = context; _mft = _context.Mft; _records = new List<FileRecord>(); _records.Add(baseRecord); _indexCache = new ObjectCache<string, Index>(); _attributes = new List<NtfsAttribute>(); LoadAttributes(); }
public NonResidentDataBuffer(INtfsContext context, CookedDataRuns cookedRuns, bool isMft) { _context = context; _cookedRuns = cookedRuns; _rawStream = new RawClusterStream(_context, _cookedRuns, isMft); _activeStream = _rawStream; _bytesPerCluster = _context.BiosParameterBlock.BytesPerCluster; _ioBuffer = new byte[_bytesPerCluster]; }
public File(INtfsContext context, FileRecord baseRecord) { _context = context; _mft = _context.Mft; _records = new List <FileRecord>(); _records.Add(baseRecord); _indexCache = new ObjectCache <string, Index>(); _attributes = new List <NtfsAttribute>(); LoadAttributes(); }
public MasterFileTable(INtfsContext context) { BiosParameterBlock bpb = context.BiosParameterBlock; _recordCache = new ObjectCache <long, FileRecord>(); _recordLength = bpb.MftRecordSize; _bytesPerSector = bpb.BytesPerSector; // Temporary record stream - until we've bootstrapped the MFT properly _recordStream = new SubStream(context.RawStream, bpb.MftCluster * bpb.SectorsPerCluster * bpb.BytesPerSector, 24 * _recordLength); }
private static Guid CreateNewGuid(INtfsContext context) { Random rng = context.Options.RandomNumberGenerator; if (rng != null) { byte[] buffer = new byte[16]; rng.NextBytes(buffer); return(new Guid(buffer)); } return(Guid.NewGuid()); }
internal new static Directory CreateNew(INtfsContext context) { Directory dir = (Directory)context.AllocateFile(FileRecordFlags.IsDirectory); StandardInformation.InitializeNewFile(dir, FileAttributeFlags.Archive); // Create the index root attribute by instantiating a new index dir.CreateIndex("$I30", AttributeType.FileName, AttributeCollationRule.Filename); dir.UpdateRecordInMft(); return(dir); }
internal static GenericAttribute FromAttributeRecord(INtfsContext context, AttributeRecord record) { switch (record.AttributeType) { case AttributeType.AttributeList: return(new AttributeListAttribute(context, record)); case AttributeType.FileName: return(new FileNameAttribute(context, record)); case AttributeType.StandardInformation: return(new StandardInformationAttribute(context, record)); default: return(new UnknownAttribute(context, record)); } }
public File InitializeNew(INtfsContext context, long firstBitmapCluster, ulong numBitmapClusters, long firstRecordsCluster, ulong numRecordsClusters) { BiosParameterBlock bpb = context.BiosParameterBlock; FileRecord fileRec = new FileRecord(bpb.BytesPerSector, bpb.MftRecordSize, (uint)MftIndex); fileRec.Flags = FileRecordFlags.InUse; fileRec.SequenceNumber = 1; _recordCache[MftIndex] = fileRec; _self = new File(context, fileRec); StandardInformation.InitializeNewFile(_self, FileAttributeFlags.Hidden | FileAttributeFlags.System); NtfsStream recordsStream = _self.CreateStream(AttributeType.Data, null, firstRecordsCluster, numRecordsClusters, (uint)bpb.BytesPerCluster); _recordStream = recordsStream.Open(FileAccess.ReadWrite); Wipe(_recordStream); NtfsStream bitmapStream = _self.CreateStream(AttributeType.Bitmap, null, firstBitmapCluster, numBitmapClusters, (uint)bpb.BytesPerCluster); using (Stream s = bitmapStream.Open(FileAccess.ReadWrite)) { Wipe(s); s.SetLength(8); _bitmap = new Bitmap(s, long.MaxValue); } RecordSize = context.BiosParameterBlock.MftRecordSize; _bytesPerSector = context.BiosParameterBlock.BytesPerSector; _bitmap.MarkPresentRange(0, 1); // Write the MFT's own record to itself byte[] buffer = new byte[RecordSize]; fileRec.ToBytes(buffer, 0); _recordStream.Position = 0; _recordStream.Write(buffer, 0, RecordSize); _recordStream.Flush(); return(_self); }
internal static File CreateNew(INtfsContext context, FileRecordFlags flags) { DateTime now = DateTime.UtcNow; File newFile = context.AllocateFile(flags); StandardInformation.InitializeNewFile(newFile, FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags)); if (context.ObjectIds != null) { Guid newId = CreateNewGuid(context); NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null); ObjectId objId = new ObjectId(); objId.Id = newId; stream.SetContent(objId); context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty); } newFile.CreateAttribute(AttributeType.Data, AttributeFlags.None); newFile.UpdateRecordInMft(); return(newFile); }
public static File CreateNew(INtfsContext context, FileRecordFlags flags, FileAttributeFlags dirFlags) { File newFile = context.AllocateFile(flags); FileAttributeFlags fileFlags = FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags) | (dirFlags & FileAttributeFlags.Compressed); AttributeFlags dataAttrFlags = AttributeFlags.None; if ((dirFlags & FileAttributeFlags.Compressed) != 0) { dataAttrFlags |= AttributeFlags.Compressed; } StandardInformation.InitializeNewFile(newFile, fileFlags); if (context.ObjectIds != null) { Guid newId = CreateNewGuid(context); NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null); ObjectId objId = new ObjectId(); objId.Id = newId; stream.SetContent(objId); context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty); } newFile.CreateAttribute(AttributeType.Data, dataAttrFlags); newFile.UpdateRecordInMft(); return newFile; }
public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags) { return CreateNew(context, FileRecordFlags.None, dirFlags); }
internal static GenericAttribute FromAttributeRecord(INtfsContext context, AttributeRecord record) { switch (record.AttributeType) { case AttributeType.AttributeList: return new AttributeListAttribute(context, record); case AttributeType.FileName: return new FileNameAttribute(context, record); case AttributeType.StandardInformation: return new StandardInformationAttribute(context, record); default: return new UnknownAttribute(context, record); } }
internal MasterFileTableEntry(INtfsContext context, FileRecord fileRecord) { _context = context; _fileRecord = fileRecord; }
public Directory(INtfsContext context, FileRecord baseRecord) : base(context, baseRecord) { }
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context) { return(new NonResidentDataBuffer(context, this)); }
internal static File CreateNew(INtfsContext context) { return(CreateNew(context, FileRecordFlags.None)); }
internal MasterFileTable(INtfsContext context, InternalMasterFileTable mft) { _context = context; _mft = mft; }
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context) { return new NonResidentDataBuffer(context, this); }
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context) { return(_memoryBuffer); }
internal static File CreateNew(INtfsContext context, FileRecordFlags flags) { DateTime now = DateTime.UtcNow; File newFile = context.AllocateFile(flags); StandardInformation.InitializeNewFile(newFile, FileAttributeFlags.Archive | FileRecord.ConvertFlags(flags)); if (context.ObjectIds != null) { Guid newId = CreateNewGuid(context); NtfsStream stream = newFile.CreateStream(AttributeType.ObjectId, null); ObjectId objId = new ObjectId(); objId.Id = newId; stream.SetContent(objId); context.ObjectIds.Add(newId, newFile.MftReference, newId, Guid.Empty, Guid.Empty); } newFile.CreateAttribute(AttributeType.Data, AttributeFlags.None); newFile.UpdateRecordInMft(); return newFile; }
public File InitializeNew(INtfsContext context, long firstBitmapCluster, ulong numBitmapClusters, long firstRecordsCluster, ulong numRecordsClusters) { BiosParameterBlock bpb = context.BiosParameterBlock; FileRecord fileRec = new FileRecord(bpb.BytesPerSector, bpb.MftRecordSize, (uint)MftIndex); fileRec.Flags = FileRecordFlags.InUse; fileRec.SequenceNumber = 1; _recordCache[MftIndex] = fileRec; _self = new File(context, fileRec); StandardInformation.InitializeNewFile(_self, FileAttributeFlags.Hidden | FileAttributeFlags.System); NtfsStream recordsStream = _self.CreateStream(AttributeType.Data, null, firstRecordsCluster, numRecordsClusters, (uint)bpb.BytesPerCluster); _recordStream = recordsStream.Open(FileAccess.ReadWrite); Wipe(_recordStream); NtfsStream bitmapStream = _self.CreateStream(AttributeType.Bitmap, null, firstBitmapCluster, numBitmapClusters, (uint)bpb.BytesPerCluster); using (Stream s = bitmapStream.Open(FileAccess.ReadWrite)) { Wipe(s); s.SetLength(8); _bitmap = new Bitmap(s, long.MaxValue); } _recordLength = context.BiosParameterBlock.MftRecordSize; _bytesPerSector = context.BiosParameterBlock.BytesPerSector; _bitmap.MarkPresentRange(0, 1); // Write the MFT's own record to itself byte[] buffer = new byte[_recordLength]; fileRec.ToBytes(buffer, 0); _recordStream.Position = 0; _recordStream.Write(buffer, 0, _recordLength); _recordStream.Flush(); return _self; }
public MasterFileTable(INtfsContext context) { BiosParameterBlock bpb = context.BiosParameterBlock; _recordCache = new ObjectCache<long, FileRecord>(); _recordLength = bpb.MftRecordSize; _bytesPerSector = bpb.BytesPerSector; // Temporary record stream - until we've bootstrapped the MFT properly _recordStream = new SubStream(context.RawStream, bpb.MftCluster * bpb.SectorsPerCluster * bpb.BytesPerSector, 24 * _recordLength); }
private static Guid CreateNewGuid(INtfsContext context) { Random rng = context.Options.RandomNumberGenerator; if (rng != null) { byte[] buffer = new byte[16]; rng.NextBytes(buffer); return new Guid(buffer); } else { return Guid.NewGuid(); } }
public static File CreateNew(INtfsContext context, FileAttributeFlags dirFlags) { return(CreateNew(context, FileRecordFlags.None, dirFlags)); }
public UnknownAttribute(INtfsContext context, AttributeRecord record) : base(context, record) { }
internal GenericAttribute(INtfsContext context, AttributeRecord record) { _context = context; _record = record; }
public NonResidentDataBuffer(INtfsContext context, NonResidentAttributeRecord record) : this(context, new CookedDataRuns(record.DataRuns, record), false) { }
public override IBuffer GetReadOnlyDataBuffer(INtfsContext context) { return _memoryBuffer; }
internal static File CreateNew(INtfsContext context) { return CreateNew(context, FileRecordFlags.None); }
public abstract IBuffer GetReadOnlyDataBuffer(INtfsContext context);