public void GetFileLength()
{
NtfsFileSystem ntfs = FileSystemSource.NtfsFileSystem();
ntfs.OpenFile(@"AFILE.TXT", FileMode.Create).Dispose();
Assert.Equal(0, ntfs.GetFileLength("AFILE.TXT"));
using (var stream = ntfs.OpenFile(@"AFILE.TXT", FileMode.Open))
{
stream.Write(new byte[14325], 0, 14325);
}
Assert.Equal(14325, ntfs.GetFileLength("AFILE.TXT"));
using (var attrStream = ntfs.OpenFile(@"AFILE.TXT:altstream", FileMode.Create))
{
attrStream.Write(new byte[122], 0, 122);
}
Assert.Equal(122, ntfs.GetFileLength("AFILE.TXT:altstream"));
// Test NTFS options for hardlink behaviour
ntfs.CreateDirectory("Dir");
ntfs.CreateHardLink("AFILE.TXT", @"Dir\OtherLink.txt");
using (var stream = ntfs.OpenFile("AFILE.TXT", FileMode.Open, FileAccess.ReadWrite))
{
stream.SetLength(50);
}
Assert.Equal(50, ntfs.GetFileLength("AFILE.TXT"));
Assert.Equal(14325, ntfs.GetFileLength(@"Dir\OtherLink.txt"));
ntfs.NtfsOptions.FileLengthFromDirectoryEntries = false;
Assert.Equal(50, ntfs.GetFileLength(@"Dir\OtherLink.txt"));
}
public static void GetDirListing(string VMDKpath, string directory)
{
if (File.Exists(VMDKpath))
{
try
{
using (VirtualDisk vhdx = VirtualDisk.OpenDisk(VMDKpath, FileAccess.Read))
{
if (vhdx.Partitions.Count > 1)
{
Console.WriteLine("Target has more than one partition");
for (var i = 0; i <= vhdx.Partitions.Count; i++)
{
NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[i].Open());
if (vhdbNtfs.DirectoryExists("\\\\" + directory))
{
string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory);
string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory);
foreach (var file in filelist)
{
Console.WriteLine("[F] {0}", file);
}
foreach (var dir in dirlist)
{
Console.WriteLine("[D] {0}", dir);
}
}
else
{
Console.WriteLine("\r\n[*] Directory does not exist");
}
}
}
else
{
NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open());
if (vhdbNtfs.DirectoryExists("\\\\" + directory))
{
string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory);
string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory);
foreach (var file in filelist)
{
Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file));
}
foreach (var dir in dirlist)
{
Console.WriteLine("[D] {0}", dir);
}
}
else
{
Console.WriteLine("\r\n[*] Directory does not exist");
}
}
}
}
catch (Exception ex)
{
Console.WriteLine("\r\n [!] Virtual Disk provided is not supported");
Console.WriteLine("\r\n [!] An exception occured: {0}", ex);
Environment.Exit(1);
}
}
else
{
Console.WriteLine("\r\n [!] The provided VMDK image does not exist or can not be accessed");
}
}
public static void GetFile(string VMDKpath, string filepath, string destinationfile)
{
if (File.Exists(VMDKpath) && Directory.Exists(Path.GetDirectoryName(destinationfile)))
{
try
{
if (Path.GetFileName(destinationfile) == "")
{
destinationfile += Path.GetFileName(filepath);
}
using (VirtualDisk vhdx = VirtualDisk.OpenDisk(VMDKpath, FileAccess.Read))
{
if (vhdx.Partitions.Count > 1)
{
Console.WriteLine("Target has more than one partition");
for (var i = 0; i <= vhdx.Partitions.Count; i++)
{
try
{
NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[i].Open());
if (vhdbNtfs.FileExists("\\\\" + filepath))
{
long fileLength = vhdbNtfs.GetFileLength("\\\\" + filepath);
using (Stream bootStream = vhdbNtfs.OpenFile("\\\\" + filepath, FileMode.Open, FileAccess.Read))
{
byte[] file = new byte[bootStream.Length];
int totalRead = 0;
while (totalRead < file.Length)
{
totalRead += bootStream.Read(file, totalRead, file.Length - totalRead);
FileStream fileStream = File.Create(destinationfile, (int)bootStream.Length);
bootStream.CopyTo(fileStream);
fileStream.Write(file, 0, (int)bootStream.Length);
}
}
long destinationLength = new FileInfo(destinationfile).Length;
if (fileLength != destinationLength)
{
Console.WriteLine("[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength);
}
else
{
Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", filepath, destinationfile);
}
}
else
{
Console.WriteLine("\r\n [!] File {0} can not be found", filepath);
}
}
catch (Exception ex)
{
Console.WriteLine("\r\n [!] An exception occured: {0}", ex);
Environment.Exit(1);
throw;
}
}
}
else
{
try
{
NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open());
if (vhdbNtfs.FileExists("\\\\" + filepath))
{
//vhdbNtfs.CopyFile();
long fileLength = vhdbNtfs.GetFileLength("\\\\" + filepath);
using (Stream bootStream = vhdbNtfs.OpenFile("\\\\" + filepath, FileMode.Open, FileAccess.Read))
{
byte[] file = new byte[bootStream.Length];
int totalRead = 0;
while (totalRead < file.Length)
{
totalRead += bootStream.Read(file, totalRead, file.Length - totalRead);
FileStream fileStream = File.Create(destinationfile, (int)bootStream.Length);
bootStream.CopyTo(fileStream);
fileStream.Write(file, 0, (int)bootStream.Length);
}
}
long destinationLength = new FileInfo(destinationfile).Length;
if (fileLength != destinationLength)
{
Console.WriteLine("[!] Something went wrong. Source file has size {0} and destination file has size {1}", fileLength, destinationLength);
}
else
{
Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", filepath, destinationfile);
}
}
else
{
Console.WriteLine("\r\n [!] File {0} can not be found", filepath);
}
}
catch (Exception ex)
{
Console.WriteLine("\r\n [!] An exception occured: {0}", ex);
Environment.Exit(1);
throw;
}
}
}
}
catch (Exception ex)
{
Console.WriteLine("\r\n [!] An exception occured: {0}", ex);
Environment.Exit(1);
throw;
}
}
else
{
Console.WriteLine("\r\n [!] The provided VMDK image does not exist / can not be accessed or the destination folder does not exist");
}
}
public static void GetDirListing(string DiskPath, string directory)
{
if (File.Exists(DiskPath))
{
try
{
VolumeManager volMgr = new VolumeManager();
VirtualDisk vhdx = VirtualDisk.OpenDisk(DiskPath, FileAccess.Read);
volMgr.AddDisk(vhdx);
VolumeInfo volInfo = null;
if (vhdx.Partitions.Count > 1)
{
Console.WriteLine("\r\n[*] Target has more than one partition\r\n");
foreach (var physVol in volMgr.GetPhysicalVolumes())
{
Console.WriteLine(" Identity: " + physVol.Identity);
Console.WriteLine(" Type: " + physVol.VolumeType);
Console.WriteLine(" Disk Id: " + physVol.DiskIdentity);
Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8"));
Console.WriteLine(" Part Id: " + physVol.PartitionIdentity);
Console.WriteLine(" Length: " + physVol.Length + " bytes");
Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry);
Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector);
Console.WriteLine();
if (!string.IsNullOrEmpty(physVol.Identity))
{
volInfo = volMgr.GetVolume(physVol.Identity);
}
using (NtfsFileSystem vhdbNtfs = new NtfsFileSystem(physVol.Partition.Open()))
{
if (vhdbNtfs.DirectoryExists("\\\\" + directory))
{
string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory);
string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory);
foreach (var file in filelist)
{
Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file));
}
foreach (var dir in dirlist)
{
Console.WriteLine("[D] {0}", dir);
}
}
else
{
Console.WriteLine("\r\n[*] Directory does not exist in partition {0}\r\n",
physVol.Identity);
}
}
}
}
else //No partitions
{
Console.WriteLine("\r\n[*] Found only one partition\r\n");
Console.WriteLine("LOGICAL VOLUMES");
foreach (var logVol in volMgr.GetLogicalVolumes())
{
Console.WriteLine(" Identity: " + logVol.Identity);
Console.WriteLine(" Length: " + logVol.Length + " bytes");
Console.WriteLine(" Disk Geometry: " + logVol.PhysicalGeometry);
Console.WriteLine(" First Sector: " + logVol.PhysicalStartSector);
Console.WriteLine();
}
using (NtfsFileSystem vhdbNtfs = new NtfsFileSystem(vhdx.Partitions[0].Open()))
{
if (vhdbNtfs.DirectoryExists("\\\\" + directory))
{
string[] filelist = vhdbNtfs.GetFiles(vhdbNtfs.Root.FullName + directory);
string[] dirlist = vhdbNtfs.GetDirectories(vhdbNtfs.Root.FullName + directory);
foreach (var file in filelist)
{
Console.WriteLine("[F] {0} {1}", file, vhdbNtfs.GetFileLength(file));
}
foreach (var dir in dirlist)
{
Console.WriteLine("[D] {0}", dir);
}
}
else
{
Console.WriteLine("\r\n[*] Directory does not exist");
}
}
}
}
catch (Exception ex)
{
Console.WriteLine("Exception {0}", ex);
}
}
}
public static void GetFile(string DiskPath, string FilePath, string DestinationFile)
{
if (File.Exists(DiskPath) && Directory.Exists(Path.GetDirectoryName(DestinationFile)))
{
if (Path.GetFileName(DestinationFile) == "")
{
DestinationFile += Path.GetFileName(FilePath);
}
VolumeManager volMgr = new VolumeManager();
VirtualDisk disk = VirtualDisk.OpenDisk(DiskPath, FileAccess.Read);
volMgr.AddDisk(disk);
VolumeInfo volInfo = null;
if (disk.Partitions.Count > 1)
{
Console.WriteLine("\r\n[*] Target has more than one partition\r\n");
foreach (var physVol in volMgr.GetPhysicalVolumes())
{
Console.WriteLine(" Identity: " + physVol.Identity);
Console.WriteLine(" Type: " + physVol.VolumeType);
Console.WriteLine(" Disk Id: " + physVol.DiskIdentity);
Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8"));
Console.WriteLine(" Part Id: " + physVol.PartitionIdentity);
Console.WriteLine(" Length: " + physVol.Length + " bytes");
Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry);
Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector);
Console.WriteLine();
if (!string.IsNullOrEmpty(physVol.Identity))
{
volInfo = volMgr.GetVolume(physVol.Identity);
}
DiscUtils.FileSystemInfo fsInfo = FileSystemManager.DetectFileSystems(volInfo)[0];
using (NtfsFileSystem diskntfs = new NtfsFileSystem(physVol.Partition.Open()))
{
if (diskntfs.FileExists("\\\\" + FilePath))
{
long fileLength = diskntfs.GetFileLength("\\\\" + FilePath);
using (Stream bootStream = diskntfs.OpenFile("\\\\" + FilePath, FileMode.Open,
FileAccess.Read))
{
byte[] file = new byte[bootStream.Length];
int totalRead = 0;
while (totalRead < file.Length)
{
totalRead += bootStream.Read(file, totalRead, file.Length - totalRead);
FileStream fileStream =
File.Create(DestinationFile, (int)bootStream.Length);
bootStream.CopyTo(fileStream);
fileStream.Write(file, 0, (int)bootStream.Length);
}
long destinationLength = new FileInfo(DestinationFile).Length;
if (fileLength != destinationLength)
{
Console.WriteLine(
"[!] Something went wrong. Source file has size {0} and destination file has size {1}",
fileLength, destinationLength);
}
else
{
Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}",
FilePath, DestinationFile);
}
}
}
else
{
Console.WriteLine("\r\n [!] File {0} can not be found", FilePath);
}
}
}
}
else
{
foreach (var physVol in volMgr.GetPhysicalVolumes())
{
Console.WriteLine(" Identity: " + physVol.Identity);
Console.WriteLine(" Type: " + physVol.VolumeType);
Console.WriteLine(" Disk Id: " + physVol.DiskIdentity);
Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8"));
Console.WriteLine(" Part Id: " + physVol.PartitionIdentity);
Console.WriteLine(" Length: " + physVol.Length + " bytes");
Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry);
Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector);
Console.WriteLine();
NtfsFileSystem diskntfs = new NtfsFileSystem(disk.Partitions[0].Open());
if (diskntfs.FileExists("\\\\" + FilePath))
{
long fileLength = diskntfs.GetFileLength("\\\\" + FilePath);
using (Stream bootStream =
diskntfs.OpenFile("\\\\" + FilePath, FileMode.Open, FileAccess.Read))
{
byte[] file = new byte[bootStream.Length];
int totalRead = 0;
while (totalRead < file.Length)
{
totalRead += bootStream.Read(file, totalRead, file.Length - totalRead);
FileStream fileStream = File.Create(DestinationFile, (int)bootStream.Length);
bootStream.CopyTo(fileStream);
fileStream.Write(file, 0, (int)bootStream.Length);
}
}
long destinationLength = new FileInfo(DestinationFile).Length;
if (fileLength != destinationLength)
{
Console.WriteLine(
"[!] Something went wrong. Source file has size {0} and destination file has size {1}",
fileLength, destinationLength);
}
else
{
Console.WriteLine("\r\n[*] File {0} was successfully copied to {1}", FilePath,
DestinationFile);
}
}
else
{
Console.WriteLine("\r\n [!] File {0} can not be found", FilePath);
}
}
}
}
else
{
Console.WriteLine(
"\r\n [!] The provided VMDK image does not exist / can not be accessed or the destination folder does not exist");
}
}
