Esempio n. 1
0
        internal static byte[] GetBytes(FileStream streamToRead, Superblock superblock, uint offset)
        {
            // Derive Length of Inode Table from superblock values
            uint length = superblock.InodesPerGroup * Inode.EXT4_INODE_SIZE;

            // Get Inode Table bytes
            return(NativeMethods.readDrive(streamToRead, offset, length));
        }
Esempio n. 2
0
        public byte[] GetBytes(string volume)
        {
            IntPtr hDevice = NativeMethods.getHandle(volume);

            using (FileStream streamToRead = NativeMethods.getFileStream(hDevice))
            {
                Superblock sb = new Superblock(Superblock.GetBytes(streamToRead, 0));
                return(Win32.NativeMethods.readDrive(streamToRead, (sb.BlockSize * this.StartBlock), (sb.BlockSize * this.BlockCount)));
            }
        }
Esempio n. 3
0
        public byte[] GetBytes(string volume)
        {
            IntPtr hDevice = NativeMethods.getHandle(volume);

            using (FileStream streamToRead = NativeMethods.getFileStream(hDevice))
            {
                Superblock sb = new Superblock(Superblock.GetBytes(streamToRead, 0));
                return Win32.NativeMethods.readDrive(streamToRead, (sb.BlockSize * this.StartBlock), (sb.BlockSize * this.BlockCount));
            }
        }
        internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock)
        {
            // Derive the location and length of the Block Group Descriptor Table
            uint offset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize);
            uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1;
            uint length = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Ensure the bgdtLength value is a multiple of 512 (minimum value for reading bytes from disk)
            if ((length % NativeMethods.BYTES_PER_SECTOR) != 0)
            {
                length += (NativeMethods.BYTES_PER_SECTOR - (length % NativeMethods.BYTES_PER_SECTOR));
            }

            // Get BlockGroupDescriptor bytes
            return NativeMethods.readDrive(streamToRead, offset, length);
        }
        internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock, uint group)
        {
            // Derive the location and length of the Block Group Descriptor Table
            uint bgdtOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize);
            uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1;
            uint bgdtLength = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Determine the offset from the beginning of the BGDT to the desired group
            uint groupOffset = group * BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Determine what Sector contains the raw bytes
            uint groupSectorOffset = groupOffset / NativeMethods.BYTES_PER_SECTOR;

            // Read the sector that the desired block resides within
            byte[] SectorBytes = NativeMethods.readDrive(streamToRead, bgdtOffset + (groupSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR);

            // Get Block Group Descriptor offset into Sector
            uint sectorOffset = (group % BLOCK_GROUPS_PER_SECTOR) * BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Create byte[] containing only bytes for the requested Block Group Descriptor
            return NativeMethods.GetSubArray(SectorBytes, sectorOffset, BLOCK_GROUP_DESCRIPTOR_LENGTH);
        }
Esempio n. 6
0
        internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock)
        {
            // Derive the location and length of the Block Group Descriptor Table
            uint offset      = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize);
            uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1;
            uint length      = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Ensure the bgdtLength value is a multiple of 512 (minimum value for reading bytes from disk)
            if ((length % NativeMethods.BYTES_PER_SECTOR) != 0)
            {
                length += (NativeMethods.BYTES_PER_SECTOR - (length % NativeMethods.BYTES_PER_SECTOR));
            }

            // Get BlockGroupDescriptor bytes
            return(NativeMethods.readDrive(streamToRead, offset, length));
        }
        internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock, uint group)
        {
            // Derive the location and length of the Block Group Descriptor Table
            uint bgdtOffset  = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize);
            uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1;
            uint bgdtLength  = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Determine the offset from the beginning of the BGDT to the desired group
            uint groupOffset = group * BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Determine what Sector contains the raw bytes
            uint groupSectorOffset = groupOffset / NativeMethods.BYTES_PER_SECTOR;

            // Read the sector that the desired block resides within
            byte[] SectorBytes = NativeMethods.readDrive(streamToRead, bgdtOffset + (groupSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR);

            // Get Block Group Descriptor offset into Sector
            uint sectorOffset = (group % BLOCK_GROUPS_PER_SECTOR) * BLOCK_GROUP_DESCRIPTOR_LENGTH;

            // Create byte[] containing only bytes for the requested Block Group Descriptor
            return(NativeMethods.GetSubArray(SectorBytes, sectorOffset, BLOCK_GROUP_DESCRIPTOR_LENGTH));
        }
Esempio n. 8
0
        protected override void ProcessRecord()
        {
            #region MBR

            MasterBootRecord mbr = MasterBootRecord.Get(devicePath);

            uint superblockOffset = 0;

            foreach (PartitionEntry partition in mbr.PartitionTable)
            {
                if (partition.Bootable && partition.SystemID == "LINUX")
                {
                    superblockOffset = partition.StartSector;
                }
            }

            #endregion MBR
            // Obtain a handle to the device named "devicePath"
            IntPtr hDevice = NativeMethods.getHandle(devicePath);

            using (FileStream streamToRead = NativeMethods.getFileStream(hDevice))
            {
                // Get Superblock to understand File System Layout
                Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset));

                if (this.MyInvocation.BoundParameters.ContainsKey("Inode"))
                {
                    if (inode == 0)
                    {
                        throw new Exception("0 is not a valid Inode value.");
                    }
                    else
                    {
                        uint block_group = (inode - 1) / superBlock.InodesPerGroup;

                        BlockGroupDescriptor bgd = new BlockGroupDescriptor(BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock));

                        uint inodeTableOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + (bgd.InodeTableOffset * superBlock.BlockSize);

                        uint inodeSectorOffset = (inode - 1) / (NativeMethods.BYTES_PER_SECTOR / (uint)superBlock.InodeSize);

                        byte[] SectorBytes = NativeMethods.readDrive(streamToRead, inodeTableOffset + (inodeSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR);

                        uint sectorOffset = ((inode - 1) % (NativeMethods.BYTES_PER_SECTOR / (uint)superBlock.InodeSize)) * (uint)superBlock.InodeSize;

                        byte[] inodeBytes = NativeMethods.GetSubArray(SectorBytes, sectorOffset, (uint)superBlock.InodeSize);

                        if (asbytes)
                        {
                            WriteObject(inodeBytes);
                        }
                        else
                        {
                            WriteObject(new Inode(inodeBytes, inode));
                        }
                    }
                }
                else
                {
                    // Create a byte array representing the BGDT
                    byte[] bgdtBytes = BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock);

                    // Iterate through BGDTs and output associate Inodes
                    for (uint o = 0; o < bgdtBytes.Length; o += BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH)
                    {
                        BlockGroupDescriptor bgd = new BlockGroupDescriptor(NativeMethods.GetSubArray(bgdtBytes, o, BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH));

                        uint inodeTableOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + (bgd.InodeTableOffset * superBlock.BlockSize);
                        byte[] inodeTableBytes = InodeTable.GetBytes(streamToRead, superBlock, inodeTableOffset);

                        for (uint i = 0; i < inodeTableBytes.Length; i += (uint)superBlock.InodeSize)
                        {
                            uint inode = ((o / BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH) + 1) * ((i / (uint)superBlock.InodeSize) + 1);
                            WriteObject(new Inode(NativeMethods.GetSubArray(inodeTableBytes, i, superBlock.InodeSize), inode));
                        }
                    }
                }
            }
        }
        protected override void ProcessRecord()
        {
            #region MBR

            MasterBootRecord mbr = MasterBootRecord.Get(devicePath);

            uint superblockOffset = 0;

            foreach (PartitionEntry partition in mbr.PartitionTable)
            {
                if (partition.Bootable && partition.SystemID == "LINUX")
                {
                    superblockOffset = partition.StartSector;
                }
            }

            #endregion MBR
            // Obtain a handle to the device named "devicePath"
            IntPtr hDevice = NativeMethods.getHandle(devicePath);

            using (FileStream streamToRead = NativeMethods.getFileStream(hDevice))
            {
                // Get Superblock to understand File System Layout
                Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset));

                // Derive the location and length of the Block Group Descriptor Table
                uint bgdtOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize);
                uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1;
                uint bgdtLength = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH;

            }
        }
        protected override void ProcessRecord()
        {
            #region MBR

            MasterBootRecord mbr = MasterBootRecord.Get(devicePath);

            uint superblockOffset = 0;

            foreach (PartitionEntry partition in mbr.PartitionTable)
            {
                if (partition.Bootable && partition.SystemID == "LINUX")
                {
                    superblockOffset = partition.StartSector;
                }
            }

            #endregion MBR
            // Obtain a handle to the device named "devicePath"
            IntPtr hDevice = NativeMethods.getHandle(devicePath);

            using (FileStream streamToRead = NativeMethods.getFileStream(hDevice))
            {
                // Get Superblock to understand File System Layout
                Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset));

                if(this.MyInvocation.BoundParameters.ContainsKey("GroupNumber"))
                {
                    if (asbytes)
                    {
                        WriteObject(BlockGroupDescriptor.GetBytes(streamToRead, superblockOffset, superBlock, number));
                    }
                    else
                    {
                        WriteObject(new BlockGroupDescriptor(BlockGroupDescriptor.GetBytes(streamToRead, superblockOffset, superBlock, number)));
                    }
                }
                else
                {
                    if (asbytes)
                    {
                        BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock);
                    }
                    else
                    {
                        byte[] bgdtBytes = BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock);
                        for (uint o = 0; o < bgdtBytes.Length; o += BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH)
                        {
                            WriteObject(new BlockGroupDescriptor(NativeMethods.GetSubArray(bgdtBytes, o, BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH)));
                        }
                    }
                }
            }
        }