private LfsRestartPage ReadRestartPage() { byte[] firstPageBytes = ReadData(0, Volume.BytesPerSector); uint systemPageSize = LfsRestartPage.GetSystemPageSize(firstPageBytes, 0); int bytesToRead = (int)systemPageSize - firstPageBytes.Length; if (bytesToRead > 0) { byte[] temp = ReadData((ulong)firstPageBytes.Length, bytesToRead); firstPageBytes = ByteUtils.Concatenate(firstPageBytes, temp); } MultiSectorHelper.RevertUsaProtection(firstPageBytes, 0); LfsRestartPage firstRestartPage = new LfsRestartPage(firstPageBytes, 0); byte[] secondPageBytes = ReadData(systemPageSize, (int)systemPageSize); MultiSectorHelper.RevertUsaProtection(secondPageBytes, 0); LfsRestartPage secondRestartPage = new LfsRestartPage(secondPageBytes, 0); if (secondRestartPage.RestartArea.CurrentLsn > firstRestartPage.RestartArea.CurrentLsn) { m_restartPage = secondRestartPage; m_isFirstRestartPageTurn = true; } else { m_restartPage = firstRestartPage; } return(m_restartPage); }
private IndexRecord ReadIndexRecord(long subnodeVBN) { long sectorIndex = ConvertToSectorIndex(subnodeVBN); byte[] recordBytes = m_indexAllocationData.ReadSectors(sectorIndex, this.SectorsPerIndexRecord); MultiSectorHelper.RevertUsaProtection(recordBytes, 0); IndexRecord record = new IndexRecord(recordBytes, 0); return(record); }
/// <summary> /// This method is used to read the record segment(s) of the MFT itself. /// Only after strapping the MFT we can use GetFileRecordSegment which relies on the MFT file record. /// </summary> private FileRecordSegment ReadMftRecordSegment(long mftStartLCN, long segmentNumber) { long sectorIndex = mftStartLCN * m_volume.SectorsPerCluster + segmentNumber * m_volume.SectorsPerFileRecordSegment; byte[] segmentBytes = m_volume.ReadSectors(sectorIndex, m_volume.SectorsPerFileRecordSegment, ContentType.MftData); MultiSectorHelper.RevertUsaProtection(segmentBytes, 0); FileRecordSegment result = new FileRecordSegment(segmentBytes, 0, segmentNumber); return(result); }
private LfsRestartPage ReadRestartPage() { byte[] pageBytes = ReadData(0, Volume.BytesPerSector); uint systemPageSize = LfsRestartPage.GetSystemPageSize(pageBytes, 0); int bytesToRead = (int)systemPageSize - pageBytes.Length; if (bytesToRead > 0) { byte[] temp = ReadData((ulong)pageBytes.Length, bytesToRead); pageBytes = ByteUtils.Concatenate(pageBytes, temp); } MultiSectorHelper.RevertUsaProtection(pageBytes, 0); m_restartPage = new LfsRestartPage(pageBytes, 0); return(m_restartPage); }
private LfsRecordPage ReadPageFromFile(ulong pageOffset) { if (m_restartPage == null) { m_restartPage = ReadRestartPage(); } byte[] pageBytes = ReadData(pageOffset, (int)m_restartPage.LogPageSize); uint pageSignature = LittleEndianConverter.ToUInt32(pageBytes, 0); if (pageSignature == LfsRecordPage.UninitializedPageSignature) { return(null); } MultiSectorHelper.RevertUsaProtection(pageBytes, 0); return(new LfsRecordPage(pageBytes, m_restartPage.LogRestartArea.LogPageDataOffset)); }
private FileRecordSegment GetFileRecordSegment(long segmentNumber) { NTFSBootRecord bootRecord = m_volume.BootRecord; // Note: File record always start at the beginning of a sector // Note: Record can span multiple clusters, or alternatively, several records can be stored in the same cluster long firstSectorIndex = segmentNumber * m_volume.SectorsPerFileRecordSegment; byte[] segmentBytes = m_mftFile.Data.ReadSectors(firstSectorIndex, m_volume.SectorsPerFileRecordSegment); if (FileRecordSegment.ContainsFileRecordSegment(segmentBytes)) { MultiSectorHelper.RevertUsaProtection(segmentBytes, 0); FileRecordSegment recordSegment = new FileRecordSegment(segmentBytes, 0, segmentNumber); return(recordSegment); } else { return(null); } }
private FileRecordSegment GetFileRecordSegment(long segmentNumber) { byte[] segmentBytes = GetFileRecordSegmentBytes(segmentNumber); MultiSectorHelper.RevertUsaProtection(segmentBytes, 0); return(new FileRecordSegment(segmentBytes, 0, segmentNumber)); }