private unsafe NtfsMFTFileRecord(byte *rawData) { // Capture raw data. NtfsFileRecord *record = (NtfsFileRecord *)rawData; int copiedBytesCount = (int)record->BytesAllocated; _localBuffer = (NtfsFileRecord *)(byte *)Marshal.AllocCoTaskMem(copiedBytesCount); Helpers.Memcpy(rawData, (byte *)_localBuffer, copiedBytesCount); return; }
internal static unsafe ulong CountAttributes(NtfsFileRecord *record) { ulong result = 0; NtfsAttribute *scannedAttribute = (NtfsAttribute *)((byte *)record + record->AttributesOffset); while (!scannedAttribute->IsLast) { result++; scannedAttribute = (NtfsAttribute *)((byte *)scannedAttribute + scannedAttribute->Length); } return(result); }
internal unsafe void EnumerateRecordAttributes(NtfsPartition owner, ulong recordLBA, ref byte *buffer, RecordAttributeEnumeratorCallbackDelegate callback, NtfsAttributeType searchedType = NtfsAttributeType.Any, AttributeNameFilterDelegate nameFilter = null) { using (IPartitionClusterData data = owner.ReadSectors(recordLBA)) { buffer = data.Data; NtfsFileRecord *header = (NtfsFileRecord *)buffer; header->AssertRecordType(); if (1024 < header->BytesAllocated) { throw new NotImplementedException(); } EnumerateRecordAttributes(header, callback, searchedType, nameFilter); } }
private unsafe void _Run() { NtfsPartition partition = Partition; IPartitionClusterData clusterData = null; try { NtfsFileRecord *fileRecord = partition.GetFileRecord( NtfsWellKnownMetadataFiles.LogFile, out clusterData); fileRecord->AssertRecordType(); throw new NotImplementedException(); } finally { if (null != clusterData) { clusterData.Dispose(); } } }
public static unsafe int Main(string[] args) { InstallExceptionHandlers(); using (PartitionDataDisposableBatch mainBatch = PartitionDataDisposableBatch.CreateNew()) { DisplayVersion(); IntPtr handle = IntPtr.Zero; int nativeError; DiskGeometry geometry = new DiskGeometry(); try { handle = Natives.CreateFile2(@"\\.\PhysicalDrive0", 0x80000000 /* GENERIC_READ */, 0x02 /* FILE_SHARE_WRITE */, 3 /* OPEN_EXISTING */, IntPtr.Zero); nativeError = Marshal.GetLastWin32Error(); if ((IntPtr.Zero == handle) || (0 != nativeError)) { Console.WriteLine("Physical drive opening failed. Error 0x{0:X8}", nativeError); return(1); } geometry.Acquire(handle); _partitionManager = new PartitionManager(handle, geometry); _partitionManager.Discover(); InterpretActivePartitions(); if (FeaturesContext.InvariantChecksEnabled) { NtfsMFTFileRecord.AssertMFTRecordCachingInvariance(_partitionManager); } // TODO : Configure TrackedPartitionIndex from command line arguments. foreach (GenericPartition partition in _partitionManager.EnumeratePartitions()) { if (!partition.ShouldCapture) { continue; } NtfsPartition ntfsPartition = partition as NtfsPartition; NtfsPartition.Current = ntfsPartition; // Basic functionnality tests. Don't remove. //ntfsPartition.CountFiles(); //ntfsPartition.MonitorBadClusters(); //ntfsPartition.ReadBitmap(); // Dump bad clusters. ntfsPartition.DumpBadClusters(); // Dump UsnJournal PrototypeUsnJournal(); new NtfsUsnJournalReader(ntfsPartition).Run(); // Dump LogFile // new NtfsLogFileReader(ntfsPartition).Run(); // Locate file. // string fileName = @"TEMP\AsciiTes.txt"; string fileName = @"$Extend\$UsnJrnl"; NtfsIndexEntryHeader *fileDescriptor = ntfsPartition.FindFile(fileName); if (null == fileDescriptor) { throw new System.IO.FileNotFoundException(fileName); } IPartitionClusterData fileData = null; NtfsFileRecord * usnJournalFileRecord = ntfsPartition.GetFileRecord(fileDescriptor->FileReference, ref fileData); if ((null == usnJournalFileRecord) || (null == fileData)) { throw new ApplicationException(); } try { usnJournalFileRecord->EnumerateRecordAttributes( delegate(NtfsAttribute * attribute, Stream dataStream) { attribute->Dump(); return(true); }); // For debugging purpose. // fileRecord->BinaryDumpContent(); // TODO : Do something with the file. } finally { if (null != fileData) { fileData.Dispose(); } } } return(0); } finally { if (IntPtr.Zero == handle) { Natives.CloseHandle(handle); handle = IntPtr.Zero; } } } }
private static unsafe void PrototypeUsnJournal() { List <Tuple <uint, ulong> > records = new List <Tuple <uint, ulong> >() { new Tuple <uint, ulong>(0x00000000, 0x10000000417F8), new Tuple <uint, ulong>(0x00831030, 0x133000000030345), new Tuple <uint, ulong>(0x00835CE0, 0x79200000000288E), new Tuple <uint, ulong>(0x00839E60, 0x16C0000000059EB), new Tuple <uint, ulong>(0x00842DE0, 0x7340000000057C6), new Tuple <uint, ulong>(0x00844160, 0x600000018405F), new Tuple <uint, ulong>(0x0084A215, 0x8F000000036956), new Tuple <uint, ulong>(0x0084EF80, 0x2B0000000020AD), new Tuple <uint, ulong>(0x00852F71, 0x3D00000000024B8), new Tuple <uint, ulong>(0x00857E50, 0x50B000000007274), new Tuple <uint, ulong>(0x00858DB0, 0x235000000000705), new Tuple <uint, ulong>(0x0085CD90, 0xD20000000086D7), new Tuple <uint, ulong>(0x00860A90, 0x7900000000840C), new Tuple <uint, ulong>(0x00862160, 0x6E500000002FC3E), new Tuple <uint, ulong>(0x00868190, 0x7F000000004050), new Tuple <uint, ulong>(0x0086C570, 0x49E000000003C3E), new Tuple <uint, ulong>(0x0086D8F0, 0x160000000F353D), new Tuple <uint, ulong>(0x00871DB0, 0x9D000000004053), new Tuple <uint, ulong>(0x00875B90, 0x19F000000001DD5), new Tuple <uint, ulong>(0x00877B0C, 0x387000000031EA2), new Tuple <uint, ulong>(0x0087BE50, 0x840000000041B7), new Tuple <uint, ulong>(0x00883CC0, 0x2C4000000006741), new Tuple <uint, ulong>(0x00888210, 0x93000000007190), new Tuple <uint, ulong>(0x00889710, 0xF30000000DD118), new Tuple <uint, ulong>(0x0089759B, 0xA2B000000006C37), new Tuple <uint, ulong>(0x0089F050, 0xD400000002EF59), new Tuple <uint, ulong>(0x008A3480, 0x4000000030266), new Tuple <uint, ulong>(0x008A4780, 0x3D000000122430), new Tuple <uint, ulong>(0x008A8FF0, 0x4A0000000F8276), new Tuple <uint, ulong>(0x008ACDF0, 0x7000000030267), new Tuple <uint, ulong>(0x008B1FF0, 0xF000000030265), new Tuple <uint, ulong>(0x008B32F2, 0x10000001E9963), new Tuple <uint, ulong>(0x008B7272, 0x5000000030269), new Tuple <uint, ulong>(0x008BB022, 0x6000000030268), new Tuple <uint, ulong>(0x008BC2A0, 0xC000000121FED), new Tuple <uint, ulong>(0x008C4B70, 0x3700000016AC1D), new Tuple <uint, ulong>(0x008CEDF0, 0x5000000184830), new Tuple <uint, ulong>(0x008DEAD0, 0x1D0000000004401), new Tuple <uint, ulong>(0x008E2D20, 0x3B400000000157B), new Tuple <uint, ulong>(0x008E4120, 0x3DC0000000045DC), new Tuple <uint, ulong>(0x008E8FC0, 0x2800000000E8AE), new Tuple <uint, ulong>(0x008F123D, 0x52F0000000010F0), new Tuple <uint, ulong>(0x008F72F0, 0x147000000033E17), new Tuple <uint, ulong>(0x008FB610, 0x5A0000000305FD), new Tuple <uint, ulong>(0x008FCA00, 0x144000000003871), new Tuple <uint, ulong>(0x00901140, 0x1E2000000033E33), new Tuple <uint, ulong>(0x009054B0, 0x29000000033E34), new Tuple <uint, ulong>(0x00906AB0, 0x3420000000035B2), new Tuple <uint, ulong>(0x0090B250, 0xD7000000004C47), new Tuple <uint, ulong>(0x0090F710, 0xA9000000005C58), new Tuple <uint, ulong>(0x00913660, 0xC9000000002451), new Tuple <uint, ulong>(0x0091A1E0, 0xA8000000004E3B), new Tuple <uint, ulong>(0x009280D4, 0x2920000000DD0CA), new Tuple <uint, ulong>(0x0092C280, 0x276000000031B0A), new Tuple <uint, ulong>(0x00934D30, 0x6F0000000F179E), new Tuple <uint, ulong>(0x0093B220, 0xB20000000D3A3F), new Tuple <uint, ulong>(0x0093F0C4, 0x5400000002BC62), new Tuple <uint, ulong>(0x00940380, 0xA7000000004A8C), new Tuple <uint, ulong>(0x00945C6F, 0x6F000000008D46), new Tuple <uint, ulong>(0x0094C310, 0x3A0000000D9AA7), new Tuple <uint, ulong>(0x00954910, 0x4C0000000D9A91) }; NtfsPartition partition = NtfsPartition.Current; ulong mftEntrySize = partition.ClusterSize / partition.MFTEntryPerCluster; IPartitionClusterData data = null; try { ulong baseFileRecord = 0; foreach (Tuple <uint, ulong> record in records) { ulong fileReference = record.Item2; NtfsFileRecord *fileRecord = partition.GetFileRecord(fileReference, ref data); if (0 == baseFileRecord) { baseFileRecord = fileRecord->BaseFileRecord; } if (fileRecord->BaseFileRecord != baseFileRecord) { fileRecord->BinaryDump(); fileRecord->Dump(); throw new ApplicationException(); } fileRecord->EnumerateRecordAttributes(delegate(NtfsAttribute * value, Stream attributeDataStream) { if (null != attributeDataStream) { throw new NotSupportedException(); } if (value->IsResident) { throw new NotSupportedException(); } IClusterStream dataStream = (IClusterStream)((NtfsNonResidentAttribute *)value)->OpenDataClusterStream(); dataStream.SeekToNextNonEmptyCluster(); NtfsUsnJournalReader.UsnRecordV2 *currentUsnRecord = null; while (true) { using (IPartitionClusterData clusterData = dataStream.ReadNextCluster()) { if (null == clusterData) { // Done with this stream. return(true); } for (uint offset = 0; offset < clusterData.DataSize; offset += currentUsnRecord->RecordLength) { currentUsnRecord = (NtfsUsnJournalReader.UsnRecordV2 *)(clusterData.Data + offset); if (0 == currentUsnRecord->RecordLength) { break; } if (2 != currentUsnRecord->MajorVersion) { Helpers.BinaryDump((byte *)currentUsnRecord, (uint)Marshal.SizeOf <NtfsUsnJournalReader.UsnRecordV2>()); throw new NotSupportedException(); } if (0 != currentUsnRecord->MinorVersion) { throw new NotSupportedException(); } currentUsnRecord->Dump(); } } } }, NtfsAttributeType.AttributeData, null); fileRecord->DumpAttributes(); } return; } finally { if (null != data) { data.Dispose(); } } }
/// <summary>Enumerate attributes bound to this <see cref="NtfsFileRecord"/>, optionally filtering /// on attribute name.</summary> /// <param name="header">The file record.</param> /// <param name="callback"></param> /// <param name="searchedAttributeType"></param> /// <param name="nameFilter">An optional name filter that will be provided with the basic attribute /// properties (including name) in order to decide if data should be retrieved. This is especially /// usefull for <see cref="NtfsAttributeListAttribute"/> attributes that may reference lengthy /// attributes data which are expensive to retrieve.</param> internal static unsafe void EnumerateRecordAttributes(NtfsFileRecord *header, RecordAttributeEnumeratorCallbackDelegate callback, NtfsAttributeType searchedAttributeType, AttributeNameFilterDelegate nameFilter) { // Walk attributes, seeking for the searched one. NtfsAttribute *currentAttribute = (NtfsAttribute *)((byte *)header + header->AttributesOffset); NtfsAttributeListAttribute *pendingAttributeList = null; NtfsAttribute *[] candidates = new NtfsAttribute *[MaxAttributeCount]; int candidatesCount = 0; for (int attributeIndex = 0; attributeIndex < header->NextAttributeNumber; attributeIndex++) { if (currentAttribute->IsLast) { break; } if (header->BytesInUse < ((byte *)currentAttribute - (byte *)header)) { break; } if (NtfsAttributeType.EndOfListMarker == currentAttribute->AttributeType) { break; } // If we found an AttributeListAttribute, we must go one level deeper to // complete the enumeration. if (NtfsAttributeType.AttributeAttributeList == currentAttribute->AttributeType) { if (null != pendingAttributeList) { // No more than one attribute of this kind per file record. throw new ApplicationException(); } if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType) { if (!callback(currentAttribute, null)) { return; } } // Defer handling pendingAttributeList = (NtfsAttributeListAttribute *)currentAttribute; break; } if (candidatesCount >= MaxAttributeCount) { throw new ApplicationException(); } if ((NtfsAttributeType.Any == searchedAttributeType) || (currentAttribute->AttributeType == searchedAttributeType)) { candidates[candidatesCount++] = currentAttribute; } currentAttribute = (NtfsAttribute *)((byte *)currentAttribute + currentAttribute->Length); } if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType) { // Either we already found one such attribute and invoked the callback or found none and // we can return immediately. Should we have found several such attributes we would have // risen an exception. return; } if (null == pendingAttributeList) { // We already walked every attributes and captured those that matched the type filter if // any. Invoke callbak on each such attribute. for (int candidateIndex = 0; candidateIndex < candidatesCount; candidateIndex++) { if (!callback(candidates[candidateIndex], null)) { return; } } // We are done. return; } NtfsAttributeListAttribute.Dump(pendingAttributeList); // HandleAttributeListAttributeEntry // We have an attribute list attribute. Delegate him the enumeration. NtfsPartition currentPartition = NtfsPartition.Current; NtfsAttributeListAttribute.EnumerateEntries((NtfsAttribute *)pendingAttributeList, searchedAttributeType, new ListEntryHandler(searchedAttributeType, nameFilter, callback).HandleListEntry); return; }
private unsafe void _Run() { NtfsPartition partition = Partition; IPartitionClusterData clusterData = null; try { // Note : We could also use the NtfsWellKnownMetadataFiles.Extend entry to // locate the directory, then find the $UsnJrnl entry directly from there. string fileName = @"$UsnJrnl"; NtfsIndexEntryHeader *fileDescriptor = partition.FindFile(fileName, NtfsWellKnownMetadataFiles.Extend); if (null == fileDescriptor) { throw new System.IO.FileNotFoundException(fileName); } IPartitionClusterData fileData = null; try { NtfsFileRecord *fileRecord = partition.GetFileRecord(fileDescriptor->FileReference, ref fileData); fileRecord->AssertRecordType(); // We retrieve the first attribute here. Stream dataStream; NtfsAttribute *jAttribute = fileRecord->GetAttribute(NtfsAttributeType.AttributeData, out dataStream, 1, _isDollarJAttributeNameFilter); if (null == jAttribute) { throw new ApplicationException(); } if (jAttribute->IsResident) { // Seems this is never the case. throw new NotSupportedException("CODE REVIEW REQUIRED"); } NtfsNonResidentAttribute *jNrAttribute = (NtfsNonResidentAttribute *)jAttribute; jNrAttribute->Dump(); byte[] buffer = new byte[NtfsPartition.Current.ClusterSize]; DateTime sparseReadStartTime = DateTime.UtcNow; TimeSpan sparseReadDuration; if (null == dataStream) { dataStream = jNrAttribute->OpenDataStream(); throw new ApplicationException("CODE REVIEW REQUIRED"); } int totalReads = 0; bool nonNullByteFound = false; while (true) { int readCount = dataStream.Read(buffer, 0, buffer.Length); if (-1 == readCount) { sparseReadDuration = DateTime.UtcNow - sparseReadStartTime; break; } if (nonNullByteFound) { for (int index = 0; index < readCount; index++) { if (0 == buffer[index]) { continue; } sparseReadDuration = DateTime.UtcNow - sparseReadStartTime; Console.WriteLine("{0} null leading bytes found after {1} secs.", totalReads + index, (int)sparseReadDuration.TotalSeconds); nonNullByteFound = true; break; } } totalReads += readCount; if (nonNullByteFound) { Helpers.BinaryDump(buffer, (uint)readCount); } } if (!nonNullByteFound) { sparseReadDuration = DateTime.UtcNow - sparseReadStartTime; Console.WriteLine("{0} null leading bytes found after {1} secs.", totalReads, (int)sparseReadDuration.TotalSeconds); } throw new NotImplementedException(); NtfsAttribute *rawAttribute = fileRecord->GetAttribute(NtfsAttributeType.AttributeData, out dataStream, 1); if (null == rawAttribute) { throw new ApplicationException(); } if ("$Max" != rawAttribute->Name) { throw new ApplicationException(); } if (rawAttribute->IsResident) { NtfsResidentAttribute *reMaxAttribute = (NtfsResidentAttribute *)rawAttribute; if (FeaturesContext.InvariantChecksEnabled) { if (0x20 != reMaxAttribute->ValueLength) { throw new ApplicationException(); } } MaxAttribute *maxAttribute = (MaxAttribute *)((byte *)reMaxAttribute + reMaxAttribute->ValueOffset); } else { throw new NotSupportedException(); } rawAttribute = fileRecord->GetAttribute(NtfsAttributeType.AttributeData, out dataStream, 2); if (null == rawAttribute) { throw new ApplicationException(); } if ("$J" != rawAttribute->Name) { throw new ApplicationException(); } throw new NotImplementedException(); } finally { if (null != fileData) { fileData.Dispose(); } } } finally { if (null != clusterData) { clusterData.Dispose(); } } }
/// <summary>The caller enumerating entries might be interested in the content of /// the currently scanned entry. This might be either for additional filtering at /// attribute level (including attribute name) or for full attribute data processing. /// </summary> /// <param name="entry">The scanned list entry of interest. Should a single /// attribute span several entries, this one is guaranteed to be the first one for the /// attribute.</param> /// <param name="remainingBytesInList">Number of bytes remaining in list, relatively to the /// entry address.</param> /// <param name="entryReferencedAttributeHandler">The callback that will be invoked /// with the referenced attribute with or without full attribute data depending on /// the value of <paramref name="dataIncluded"/></param> /// <param name="dataIncluded"></param> /// <returns>true if caller should continue process data, false if it should stop.</returns> private static unsafe bool HandleEntryReferencedAttribute(ListEntry *entry, uint remainingBytesInList, EntryListReferencedAttributeHandlerDelegate entryReferencedAttributeHandler, bool dataIncluded) { ushort currentAttributeNumber = entry->AttributeNumber; NtfsAttributeType currentAttributeType = entry->AttributeType; byte * baseAddress = (byte *)entry; uint relativeOffset = 0; // The last callback invocation decided it needs some more data before deciding // what to do. IPartitionClusterData clusterData = null; NtfsPartition currentPartition = NtfsPartition.Current; using (PartitionDataDisposableBatch batch = PartitionDataDisposableBatch.CreateNew()) { while (true) { ListEntry * scannedEntry = (ListEntry *)baseAddress; ulong mainFileReferenceNumber = entry->FileReferenceNumber; List <ulong> entries = new List <ulong>(); Stream dataStream = null; if (dataIncluded) { // Read each record and prepare for data retrieval. while (true) { entries.Add(scannedEntry->FileReferenceNumber); relativeOffset += scannedEntry->EntryLength; if (relativeOffset >= remainingBytesInList) { // Take care not to go further than the end of the list. break; } scannedEntry = (ListEntry *)(baseAddress + relativeOffset); if ((currentAttributeNumber != scannedEntry->AttributeNumber) || (currentAttributeType != scannedEntry->AttributeType)) { break; } } dataStream = new MultiRecordAttributeDataStream(entries); } // Retrieve attribute itself. NtfsFileRecord *mainFileRecord = currentPartition.GetFileRecord(mainFileReferenceNumber, ref clusterData); if (null == mainFileRecord) { throw new ApplicationException(); } NtfsAttribute *retrievedAttribute = (NtfsAttribute *)((byte *)mainFileRecord + mainFileRecord->AttributesOffset); // Invoke callback. bool retry; if (!entryReferencedAttributeHandler(retrievedAttribute, dataStream, out retry)) { // After attribute has been processed, it has been decided no other list // entry should be performed. return(false); } if (!retry) { // After attribute has been processed, it has been decided that no // additional data from this attribute is required. However the enumeration // of other list entries should continue. return(true); } if (dataIncluded) { throw new InvalidOperationException(); } // Attribute has been processed, however not enough data was available for a // final decision. We loop and include all data now. dataIncluded = true; } } }