private void ScanMtf(ScanningState state, CancellationToken token)
{
Dictionary <uint, FileNodeIndexes> fileNodes = new Dictionary <uint, FileNodeIndexes>();
DriveInfo driveInfo = new DriveInfo(Path.GetPathRoot(state.RootPath));
using (NtfsReader ntfs = new NtfsReader(driveInfo, RetrieveMode.StandardInformations)) {
ReadMft(state, ntfs, fileNodes, token);
}
foreach (FileNodeIndexes indexes in fileNodes.Values)
{
FileNodeBase node = indexes.FileNode;
//if (node.Type == FileNodeType.File)
// document.Extensions.Include(node.Extension, node.Size);
if (indexes.NodeIndex == indexes.ParentNodeIndex)
{
// This must be a root
}
else if (fileNodes.TryGetValue(indexes.ParentNodeIndex, out var parentIndexes))
{
((FolderNode)parentIndexes.FileNode).AddChild(node,
ref parentIndexes.FileCollection, ref parentIndexes.SingleFile);
}
SuspendCheck();
if (token.IsCancellationRequested)
{
return;
}
}
}
private async void DrvCombo_SelectionChanged(object sender,
System.Windows.Controls.SelectionChangedEventArgs e)
{
if (DrvCombo.SelectedItem != null)
{
var driveToAnalyze = (DriveInfo)DrvCombo.SelectedItem;
DrvCombo.IsEnabled = false;
StatusTxt.Text = "Analyzing drive";
List <INode> nodes = null;
await Task.Factory.StartNew(() =>
{
var ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
nodes =
ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(n => (n.Attributes &
(Attributes.Hidden | Attributes.System |
Attributes.Temporary | Attributes.Device |
Attributes.Directory | Attributes.Offline |
Attributes.ReparsePoint | Attributes.SparseFile)) == 0)
.OrderByDescending(n => n.Size).ToList();
});
FilesList.ItemsSource = nodes;
_view = (CollectionView)CollectionViewSource.GetDefaultView(FilesList.ItemsSource);
DrvCombo.IsEnabled = true;
StatusTxt.Text = $"{nodes.Count} files listed. " +
$"Total size: {nodes.Sum(n => (double)n.Size):N0}";
}
else
{
_view = null;
}
}
//[PrincipalPermission(SecurityAction.Demand, Role = @"BUILTIN\Administrators")]
#endregion
public void ntfsread(IProgress <int> progress, IProgress <string> fase, bool update)
{
string[] drivetoscan = DiskInfo.listDrive().ToArray();
createDB(update);
SharedVar.listScore = getAllIndexProcess();
int i = 1;
foreach (string drive in drivetoscan)
{
progress?.Report(i * 100 / drivetoscan.Length - 1);
fase?.Report("Indexing Drive " + drive + ":\\ in progress. Please wait a few seconds.");
Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));
DriveInfo driveToAnalyze = new DriveInfo(drive);
NtfsReader ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(n => (n.Attributes &
(Attributes.Hidden | Attributes.System |
Attributes.Temporary | Attributes.Device |
Attributes.Directory | Attributes.Offline |
Attributes.ReparsePoint | Attributes.SparseFile)) == 0)
.OrderByDescending(n => n.Size);
ntfsReader.Dispose();
InsertNodes(nodes, driveToAnalyze, update);
i++;
}
}
private void ScanMtf(ScanningState state, CancellationToken token)
{
FileNodeIndexes[] fileItemsLookup;
List <FileNodeIndexes> fileItems = new List <FileNodeIndexes>();
DriveInfo driveInfo = new DriveInfo(Path.GetPathRoot(state.RootPath));
using (NtfsReader ntfs = new NtfsReader(driveInfo, RetrieveMode.StandardInformations)) {
fileItemsLookup = new FileNodeIndexes[ntfs.NodeCount];
ReadMft(state, ntfs, fileItemsLookup, fileItems, token);
}
foreach (FileNodeIndexes indexes in fileItems)
{
FileItemBase item = indexes.FileItem;
FileNodeIndexes parentIndexes = fileItemsLookup[indexes.ParentNodeIndex];
if (indexes.NodeIndex == indexes.ParentNodeIndex)
{
// This must be the drive root
}
else if (parentIndexes != null)
{
((FolderItem)parentIndexes.FileItem).AddItem(item,
ref parentIndexes.FileCollection, ref parentIndexes.FirstFile);
}
else
{
// This must be the root
}
if (AsyncChecks(token))
{
return;
}
}
}
private async Task <List <UserSpaceModel> > GetProfilesSizesAsync(string usersPath = "C:\\Users")
{
return(await Task.Run(() =>
{
var driveToAnalyze = new DriveInfo(Path.GetPathRoot(usersPath));
var trimmedUserPath = usersPath.Replace('/', '\\').Trim('"', '\\');
List <UserSpaceModel> nodes;
using (var ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.Minimal))
{
nodes = ntfsReader.GetNodes(usersPath)
.AsParallel()
.Where(node => (node.Attributes & Attributes.Directory) == 0)
.ToLookup(x => x.FullName
.Substring(trimmedUserPath.Length)
.Split('\\')
.ElementAtOrDefault(1) ?? ".")
.Where(x => !x.Key.Contains(".LOG", StringComparison.OrdinalIgnoreCase))
.OrderBy(x => x.Key)
.Select(gr => new UserSpaceModel
{
Username = gr.Key,
UsedSpaceBytes = gr.Aggregate <INode, ulong>(0, (a, c) => a + c.Size)
})
.ToList();
}
return nodes;
}));
}
private void bw_DoWork(object sender, DoWorkEventArgs e)
{
DriveInfo driveToAnalyze = new DriveInfo("c");
NtfsReader ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(driveToAnalyze.Name);
foreach (INode node in nodes)
{
ListViewItem lvi = new ListViewItem();
lvi.Tag = node;
lvi.Text = node.Name;
lvi.SubItems.Add(node.FullName);
lvi.SubItems.Add(node.Size.ToString());
lvi.SubItems.Add(node.LastChangeTime.ToString());
allItems.Add(lvi);
if (filecount++ % 1000 == 0)
{
bw.ReportProgress(filecount);
}
}
allItems.Sort((x, y) => string.Compare(x.Text, y.Text));
}
private void ReadMft(ScanningState state, NtfsReader ntfs, Dictionary <uint, FileNodeIndexes> fileNodes,
CancellationToken token)
{
foreach (INtfsNode node in ntfs.EnumerateNodes(state.RootPath))
{
string fullPath = PathUtils.TrimSeparatorDotEnd(node.FullName);
bool isRoot = (node.NodeIndex == node.ParentNodeIndex);
if (!isRoot && SkipFile(state, Path.GetFileName(fullPath), fullPath))
{
continue;
}
FileNodeBase child;
if (isRoot)
{
child = state.Root;
/*state.Root = new RootNode(document, node, IsSingle);
* child = state.Root;
* // Let the user know that the root was found
* SetupRoot(state.Root, rootSetup);*/
}
else if (node.Attributes.HasFlag(FileAttributes.Directory))
{
if (!state.IsDrive && state.RootPath == node.FullName.ToUpperInvariant())
{
child = state.Root;
/*state.Root = new RootNode(document, node, IsSingle);
* child = state.Root;
* // Let the user know that the root was found
* SetupRoot(state.Root, rootSetup);*/
}
else
{
child = new FolderNode(node);
}
}
else
{
FileNode file = new FileNode(node);
child = file;
if (!node.Attributes.HasFlag(FileAttributes.ReparsePoint))
{
state.ScannedSize += child.Size;
totalScannedSize += child.Size;
}
file.extRecord = extensions.Include(GetExtension(file.Name), child.Size);
}
fileNodes[node.NodeIndex] = new FileNodeIndexes(child, node);
SuspendCheck();
if (token.IsCancellationRequested)
{
return;
}
}
}
private async void BuildFileIndex()
{
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
_State = eState.NotReady;
string[] FixedDrives = GetFixedDriveNames();
List <Task> PrepareTasks = new List <Task>();
foreach (var FixedDrive in FixedDrives)
{
Task Prepare = Task.Run(() =>
{
try
{
LogStatics.Debug("begin analyze ntfs drive : {0}", FixedDrive);
DriveInfo driveToAnalyze = new DriveInfo(FixedDrive);
NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.Minimal);
IEnumerable <INode> nodes = ntfsReader.GetNodes(driveToAnalyze.Name);
return(nodes.ToArray());
}
catch (Exception ex)
{
LogStatics.Warn("failue analyze ntfs drive : {0} {1}", FixedDrive, ex);
}
finally
{
LogStatics.Debug("end analyze ntfs drive : {0}", FixedDrive);
}
return(null);
}).ContinueWith(task =>
{
try
{
LogStatics.Debug("begin build ntfs drive : {0}", FixedDrive);
BuildIndexDictionary(task.Result, ref _IndexDictionary);
}
catch (Exception ex)
{
LogStatics.Warn("failue build ntfs drive : {0} {1}", FixedDrive, ex);
}
finally
{
LogStatics.Debug("end build ntfs drive : {0}", FixedDrive);
}
});
PrepareTasks.Add(Prepare);
}
await Task.WhenAll(PrepareTasks);
GC.Collect();
_State = eState.Ready;
RaiseOnInitializeComplate();
LogStatics.Debug("file finder total file index build time {0} ms", (float)stopwatch.ElapsedTicks / TimeSpan.TicksPerMillisecond);
}
private IEnumerable <INode> GetAllNodesFromDrive()
{
DriveInfo driveToAnalyze = new DriveInfo(Path);
NtfsReader ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(driveToAnalyze.Name);
return(nodes);
}
private void ReadMft(ScanningState state, NtfsReader ntfs, FileNodeIndexes[] fileItemsLookup,
List <FileNodeIndexes> fileItems, CancellationToken token)
{
foreach (INtfsNode node in ntfs.EnumerateNodes(state.RootPath))
{
string fullPath = PathUtils.TrimSeparatorDotEnd(node.FullName);
bool isRoot = (node.NodeIndex == node.ParentNodeIndex);
if (!isRoot && SkipFile(state, Path.GetFileName(fullPath), fullPath))
{
continue;
}
FileItemBase child;
bool reparsePoint = node.Attributes.HasFlag(FileAttributes.ReparsePoint);
if (isRoot)
{
child = state.Root;
}
else if (node.Attributes.HasFlag(FileAttributes.Directory))
{
if (!state.IsDrive && state.RootPath == node.FullName.ToUpperInvariant())
{
child = state.Root;
}
else
{
child = new FolderItem(new ScanFileInfo(node));
}
}
else
{
ExtensionItem extension = Extensions.GetOrAddFromPath(node.Name);
FileItem file = new FileItem(new ScanFileInfo(node), extension);
child = file;
if (!reparsePoint)
{
TotalScannedSize += child.Size;
}
}
FileNodeIndexes indexes = new FileNodeIndexes(child, node);
fileItemsLookup[node.NodeIndex] = indexes;
if (!reparsePoint)
{
fileItems.Add(indexes);
}
if (AsyncChecks(token))
{
return;
}
}
}
private static IEnumerable <INode> GetFileNodes(DriveInfo driveToAnalyze)
{
var ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
return
(ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(n => (n.Attributes &
(Attributes.Hidden | Attributes.System |
Attributes.Temporary | Attributes.Device |
Attributes.Directory | Attributes.Offline |
Attributes.ReparsePoint | Attributes.SparseFile)) == 0));
}
public static IEnumerable <INode> EnumerateMft(DriveInfo driveToAnalyze)
{
NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(n => (n.Attributes &
(
NtfsNodeAttributes.Device
| NtfsNodeAttributes.Directory
| NtfsNodeAttributes.ReparsePoint
| NtfsNodeAttributes.SparseFile
)
) == 0); // This means that we DONT want any matches of the above NtfsNodeAttributes types.
//.OrderByDescending(n => n.Size);
return(nodes);
}
public static IEnumerable <INode> EnumerateFiles(ScanParameters parameters)
{
parameters.CancelToken.ThrowIfCancellationRequested();
StringBuilder currentPath = new StringBuilder(parameters.SelectedFolder);
string lastParent = currentPath.ToString();
string temp = currentPath.ToString();
if (temp.Contains(':') && (temp.Length == 2 || temp.Length == 3)) // Is a root directory, i.e. "C:" or "C:\"
{
lastParent = ".";
}
string drive = parameters.SelectedFolder[0].ToString().ToUpper();
List <DriveInfo> ntfsDrives = DriveInfo.GetDrives().Where(d => d.IsReady && d.DriveFormat == "NTFS").ToList();
DriveInfo driveToAnalyze = ntfsDrives.Where(dr => dr.Name.ToUpper().Contains(drive)).Single();
NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> mftNodes =
ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(node =>
(node.Attributes &
(NtfsNodeAttributes.Device
| NtfsNodeAttributes.Directory
| NtfsNodeAttributes.ReparsePoint
| NtfsNodeAttributes.SparseFile
)
) == 0) // This means that we DONT want any matches of the above NtfsNodeAttributes type
.Where(node => FileMatchesPattern(node.FullName, parameters.SearchPatterns));
if (parameters.SelectedFolder.ToCharArray().Length > 3)
{
string selectedFolderUppercase = parameters.SelectedFolder.ToUpperInvariant().TrimEnd(new char[] { '\\' });
mftNodes = mftNodes.Where(node => node.FullName.ToUpperInvariant().Contains(selectedFolderUppercase));
}
return(mftNodes);
}
static void Main(string[] args)
{
Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));
DriveInfo driveToAnalyze = new DriveInfo("c");
NtfsReader ntfsReader =
new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(driveToAnalyze.Name);
int directoryCount = 0, fileCount = 0;
foreach (INode node in nodes)
{
if ((node.Attributes & Attributes.Directory) != 0)
{
directoryCount++;
}
else
{
fileCount++;
}
}
Console.WriteLine(
string.Format(
"Directory Count: {0}, File Count {1}",
directoryCount,
fileCount
)
);
AnalyzeFragmentation(nodes, driveToAnalyze);
AnalyzeSimilarity(nodes, driveToAnalyze);
Console.ReadKey();
}
public List <DeletedFile> getFiles()
{
NtfsReader ntfsReader = new NtfsReader(this.DriveInfo, RetrieveMode.All);
IEnumerable <INode> nodes =
ntfsReader.GetNodes(this.DriveInfo.Name);
int directoryCount = 0, fileCount = 0;
this.DeletedFiles.Clear();
foreach (INode node in nodes)
{
if ((node.Attributes & Attributes.Directory) != 0)
{
directoryCount++;
}
else
{
this.DeletedFiles.Add(new DeletedFile(node.Name, node.FullName, node.CreationTime, node.LastChangeTime, node.LastAccessTime, node.Size));
fileCount++;
}
}
return(this.DeletedFiles);
}
private static FileEnumeratorReport Worker(FileEnumeratorParameters parameters)
{
TimingMetrics timingMetrics = new TimingMetrics();
FailSuccessCount fileEnumCount = new FailSuccessCount("OS files enumerated");
FailSuccessCount databaseInsertCount = new FailSuccessCount("OS database rows updated");
try
{
parameters.CancelToken.ThrowIfCancellationRequested();
StringBuilder currentPath = new StringBuilder(parameters.SelectedFolder);
string lastParent = currentPath.ToString();
string temp = currentPath.ToString();
if (temp.Contains(':') && (temp.Length == 2 || temp.Length == 3)) // Is a root directory, i.e. "C:" or "C:\"
{
lastParent = ".";
}
string drive = parameters.SelectedFolder[0].ToString().ToUpper();
timingMetrics.Start(TimingMetric.ParsingMFT);
List <DriveInfo> ntfsDrives = DriveInfo.GetDrives().Where(d => d.IsReady && d.DriveFormat == "NTFS").ToList();
DriveInfo driveToAnalyze = ntfsDrives.Where(dr => dr.Name.ToUpper().Contains(drive)).Single();
NtfsReader ntfsReader = new NtfsReader(driveToAnalyze, RetrieveMode.All);
IEnumerable <INode> mftNodes =
ntfsReader.GetNodes(driveToAnalyze.Name)
.Where(node => (node.Attributes &
(NtfsNodeAttributes.Device
| NtfsNodeAttributes.Directory
| NtfsNodeAttributes.ReparsePoint
| NtfsNodeAttributes.SparseFile
)) == 0) // This means that we DONT want any matches of the above NtfsNodeAttributes type
.Where(node => FileMatchesPattern(node.FullName, parameters.SearchPatterns));
//.OrderByDescending(n => n.Size);
if (parameters.SelectedFolder.ToCharArray().Length > 3)
{
string selectedFolderUppercase = parameters.SelectedFolder.ToUpperInvariant().TrimEnd(new char[] { '\\' });
mftNodes = mftNodes.Where(node => node.FullName.ToUpperInvariant().Contains(selectedFolderUppercase));
}
timingMetrics.Stop(TimingMetric.ParsingMFT);
IDataPersistenceLayer dataPersistenceLayer = parameters.DataPersistenceLayer;
foreach (INode node in mftNodes)
{
string message = $"MFT#: {node.MFTRecordNumber.ToString().PadRight(7)} Seq.#: {node.SequenceNumber.ToString().PadRight(4)} Path: {node.FullName}";
parameters.ReportAndLogOutputFunction.Invoke(message);
fileEnumCount.IncrementSucceededCount();
FileProperties prop = new FileProperties();
prop.PopulateFileProperties(parameters, parameters.SelectedFolder[0], node, timingMetrics);
// INSERT file properties into _DATABASE_
timingMetrics.Start(TimingMetric.PersistingFileProperties);
bool insertResult = dataPersistenceLayer.PersistFileProperties(prop);
if (insertResult)
{
databaseInsertCount.IncrementSucceededCount();
}
else
{
databaseInsertCount.IncrementFailedCount();
}
timingMetrics.Stop(TimingMetric.PersistingFileProperties);
parameters.CancelToken.ThrowIfCancellationRequested();
}
dataPersistenceLayer.Dispose();
FileProperties.CleanUp();
}
catch (OperationCanceledException)
{ }
return(new FileEnumeratorReport(new List <FailSuccessCount> {
fileEnumCount, databaseInsertCount
}, timingMetrics));
}
public StreamWrapper(NtfsReader reader, NodeWrapper parentNode, int streamIndex)
{
_reader = reader;
_parentNode = parentNode;
_streamIndex = streamIndex;
}
public NodeWrapper(NtfsReader reader, UInt32 nodeIndex, Node node)
{
_reader = reader;
_nodeIndex = nodeIndex;
_node = node;
}
