public IndexEntry(byte[] key, byte[] data, bool isFileIndexEntry) { _isFileIndexEntry = isFileIndexEntry; _flags = IndexEntryFlags.None; _keyBuffer = key; _dataBuffer = data; }
public virtual void Read(byte[] buffer, int offset) { ushort dataOffset = Utilities.ToUInt16LittleEndian(buffer, offset + 0x00); ushort dataLength = Utilities.ToUInt16LittleEndian(buffer, offset + 0x02); ushort length = Utilities.ToUInt16LittleEndian(buffer, offset + 0x08); ushort keyLength = Utilities.ToUInt16LittleEndian(buffer, offset + 0x0A); _flags = (IndexEntryFlags)Utilities.ToUInt16LittleEndian(buffer, offset + 0x0C); if ((_flags & IndexEntryFlags.End) == 0) { _keyBuffer = new byte[keyLength]; Array.Copy(buffer, offset + 0x10, _keyBuffer, 0, keyLength); if (IsFileIndexEntry) { // Special case, for file indexes, the MFT ref is held where the data offset & length go _dataBuffer = new byte[8]; Array.Copy(buffer, offset + 0x00, _dataBuffer, 0, 8); } else { _dataBuffer = new byte[dataLength]; Array.Copy(buffer, offset + 0x10 + keyLength, _dataBuffer, 0, dataLength); } } if ((_flags & IndexEntryFlags.Node) != 0) { _vcn = Utilities.ToInt64LittleEndian(buffer, offset + length - 8); } }
public IndexEntry(IndexEntry toCopy, byte[] newKey, byte[] newData) { _isFileIndexEntry = toCopy._isFileIndexEntry; _flags = toCopy._flags; _vcn = toCopy._vcn; _keyBuffer = newKey; _dataBuffer = newData; }
public FileNameIndexEntry(byte[] buffer, int offset) { FileReference = new MftSegmentReference(buffer, offset + 0x00); RecordLength = LittleEndianConverter.ToUInt16(buffer, offset + 0x08); FileNameOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x0A); IndexFlags = (IndexEntryFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x0C); if (RecordLength > 16)// otherwise it's the last record { Record = new FileNameRecord(buffer, offset + 0x10); } }
public long SubnodeVCN; // if PointsToSubnode flag is set, stored as ulong but can be represented using long public IndexNodeEntry(byte[] buffer, ref int offset) { SegmentReference = new MftSegmentReference(buffer, offset + 0x00); ushort recordLength = LittleEndianConverter.ToUInt16(buffer, offset + 0x08); ushort keyLength = LittleEndianConverter.ToUInt16(buffer, offset + 0x0A); Flags = (IndexEntryFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x0C); Key = ByteReader.ReadBytes(buffer, offset + 0x10, keyLength); if (PointsToSubnode) { // key is padded to align to 8 byte boundary int keyLengthWithPadding = (int)Math.Ceiling((double)keyLength / 8) * 8; SubnodeVCN = (long)LittleEndianConverter.ToUInt64(buffer, offset + 0x10 + keyLengthWithPadding); } offset += recordLength; }
/// <summary> /// Create an index entry for a file with the given stage /// and cache information. /// </summary> /// <param name="path">The path to the file</param> /// <param name="mode">The filemode for the file</param> /// <param name="id">The object id for the file</param> /// <param name="stage">The stage level to add</param> /// <param name="flags">Flags for the index entry</param> /// <param name="changeTime">The last changed time for the item</param> /// <param name="modificationTime">The last modified time for the item</param> /// <param name="device">The device the working tree file is on</param> /// <param name="inode">The inode for the working tree file</param> /// <param name="userId">The uid that owns the working tree file</param> /// <param name="groupId">The gid that owns the working tree file</param> /// <param name="fileSize">The file size</param> public IndexEntry( string path, FileMode mode, ObjectId id, IndexEntryStage stage = IndexEntryStage.Main, IndexEntryFlags flags = IndexEntryFlags.None, IndexEntryTime changeTime = null, IndexEntryTime modificationTime = null, long device = 0, long inode = 0, long userId = 0, long groupId = 0, long fileSize = 0) { Ensure.ArgumentNotNull(path, "path"); Ensure.ArgumentNotNull(mode, "mode"); Ensure.ArgumentNotNull(id, "id"); Ensure.CastToUInt(device, "device"); Ensure.CastToUInt(inode, "inode"); Ensure.CastToUInt(inode, "userId"); Ensure.CastToUInt(inode, "groupId"); Ensure.CastToUInt(inode, "fileSize"); Path = path; Mode = mode; Id = id; Stage = stage; Flags = new IndexEntryFlags(); ChangeTime = changeTime ?? IndexEntryTime.Epoch; ModificationTime = modificationTime ?? IndexEntryTime.Epoch; Device = device; Inode = inode; UserId = userId; GroupId = groupId; FileSize = fileSize; }