private static unsafe void InterpretActivePartitions()
{
byte *sector = null;
byte *mftRecord = null;
try {
foreach (GenericPartition partition in _partitionManager.EnumeratePartitions())
{
if (!partition.ShouldCapture)
{
continue;
}
NtfsPartition ntfsPartition = partition as NtfsPartition;
NtfsPartition.Current = ntfsPartition;
if (null == ntfsPartition)
{
throw new NotSupportedException();
}
ntfsPartition.InterpretBootSector();
ntfsPartition.CaptureMetadataFilePointers();
}
return;
}
finally {
if (null != mftRecord)
{
Marshal.FreeCoTaskMem((IntPtr)mftRecord);
}
if (null != sector)
{
Marshal.FreeCoTaskMem((IntPtr)sector);
}
}
}
/// <summary></summary>
/// <remarks>The Update Sequence Array (usa) is an array of the short values which
/// belong to the end of each sector protected by the update sequence record in which
/// this array is contained. Note that the first entry is the Update Sequence Number
/// (usn), a cyclic counter of how many times the protected record has been written
/// to disk. The values 0 and -1 (ie. 0xffff) are not used. All last short's of each
/// sector have to be equal to the usn (during reading) or are set to it (during
/// writing). If they are not, an incomplete multi sector transfer has occurred when
/// the data was written.
/// The maximum size for the update sequence array is fixed to:
/// maximum size = usa_ofs + (usa_count * 2) = 510 bytes
/// The 510 bytes comes from the fact that the last short in the array has to
/// (obviously) finish before the last short of the first 512 - byte sector.
/// This formula can be used as a consistency check in that usa_ofs + (usa_count * 2)
/// has to be less than or equal to 510.</remarks>
internal unsafe void ApplyFixups()
{
// TODO : Should track already fixed records otherwise we encounter spurious fixup
// mismatches. Tracked record should be reset on Disposal.
NtfsPartition partition = NtfsPartition.Current;
uint bytesPerSector = partition.BytesPerSector;
uint sectorsPerCluster = partition.SectorsPerCluster;
ushort fixupCount = UsaCount;
fixed(NtfsRecord *nativeRecord = &this)
{
// Check magic number on every sector.
byte * fixLocation = (byte *)nativeRecord + bytesPerSector - sizeof(ushort);
ushort *pFixup = (ushort *)((byte *)nativeRecord + UsaOffset);
ushort fixupTag = *(pFixup++);
for (int sectorIndex = 0; sectorIndex < fixupCount; sectorIndex++, fixLocation += bytesPerSector)
{
ushort fixedValue = *((ushort *)fixLocation);
if (fixedValue != fixupTag)
{
Console.WriteLine("WARNING : fixup tag mismatch.");
}
}
// Apply those fixups that are defined.
fixLocation = (byte *)nativeRecord + bytesPerSector - sizeof(ushort);
pFixup = (ushort *)((byte *)nativeRecord + UsaOffset);
pFixup++; // Skip fixup tag.
for (int sectorIndex = 0; sectorIndex < fixupCount; sectorIndex++, fixLocation += bytesPerSector)
{
*((ushort *)fixLocation) = *(pFixup++);
}
}
}
internal static unsafe NtfsFileRecord *Create(ulong fileId)
{
if ((0xFFFFFFFFFFFF & fileId) != fileId)
{
throw new ArgumentException();
}
NtfsPartition partition = NtfsPartition.Current;
ulong mftEntrySize = partition.ClusterSize / partition.MFTEntryPerCluster;
ulong clusterId = fileId / partition.MFTEntryPerCluster;
ulong inClusterOffset = (fileId % partition.MFTEntryPerCluster) * mftEntrySize;
IPartitionClusterData clusterData = partition.ReadSectors(clusterId * partition.SectorsPerCluster,
partition.SectorsPerCluster);
return((NtfsFileRecord *)(clusterData.Data + inClusterOffset));
}
internal unsafe void EnumerateRecordAttributes(NtfsPartition owner, ulong recordLBA,
ref byte *buffer, RecordAttributeEnumeratorCallbackDelegate callback,
NtfsAttributeType searchedType = NtfsAttributeType.Any,
AttributeNameFilterDelegate nameFilter = null)
{
using (IPartitionClusterData data = owner.ReadSectors(recordLBA)) {
buffer = data.Data;
NtfsFileRecord *header = (NtfsFileRecord *)buffer;
header->AssertRecordType();
if (1024 < header->BytesAllocated)
{
throw new NotImplementedException();
}
EnumerateRecordAttributes(header, callback, searchedType, nameFilter);
}
}
internal static unsafe NtfsMFTFileRecord Create(NtfsPartition owner, byte *rawData)
{
if (null == owner)
{
throw new ArgumentNullException();
}
if (_gcPreventer.ContainsKey(owner))
{
throw new InvalidOperationException();
}
NtfsMFTFileRecord result = new NtfsMFTFileRecord(rawData);
result.AssertNoOverflowingAttribute();
_gcPreventer.Add(owner, result);
return(result);
}
private unsafe void _Run()
{
NtfsPartition partition = Partition;
IPartitionClusterData clusterData = null;
try {
NtfsFileRecord *fileRecord = partition.GetFileRecord(
NtfsWellKnownMetadataFiles.LogFile, out clusterData);
fileRecord->AssertRecordType();
throw new NotImplementedException();
}
finally {
if (null != clusterData)
{
clusterData.Dispose();
}
}
}
internal static unsafe GenericPartition Create(IntPtr partitionHandle, byte *buffer, uint offset)
{
byte partitionType = buffer[offset + 4];
bool hiddenPartition = false;
bool activePartition = (0x80 == buffer[offset]);
uint startSector = *((uint *)(buffer + offset + 8));
uint sectorsCount = *((uint *)(buffer + offset + 12));
GenericPartition result = null;
// See : https://en.wikipedia.org/wiki/Partition_type
switch (partitionType)
{
case 0x00:
// Empty entry.
return(null);
case 0x07:
// TODO : Consider using a mapping that restrict viewing to the partition content.
result = new NtfsPartition(partitionHandle, hiddenPartition, startSector, sectorsCount);
break;
case 0x17:
// TODO : Should differentiate 0x17 & 0x27
hiddenPartition = true;
goto case 0x07;
case 0x27:
// See https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt
// See https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-biosmbr-based-hard-drive-partitions
// See https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-and-gpt-faq
hiddenPartition = true;
goto case 0x07;
default:
Console.WriteLine("unsupported partition type 0x{0:X2}.", partitionType);
return(null);
}
if (null != result)
{
result.Active = activePartition;
}
return(result);
}
public static unsafe int Main(string[] args)
{
InstallExceptionHandlers();
using (PartitionDataDisposableBatch mainBatch = PartitionDataDisposableBatch.CreateNew()) {
DisplayVersion();
IntPtr handle = IntPtr.Zero;
int nativeError;
DiskGeometry geometry = new DiskGeometry();
try {
handle = Natives.CreateFile2(@"\\.\PhysicalDrive0", 0x80000000 /* GENERIC_READ */,
0x02 /* FILE_SHARE_WRITE */, 3 /* OPEN_EXISTING */, IntPtr.Zero);
nativeError = Marshal.GetLastWin32Error();
if ((IntPtr.Zero == handle) || (0 != nativeError))
{
Console.WriteLine("Physical drive opening failed. Error 0x{0:X8}", nativeError);
return(1);
}
geometry.Acquire(handle);
_partitionManager = new PartitionManager(handle, geometry);
_partitionManager.Discover();
InterpretActivePartitions();
if (FeaturesContext.InvariantChecksEnabled)
{
NtfsMFTFileRecord.AssertMFTRecordCachingInvariance(_partitionManager);
}
// TODO : Configure TrackedPartitionIndex from command line arguments.
foreach (GenericPartition partition in _partitionManager.EnumeratePartitions())
{
if (!partition.ShouldCapture)
{
continue;
}
NtfsPartition ntfsPartition = partition as NtfsPartition;
NtfsPartition.Current = ntfsPartition;
// Basic functionnality tests. Don't remove.
//ntfsPartition.CountFiles();
//ntfsPartition.MonitorBadClusters();
//ntfsPartition.ReadBitmap();
// Dump bad clusters.
ntfsPartition.DumpBadClusters();
// Dump UsnJournal
PrototypeUsnJournal();
new NtfsUsnJournalReader(ntfsPartition).Run();
// Dump LogFile
// new NtfsLogFileReader(ntfsPartition).Run();
// Locate file.
// string fileName = @"TEMP\AsciiTes.txt";
string fileName = @"$Extend\$UsnJrnl";
NtfsIndexEntryHeader *fileDescriptor = ntfsPartition.FindFile(fileName);
if (null == fileDescriptor)
{
throw new System.IO.FileNotFoundException(fileName);
}
IPartitionClusterData fileData = null;
NtfsFileRecord * usnJournalFileRecord =
ntfsPartition.GetFileRecord(fileDescriptor->FileReference, ref fileData);
if ((null == usnJournalFileRecord) || (null == fileData))
{
throw new ApplicationException();
}
try {
usnJournalFileRecord->EnumerateRecordAttributes(
delegate(NtfsAttribute * attribute, Stream dataStream) {
attribute->Dump();
return(true);
});
// For debugging purpose.
// fileRecord->BinaryDumpContent();
// TODO : Do something with the file.
}
finally {
if (null != fileData)
{
fileData.Dispose();
}
}
}
return(0);
}
finally {
if (IntPtr.Zero == handle)
{
Natives.CloseHandle(handle);
handle = IntPtr.Zero;
}
}
}
}
private static unsafe void PrototypeUsnJournal()
{
List <Tuple <uint, ulong> > records = new List <Tuple <uint, ulong> >()
{
new Tuple <uint, ulong>(0x00000000, 0x10000000417F8),
new Tuple <uint, ulong>(0x00831030, 0x133000000030345),
new Tuple <uint, ulong>(0x00835CE0, 0x79200000000288E),
new Tuple <uint, ulong>(0x00839E60, 0x16C0000000059EB),
new Tuple <uint, ulong>(0x00842DE0, 0x7340000000057C6),
new Tuple <uint, ulong>(0x00844160, 0x600000018405F),
new Tuple <uint, ulong>(0x0084A215, 0x8F000000036956),
new Tuple <uint, ulong>(0x0084EF80, 0x2B0000000020AD),
new Tuple <uint, ulong>(0x00852F71, 0x3D00000000024B8),
new Tuple <uint, ulong>(0x00857E50, 0x50B000000007274),
new Tuple <uint, ulong>(0x00858DB0, 0x235000000000705),
new Tuple <uint, ulong>(0x0085CD90, 0xD20000000086D7),
new Tuple <uint, ulong>(0x00860A90, 0x7900000000840C),
new Tuple <uint, ulong>(0x00862160, 0x6E500000002FC3E),
new Tuple <uint, ulong>(0x00868190, 0x7F000000004050),
new Tuple <uint, ulong>(0x0086C570, 0x49E000000003C3E),
new Tuple <uint, ulong>(0x0086D8F0, 0x160000000F353D),
new Tuple <uint, ulong>(0x00871DB0, 0x9D000000004053),
new Tuple <uint, ulong>(0x00875B90, 0x19F000000001DD5),
new Tuple <uint, ulong>(0x00877B0C, 0x387000000031EA2),
new Tuple <uint, ulong>(0x0087BE50, 0x840000000041B7),
new Tuple <uint, ulong>(0x00883CC0, 0x2C4000000006741),
new Tuple <uint, ulong>(0x00888210, 0x93000000007190),
new Tuple <uint, ulong>(0x00889710, 0xF30000000DD118),
new Tuple <uint, ulong>(0x0089759B, 0xA2B000000006C37),
new Tuple <uint, ulong>(0x0089F050, 0xD400000002EF59),
new Tuple <uint, ulong>(0x008A3480, 0x4000000030266),
new Tuple <uint, ulong>(0x008A4780, 0x3D000000122430),
new Tuple <uint, ulong>(0x008A8FF0, 0x4A0000000F8276),
new Tuple <uint, ulong>(0x008ACDF0, 0x7000000030267),
new Tuple <uint, ulong>(0x008B1FF0, 0xF000000030265),
new Tuple <uint, ulong>(0x008B32F2, 0x10000001E9963),
new Tuple <uint, ulong>(0x008B7272, 0x5000000030269),
new Tuple <uint, ulong>(0x008BB022, 0x6000000030268),
new Tuple <uint, ulong>(0x008BC2A0, 0xC000000121FED),
new Tuple <uint, ulong>(0x008C4B70, 0x3700000016AC1D),
new Tuple <uint, ulong>(0x008CEDF0, 0x5000000184830),
new Tuple <uint, ulong>(0x008DEAD0, 0x1D0000000004401),
new Tuple <uint, ulong>(0x008E2D20, 0x3B400000000157B),
new Tuple <uint, ulong>(0x008E4120, 0x3DC0000000045DC),
new Tuple <uint, ulong>(0x008E8FC0, 0x2800000000E8AE),
new Tuple <uint, ulong>(0x008F123D, 0x52F0000000010F0),
new Tuple <uint, ulong>(0x008F72F0, 0x147000000033E17),
new Tuple <uint, ulong>(0x008FB610, 0x5A0000000305FD),
new Tuple <uint, ulong>(0x008FCA00, 0x144000000003871),
new Tuple <uint, ulong>(0x00901140, 0x1E2000000033E33),
new Tuple <uint, ulong>(0x009054B0, 0x29000000033E34),
new Tuple <uint, ulong>(0x00906AB0, 0x3420000000035B2),
new Tuple <uint, ulong>(0x0090B250, 0xD7000000004C47),
new Tuple <uint, ulong>(0x0090F710, 0xA9000000005C58),
new Tuple <uint, ulong>(0x00913660, 0xC9000000002451),
new Tuple <uint, ulong>(0x0091A1E0, 0xA8000000004E3B),
new Tuple <uint, ulong>(0x009280D4, 0x2920000000DD0CA),
new Tuple <uint, ulong>(0x0092C280, 0x276000000031B0A),
new Tuple <uint, ulong>(0x00934D30, 0x6F0000000F179E),
new Tuple <uint, ulong>(0x0093B220, 0xB20000000D3A3F),
new Tuple <uint, ulong>(0x0093F0C4, 0x5400000002BC62),
new Tuple <uint, ulong>(0x00940380, 0xA7000000004A8C),
new Tuple <uint, ulong>(0x00945C6F, 0x6F000000008D46),
new Tuple <uint, ulong>(0x0094C310, 0x3A0000000D9AA7),
new Tuple <uint, ulong>(0x00954910, 0x4C0000000D9A91)
};
NtfsPartition partition = NtfsPartition.Current;
ulong mftEntrySize = partition.ClusterSize / partition.MFTEntryPerCluster;
IPartitionClusterData data = null;
try {
ulong baseFileRecord = 0;
foreach (Tuple <uint, ulong> record in records)
{
ulong fileReference = record.Item2;
NtfsFileRecord *fileRecord = partition.GetFileRecord(fileReference, ref data);
if (0 == baseFileRecord)
{
baseFileRecord = fileRecord->BaseFileRecord;
}
if (fileRecord->BaseFileRecord != baseFileRecord)
{
fileRecord->BinaryDump();
fileRecord->Dump();
throw new ApplicationException();
}
fileRecord->EnumerateRecordAttributes(delegate(NtfsAttribute * value, Stream attributeDataStream) {
if (null != attributeDataStream)
{
throw new NotSupportedException();
}
if (value->IsResident)
{
throw new NotSupportedException();
}
IClusterStream dataStream = (IClusterStream)((NtfsNonResidentAttribute *)value)->OpenDataClusterStream();
dataStream.SeekToNextNonEmptyCluster();
NtfsUsnJournalReader.UsnRecordV2 *currentUsnRecord = null;
while (true)
{
using (IPartitionClusterData clusterData = dataStream.ReadNextCluster()) {
if (null == clusterData)
{
// Done with this stream.
return(true);
}
for (uint offset = 0; offset < clusterData.DataSize; offset += currentUsnRecord->RecordLength)
{
currentUsnRecord = (NtfsUsnJournalReader.UsnRecordV2 *)(clusterData.Data + offset);
if (0 == currentUsnRecord->RecordLength)
{
break;
}
if (2 != currentUsnRecord->MajorVersion)
{
Helpers.BinaryDump((byte *)currentUsnRecord,
(uint)Marshal.SizeOf <NtfsUsnJournalReader.UsnRecordV2>());
throw new NotSupportedException();
}
if (0 != currentUsnRecord->MinorVersion)
{
throw new NotSupportedException();
}
currentUsnRecord->Dump();
}
}
}
},
NtfsAttributeType.AttributeData, null);
fileRecord->DumpAttributes();
}
return;
}
finally {
if (null != data)
{
data.Dispose();
}
}
}
internal NtfsLogFileReader(NtfsPartition partition)
{
Partition = partition ?? throw new ArgumentNullException("partition");
}
/// <summary>Enumerate attributes bound to this <see cref="NtfsFileRecord"/>, optionally filtering
/// on attribute name.</summary>
/// <param name="header">The file record.</param>
/// <param name="callback"></param>
/// <param name="searchedAttributeType"></param>
/// <param name="nameFilter">An optional name filter that will be provided with the basic attribute
/// properties (including name) in order to decide if data should be retrieved. This is especially
/// usefull for <see cref="NtfsAttributeListAttribute"/> attributes that may reference lengthy
/// attributes data which are expensive to retrieve.</param>
internal static unsafe void EnumerateRecordAttributes(NtfsFileRecord *header,
RecordAttributeEnumeratorCallbackDelegate callback, NtfsAttributeType searchedAttributeType,
AttributeNameFilterDelegate nameFilter)
{
// Walk attributes, seeking for the searched one.
NtfsAttribute *currentAttribute = (NtfsAttribute *)((byte *)header + header->AttributesOffset);
NtfsAttributeListAttribute *pendingAttributeList = null;
NtfsAttribute *[] candidates = new NtfsAttribute *[MaxAttributeCount];
int candidatesCount = 0;
for (int attributeIndex = 0; attributeIndex < header->NextAttributeNumber; attributeIndex++)
{
if (currentAttribute->IsLast)
{
break;
}
if (header->BytesInUse < ((byte *)currentAttribute - (byte *)header))
{
break;
}
if (NtfsAttributeType.EndOfListMarker == currentAttribute->AttributeType)
{
break;
}
// If we found an AttributeListAttribute, we must go one level deeper to
// complete the enumeration.
if (NtfsAttributeType.AttributeAttributeList == currentAttribute->AttributeType)
{
if (null != pendingAttributeList)
{
// No more than one attribute of this kind per file record.
throw new ApplicationException();
}
if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType)
{
if (!callback(currentAttribute, null))
{
return;
}
}
// Defer handling
pendingAttributeList = (NtfsAttributeListAttribute *)currentAttribute;
break;
}
if (candidatesCount >= MaxAttributeCount)
{
throw new ApplicationException();
}
if ((NtfsAttributeType.Any == searchedAttributeType) ||
(currentAttribute->AttributeType == searchedAttributeType))
{
candidates[candidatesCount++] = currentAttribute;
}
currentAttribute = (NtfsAttribute *)((byte *)currentAttribute + currentAttribute->Length);
}
if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType)
{
// Either we already found one such attribute and invoked the callback or found none and
// we can return immediately. Should we have found several such attributes we would have
// risen an exception.
return;
}
if (null == pendingAttributeList)
{
// We already walked every attributes and captured those that matched the type filter if
// any. Invoke callbak on each such attribute.
for (int candidateIndex = 0; candidateIndex < candidatesCount; candidateIndex++)
{
if (!callback(candidates[candidateIndex], null))
{
return;
}
}
// We are done.
return;
}
NtfsAttributeListAttribute.Dump(pendingAttributeList);
// HandleAttributeListAttributeEntry
// We have an attribute list attribute. Delegate him the enumeration.
NtfsPartition currentPartition = NtfsPartition.Current;
NtfsAttributeListAttribute.EnumerateEntries((NtfsAttribute *)pendingAttributeList, searchedAttributeType,
new ListEntryHandler(searchedAttributeType, nameFilter, callback).HandleListEntry);
return;
}
private unsafe void _Run()
{
NtfsPartition partition = Partition;
IPartitionClusterData clusterData = null;
try {
// Note : We could also use the NtfsWellKnownMetadataFiles.Extend entry to
// locate the directory, then find the $UsnJrnl entry directly from there.
string fileName = @"$UsnJrnl";
NtfsIndexEntryHeader *fileDescriptor = partition.FindFile(fileName, NtfsWellKnownMetadataFiles.Extend);
if (null == fileDescriptor)
{
throw new System.IO.FileNotFoundException(fileName);
}
IPartitionClusterData fileData = null;
try {
NtfsFileRecord *fileRecord =
partition.GetFileRecord(fileDescriptor->FileReference, ref fileData);
fileRecord->AssertRecordType();
// We retrieve the first attribute here.
Stream dataStream;
NtfsAttribute *jAttribute = fileRecord->GetAttribute(NtfsAttributeType.AttributeData,
out dataStream, 1, _isDollarJAttributeNameFilter);
if (null == jAttribute)
{
throw new ApplicationException();
}
if (jAttribute->IsResident)
{
// Seems this is never the case.
throw new NotSupportedException("CODE REVIEW REQUIRED");
}
NtfsNonResidentAttribute *jNrAttribute = (NtfsNonResidentAttribute *)jAttribute;
jNrAttribute->Dump();
byte[] buffer = new byte[NtfsPartition.Current.ClusterSize];
DateTime sparseReadStartTime = DateTime.UtcNow;
TimeSpan sparseReadDuration;
if (null == dataStream)
{
dataStream = jNrAttribute->OpenDataStream();
throw new ApplicationException("CODE REVIEW REQUIRED");
}
int totalReads = 0;
bool nonNullByteFound = false;
while (true)
{
int readCount = dataStream.Read(buffer, 0, buffer.Length);
if (-1 == readCount)
{
sparseReadDuration = DateTime.UtcNow - sparseReadStartTime;
break;
}
if (nonNullByteFound)
{
for (int index = 0; index < readCount; index++)
{
if (0 == buffer[index])
{
continue;
}
sparseReadDuration = DateTime.UtcNow - sparseReadStartTime;
Console.WriteLine("{0} null leading bytes found after {1} secs.",
totalReads + index, (int)sparseReadDuration.TotalSeconds);
nonNullByteFound = true;
break;
}
}
totalReads += readCount;
if (nonNullByteFound)
{
Helpers.BinaryDump(buffer, (uint)readCount);
}
}
if (!nonNullByteFound)
{
sparseReadDuration = DateTime.UtcNow - sparseReadStartTime;
Console.WriteLine("{0} null leading bytes found after {1} secs.",
totalReads, (int)sparseReadDuration.TotalSeconds);
}
throw new NotImplementedException();
NtfsAttribute *rawAttribute =
fileRecord->GetAttribute(NtfsAttributeType.AttributeData, out dataStream, 1);
if (null == rawAttribute)
{
throw new ApplicationException();
}
if ("$Max" != rawAttribute->Name)
{
throw new ApplicationException();
}
if (rawAttribute->IsResident)
{
NtfsResidentAttribute *reMaxAttribute = (NtfsResidentAttribute *)rawAttribute;
if (FeaturesContext.InvariantChecksEnabled)
{
if (0x20 != reMaxAttribute->ValueLength)
{
throw new ApplicationException();
}
}
MaxAttribute *maxAttribute = (MaxAttribute *)((byte *)reMaxAttribute + reMaxAttribute->ValueOffset);
}
else
{
throw new NotSupportedException();
}
rawAttribute = fileRecord->GetAttribute(NtfsAttributeType.AttributeData, out dataStream, 2);
if (null == rawAttribute)
{
throw new ApplicationException();
}
if ("$J" != rawAttribute->Name)
{
throw new ApplicationException();
}
throw new NotImplementedException();
}
finally {
if (null != fileData)
{
fileData.Dispose();
}
}
}
finally {
if (null != clusterData)
{
clusterData.Dispose();
}
}
}
internal NtfsUsnJournalReader(NtfsPartition partition)
{
Partition = partition ?? throw new ArgumentNullException("partition");
}
/// <summary>The caller enumerating entries might be interested in the content of
/// the currently scanned entry. This might be either for additional filtering at
/// attribute level (including attribute name) or for full attribute data processing.
/// </summary>
/// <param name="entry">The scanned list entry of interest. Should a single
/// attribute span several entries, this one is guaranteed to be the first one for the
/// attribute.</param>
/// <param name="remainingBytesInList">Number of bytes remaining in list, relatively to the
/// entry address.</param>
/// <param name="entryReferencedAttributeHandler">The callback that will be invoked
/// with the referenced attribute with or without full attribute data depending on
/// the value of <paramref name="dataIncluded"/></param>
/// <param name="dataIncluded"></param>
/// <returns>true if caller should continue process data, false if it should stop.</returns>
private static unsafe bool HandleEntryReferencedAttribute(ListEntry *entry, uint remainingBytesInList,
EntryListReferencedAttributeHandlerDelegate entryReferencedAttributeHandler,
bool dataIncluded)
{
ushort currentAttributeNumber = entry->AttributeNumber;
NtfsAttributeType currentAttributeType = entry->AttributeType;
byte * baseAddress = (byte *)entry;
uint relativeOffset = 0;
// The last callback invocation decided it needs some more data before deciding
// what to do.
IPartitionClusterData clusterData = null;
NtfsPartition currentPartition = NtfsPartition.Current;
using (PartitionDataDisposableBatch batch = PartitionDataDisposableBatch.CreateNew()) {
while (true)
{
ListEntry * scannedEntry = (ListEntry *)baseAddress;
ulong mainFileReferenceNumber = entry->FileReferenceNumber;
List <ulong> entries = new List <ulong>();
Stream dataStream = null;
if (dataIncluded)
{
// Read each record and prepare for data retrieval.
while (true)
{
entries.Add(scannedEntry->FileReferenceNumber);
relativeOffset += scannedEntry->EntryLength;
if (relativeOffset >= remainingBytesInList)
{
// Take care not to go further than the end of the list.
break;
}
scannedEntry = (ListEntry *)(baseAddress + relativeOffset);
if ((currentAttributeNumber != scannedEntry->AttributeNumber) ||
(currentAttributeType != scannedEntry->AttributeType))
{
break;
}
}
dataStream = new MultiRecordAttributeDataStream(entries);
}
// Retrieve attribute itself.
NtfsFileRecord *mainFileRecord =
currentPartition.GetFileRecord(mainFileReferenceNumber, ref clusterData);
if (null == mainFileRecord)
{
throw new ApplicationException();
}
NtfsAttribute *retrievedAttribute =
(NtfsAttribute *)((byte *)mainFileRecord + mainFileRecord->AttributesOffset);
// Invoke callback.
bool retry;
if (!entryReferencedAttributeHandler(retrievedAttribute, dataStream, out retry))
{
// After attribute has been processed, it has been decided no other list
// entry should be performed.
return(false);
}
if (!retry)
{
// After attribute has been processed, it has been decided that no
// additional data from this attribute is required. However the enumeration
// of other list entries should continue.
return(true);
}
if (dataIncluded)
{
throw new InvalidOperationException();
}
// Attribute has been processed, however not enough data was available for a
// final decision. We loop and include all data now.
dataIncluded = true;
}
}
}
internal unsafe void EnumerateRecords(FileRecordEnumeratorDelegate callback)
{
Stream attributeData;
NtfsNonResidentAttribute *dataAttribute =
(NtfsNonResidentAttribute *)RecordBase->GetAttribute(
NtfsAttributeType.AttributeData, out attributeData);
if (null == dataAttribute)
{
throw new ApplicationException();
}
dataAttribute->AssertNonResident();
NtfsPartition partition = NtfsPartition.Current;
ulong clusterSize = partition.ClusterSize;
ulong mftRecordPerCluster = clusterSize / partition.MFTEntrySize;
ulong sectorsPerMFTRecord = partition.MFTEntrySize / partition.BytesPerSector;
if (FeaturesContext.InvariantChecksEnabled)
{
if (0 != (clusterSize % partition.MFTEntrySize))
{
throw new ApplicationException();
}
if (0 != (partition.MFTEntrySize % partition.BytesPerSector))
{
throw new ApplicationException();
}
}
ulong recordsPerCluster = clusterSize / NtfsFileRecord.RECORD_SIZE;
byte[] localBuffer = new byte[clusterSize];
Stream mftDataStream = dataAttribute->OpenDataStream();
try {
NtfsBitmapAttribute *bitmap = (NtfsBitmapAttribute *)RecordBase->GetAttribute(
NtfsAttributeType.AttributeBitmap, out attributeData);
if (null == bitmap)
{
throw new AssertionException("Didn't find the $MFT bitmap attribute.");
}
IEnumerator <bool> bitmapEnumerator = bitmap->GetContentEnumerator();
ulong recordIndex = 0;
while (bitmapEnumerator.MoveNext())
{
recordIndex++;
if (!bitmapEnumerator.Current)
{
continue;
}
ulong targetClusterIndex = mftRecordPerCluster / recordIndex;
ulong sectorIndexInCluster = (recordIndex % mftRecordPerCluster) * sectorsPerMFTRecord;
ulong targetPosition = targetClusterIndex * clusterSize;
if (long.MaxValue < targetPosition)
{
throw new ApplicationException();
}
mftDataStream.Seek((long)(targetPosition), SeekOrigin.Begin);
int readCount = mftDataStream.Read(localBuffer, 0, (int)clusterSize);
if (0 == readCount)
{
break;
}
if ((int)clusterSize != readCount)
{
throw new ApplicationException();
}
fixed(byte *nativeBuffer = localBuffer)
{
Helpers.BinaryDump(nativeBuffer, (uint)clusterSize);
byte *nativeRecord = nativeBuffer + (NtfsFileRecord.RECORD_SIZE * sectorIndexInCluster);
// TODO Make sure the result is inside the buffer.
if (!callback((NtfsFileRecord *)nativeRecord))
{
break;
}
}
}
if (null != mftDataStream)
{
mftDataStream.Close();
}
}
catch {
if (null != mftDataStream)
{
mftDataStream.Close();
}
throw;
}
}
