public FileListEntry(MFTRecordOut r)
{
FullPath = $"{r.ParentPath}\\{r.FileName}";
Extension = r.Extension;
IsDirectory = r.IsDirectory;
FileSize = r.FileSize;
Created0x10 = r.Created0x10;
LastModified0x10 = r.LastModified0x10;
}
public static MFTRecordOut GetCsvData(FileRecord fr, FileName fn, AdsInfo adsinfo)
{
var mftr = new MFTRecordOut
{
EntryNumber = fr.EntryNumber,
FileName = fn.FileInfo.FileName,
InUse = fr.IsDeleted() == false,
ParentPath = _mft.GetFullParentPath(fn.FileInfo.ParentMftRecord.GetKey()),
SequenceNumber = fr.SequenceNumber,
IsDirectory = fr.IsDirectory(),
ParentEntryNumber = fn.FileInfo.ParentMftRecord.MftEntryNumber,
ParentSequenceNumber = fn.FileInfo.ParentMftRecord.MftSequenceNumber,
NameType = fn.FileInfo.NameType,
FnAttributeId = fn.AttributeNumber
};
if (mftr.IsDirectory == false)
{
mftr.Extension = Path.GetExtension(mftr.FileName);
var data = fr.Attributes.FirstOrDefault(t => t.AttributeType == AttributeType.Data);
if (data != null)
{
mftr.OtherAttributeId = data.AttributeNumber;
}
}
mftr.FileSize = fr.GetFileSize();
if (adsinfo != null)
{
mftr.FileName = $"{mftr.FileName}:{adsinfo.Name}";
mftr.FileSize = adsinfo.Size;
try
{
mftr.Extension = Path.GetExtension(adsinfo.Name);
}
catch (Exception)
{
//sometimes bad chars show up
}
if (adsinfo.Name == "Zone.Identifier")
{
if (adsinfo.ResidentData != null)
{
mftr.ZoneIdContents = Encoding.GetEncoding(1252).GetString(adsinfo.ResidentData.Data);
}
else
{
mftr.ZoneIdContents = "(Zone.Identifier data is non-resident)";
}
}
}
mftr.ReferenceCount = fr.GetReferenceCount();
mftr.LogfileSequenceNumber = fr.LogSequenceNumber;
var oid = (ObjectId)fr.Attributes.SingleOrDefault(t =>
t.AttributeType == AttributeType.VolumeVersionObjectId);
if (oid != null)
{
mftr.ObjectIdFileDroid = oid.FileDroid.ToString();
}
var lus = (LoggedUtilityStream)fr.Attributes.FirstOrDefault(t =>
t.AttributeType == AttributeType.LoggedUtilityStream);
if (lus != null)
{
mftr.LoggedUtilStream = lus.Name;
}
var rp = fr.GetReparsePoint();
if (rp != null)
{
mftr.ReparseTarget = rp.SubstituteName.Replace(@"\??\", "");
}
var si = (StandardInfo)fr.Attributes.SingleOrDefault(t =>
t.AttributeType == AttributeType.StandardInformation);
if (si != null)
{
mftr.UpdateSequenceNumber = si.UpdateSequenceNumber;
mftr.Created0x10 = si.CreatedOn;
mftr.LastModified0x10 = si.ContentModifiedOn;
mftr.LastRecordChange0x10 = si.RecordModifiedOn;
mftr.LastAccess0x10 = si.LastAccessedOn;
mftr.Copied = si.ContentModifiedOn < si.CreatedOn;
if (_fluentCommandLineParser.Object.AllTimeStampsAllTime || fn.FileInfo.CreatedOn != si.CreatedOn)
{
mftr.Created0x30 = fn.FileInfo.CreatedOn;
}
if (_fluentCommandLineParser.Object.AllTimeStampsAllTime || fn.FileInfo.ContentModifiedOn != si.ContentModifiedOn)
{
mftr.LastModified0x30 = fn.FileInfo.ContentModifiedOn;
}
if (_fluentCommandLineParser.Object.AllTimeStampsAllTime || fn.FileInfo.RecordModifiedOn != si.RecordModifiedOn)
{
mftr.LastRecordChange0x30 = fn.FileInfo.RecordModifiedOn;
}
if (_fluentCommandLineParser.Object.AllTimeStampsAllTime || fn.FileInfo.LastAccessedOn != si.LastAccessedOn)
{
mftr.LastAccess0x30 = fn.FileInfo.LastAccessedOn;
}
mftr.SecurityId = si.SecurityId;
mftr.SiFlags = si.Flags;
if (mftr.Created0x30.HasValue && mftr.Created0x10?.UtcTicks < mftr.Created0x30.Value.UtcTicks)
{
mftr.Timestomped = true;
}
if (mftr.Created0x10?.Millisecond == 0 || mftr.LastModified0x10?.Millisecond == 0)
{
mftr.uSecZeros = true;
}
}
else
{
//no si, so update FN timestamps
mftr.Created0x30 = fn.FileInfo.CreatedOn;
mftr.LastModified0x10 = fn.FileInfo.ContentModifiedOn;
mftr.LastRecordChange0x10 = fn.FileInfo.RecordModifiedOn;
mftr.LastAccess0x10 = fn.FileInfo.LastAccessedOn;
}
return(mftr);
}
private static BodyFile GetBodyData(MFTRecordOut mftr, bool getStandardInfo)
{
var b = new BodyFile
{
Name =
$"{_fluentCommandLineParser.Object.BodyDriveLetter.ToLowerInvariant()}:{mftr.ParentPath.Substring(1)}\\{mftr.FileName}"
.Replace("\\", "/"),
Gid = 0,
Uid = 0,
Mode = "r/rrwxrwxrwx",
Md5 = 0,
Size = mftr.FileSize
};
if (getStandardInfo)
{
if (mftr.LastAccess0x10 != null)
{
b.AccessTime = mftr.LastAccess0x10.Value.ToUnixTimeSeconds();
}
if (mftr.LastModified0x10 != null)
{
b.ModifiedTime = mftr.LastModified0x10.Value.ToUnixTimeSeconds();
}
if (mftr.LastRecordChange0x10 != null)
{
b.RecordModifiedTime = mftr.LastRecordChange0x10.Value.ToUnixTimeSeconds();
}
if (mftr.Created0x10 != null)
{
b.CreatedTime = mftr.Created0x10.Value.ToUnixTimeSeconds();
}
if (mftr.IsDirectory)
{
b.Inode = $"{mftr.EntryNumber}-144-{mftr.OtherAttributeId}";
}
else
{
b.Inode = $"{mftr.EntryNumber}-128-{mftr.OtherAttributeId}";
}
}
else
{
b.Name = $"{b.Name} ($FILE_NAME)";
if (mftr.LastAccess0x30 != null)
{
b.AccessTime = mftr.LastAccess0x30.Value.ToUnixTimeSeconds();
}
else
{
if (mftr.LastAccess0x10 != null)
{
b.AccessTime = mftr.LastAccess0x10.Value.ToUnixTimeSeconds();
}
}
if (mftr.LastModified0x30 != null)
{
b.ModifiedTime = mftr.LastModified0x30.Value.ToUnixTimeSeconds();
}
else
{
if (mftr.LastModified0x10 != null)
{
b.ModifiedTime = mftr.LastModified0x10.Value.ToUnixTimeSeconds();
}
}
if (mftr.LastRecordChange0x30 != null)
{
b.RecordModifiedTime = mftr.LastRecordChange0x30.Value.ToUnixTimeSeconds();
}
else
{
if (mftr.LastRecordChange0x10 != null)
{
b.RecordModifiedTime = mftr.LastRecordChange0x10.Value.ToUnixTimeSeconds();
}
}
if (mftr.Created0x30 != null)
{
b.CreatedTime = mftr.Created0x30.Value.ToUnixTimeSeconds();
}
else
{
if (mftr.Created0x10 != null)
{
b.CreatedTime = mftr.Created0x10.Value.ToUnixTimeSeconds();
}
}
b.Inode = $"{mftr.EntryNumber}-48-{mftr.FnAttributeId}";
}
if (mftr.InUse == false)
{
b.Name = $"{b.Name} (deleted)";
}
return(b);
}