private byte[] GetContent(FileRecordAttribute attribute)
{
if (attribute.NonResident)
{
return((attribute as NonResident).GetBytes());
}
else
{
return((attribute as Data).RawData);
}
throw new Exception("Could not locate file contents");
}
public string RestoreDeletedFile(string InFullFileName, string OutFullFileName)
{
FileRecord fileRecord = GetDeletedInstance(InFullFileName);
if (fileRecord.IsNull())
{
return("Can't restore File, no trace in Master File Table");
}
FileRecordAttribute attribute = fileRecord.Attribute.First(a => a.Name == FileRecordAttribute.ATTR_TYPE.DATA);
if (attribute.IsNull())
{
return("Can't find any attribute data to locate the deleted File");
}
fileRecord.CopyFile(OutFullFileName);
return("File copied");
}
private FileRecord(ref FileRecord[] recordArray, byte[] bytes, int offset, int bytesPerFileRecord, string volume, bool fast)
{
if (Encoding.ASCII.GetString(bytes, 0x00 + offset, 0x04) == "FILE")
{
OffsetOfUS = BitConverter.ToUInt16(bytes, 0x04 + offset);
SizeOfUS = BitConverter.ToUInt16(bytes, 0x06 + offset);
LogFileSequenceNumber = BitConverter.ToUInt64(bytes, 0x08 + offset);
SequenceNumber = BitConverter.ToUInt16(bytes, 0x10 + offset);
Hardlinks = BitConverter.ToUInt16(bytes, 0x12 + offset);
OffsetOfAttribute = BitConverter.ToUInt16(bytes, 0x14 + offset);
Flags = (FILE_RECORD_FLAG)BitConverter.ToUInt16(bytes, 0x16 + offset);
Deleted = isDeleted(Flags);
Directory = isDirectory(Flags);
RealSize = BitConverter.ToInt32(bytes, 0x18 + offset);
AllocatedSize = BitConverter.ToInt32(bytes, 0x1C + offset);
ReferenceToBase = BitConverter.ToUInt64(bytes, 0x20 + offset);
NextAttrId = BitConverter.ToUInt16(bytes, 0x28 + offset);
RecordNumber = BitConverter.ToUInt32(bytes, 0x2C + offset);
Attribute = FileRecordAttribute.GetInstances(bytes, OffsetOfAttribute + offset, bytesPerFileRecord, volume);
#region AttributeProperties
foreach (FileRecordAttribute attr in Attribute)
{
if (attr.Name == FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION)
{
StandardInformation stdInfo = attr as StandardInformation;
ModifiedTime = stdInfo.ModifiedTime;
AccessedTime = stdInfo.AccessedTime;
ChangedTime = stdInfo.ChangedTime;
BornTime = stdInfo.BornTime;
Permission = stdInfo.Permission;
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST)
{
if (!(Deleted))
{
AttributeList attrList = null;
List <FileRecordAttribute> list = new List <FileRecordAttribute>();
list.AddRange(Attribute);
if (attr.NonResident)
{
attrList = new AttributeList(attr as NonResident);
}
else
{
attrList = attr as AttributeList;
}
foreach (AttrRef attribute in attrList.AttributeReference)
{
if (attribute.RecordNumber != RecordNumber)
{
FileRecord record = null;
// Test if we have already parse the record
if (recordArray[attribute.RecordNumber] != null)
{
record = recordArray[attribute.RecordNumber];
}
else
{
// If not parse it and add it to the array
record = new FileRecord(ref recordArray, bytes, bytesPerFileRecord * (int)attribute.RecordNumber, bytesPerFileRecord, volume, fast);
recordArray[attribute.RecordNumber] = record;
}
// Add the attributes to the attribute array
list.AddRange(record.Attribute);
list.Remove(attr);
}
}
Attribute = list.ToArray();
}
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.FILE_NAME)
{
FileName fN = attr as FileName;
if (!(fN.Namespace == 2))
{
Name = fN.Filename;
ParentSequenceNumber = fN.ParentSequenceNumber;
ParentRecordNumber = fN.ParentRecordNumber;
FNModifiedTime = fN.ModifiedTime;
FNAccessedTime = fN.AccessedTime;
FNChangedTime = fN.ChangedTime;
FNBornTime = fN.BornTime;
}
}
}
#endregion AttributeProperties
#region FullName
if (fast)
{
FullName = Name;
}
else
{
StringBuilder sb = new StringBuilder();
string volLetter = Helper.GetVolumeLetter(volume);
if (RecordNumber == 0)
{
sb.Append(volLetter);
sb.Append('\\');
sb.Append(Name);
FullName = sb.ToString();
}
else if (RecordNumber == 5)
{
FullName = volLetter;
}
else
{
FileRecord parent = null;
if (recordArray[this.ParentRecordNumber] != null)
{
parent = recordArray[this.ParentRecordNumber];
}
else
{
parent = new FileRecord(ref recordArray, bytes, bytesPerFileRecord * (int)this.ParentRecordNumber, bytesPerFileRecord, volume, fast);
recordArray[this.ParentRecordNumber] = parent;
}
if (parent.SequenceNumber == this.ParentSequenceNumber)
{
sb.Append(parent.FullName);
}
else
{
sb.Append(@"$OrphanFiles");
}
if (Name != null)
{
sb.Append('\\');
FullName = sb.Append(Name).ToString();
}
else
{
FullName = sb.ToString();
}
}
}
#endregion FullName
}
}
private FileRecord(byte[] recordBytes, string volume, int bytesPerFileRecord, bool fast)
{
if (Encoding.ASCII.GetString(recordBytes, 0x00, 0x04) == "FILE")
{
VolumePath = volume;
OffsetOfUS = BitConverter.ToUInt16(recordBytes, 0x04);
SizeOfUS = BitConverter.ToUInt16(recordBytes, 0x06);
LogFileSequenceNumber = BitConverter.ToUInt64(recordBytes, 0x08);
SequenceNumber = BitConverter.ToUInt16(recordBytes, 0x10);
Hardlinks = BitConverter.ToUInt16(recordBytes, 0x12);
OffsetOfAttribute = BitConverter.ToUInt16(recordBytes, 0x14);
Flags = (FILE_RECORD_FLAG)BitConverter.ToUInt16(recordBytes, 0x16);
Deleted = isDeleted(Flags);
Directory = isDirectory(Flags);
RealSize = BitConverter.ToInt32(recordBytes, 0x18);
AllocatedSize = BitConverter.ToInt32(recordBytes, 0x1C);
ReferenceToBase = BitConverter.ToUInt64(recordBytes, 0x20);
NextAttrId = BitConverter.ToUInt16(recordBytes, 40);
RecordNumber = BitConverter.ToUInt32(recordBytes, 44);
Attribute = FileRecordAttribute.GetInstances(recordBytes, OffsetOfAttribute, bytesPerFileRecord, volume);
#region AttributeProperties
foreach (FileRecordAttribute attr in Attribute)
{
if (attr.Name == FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION)
{
StandardInformation stdInfo = attr as StandardInformation;
ModifiedTime = stdInfo.ModifiedTime;
AccessedTime = stdInfo.AccessedTime;
ChangedTime = stdInfo.ChangedTime;
BornTime = stdInfo.BornTime;
Permission = stdInfo.Permission;
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST)
{
if (!(Deleted))
{
AttributeList attrList = null;
List <FileRecordAttribute> list = new List <FileRecordAttribute>();
list.AddRange(Attribute);
if (attr.NonResident)
{
attrList = new AttributeList(attr as NonResident);
}
else
{
attrList = attr as AttributeList;
}
foreach (AttrRef attribute in attrList.AttributeReference)
{
if (attribute.RecordNumber != RecordNumber)
{
FileRecord record = FileRecord.Get(volume, (int)attribute.RecordNumber);
list.AddRange(record.Attribute);
list.Remove(attr);
}
}
Attribute = list.ToArray();
}
}
else if (attr.Name == FileRecordAttribute.ATTR_TYPE.FILE_NAME)
{
FileName fN = attr as FileName;
if (!(fN.Namespace == 2))
{
Name = fN.Filename;
ParentSequenceNumber = fN.ParentSequenceNumber;
ParentRecordNumber = fN.ParentRecordNumber;
FNModifiedTime = fN.ModifiedTime;
FNAccessedTime = fN.AccessedTime;
FNChangedTime = fN.ChangedTime;
FNBornTime = fN.BornTime;
}
}
}
#endregion AttributeProperties
#region FullName
if (fast)
{
FullName = Name;
}
else
{
StringBuilder sb = new StringBuilder();
string volLetter = Helper.GetVolumeLetter(volume);
if (RecordNumber == 0)
{
sb.Append(volLetter);
sb.Append('\\');
sb.Append(Name);
FullName = sb.ToString();
}
else if (RecordNumber == 5)
{
FullName = volLetter;
}
else
{
FileRecord parent = new FileRecord(GetRecordBytes(volume, (int)ParentRecordNumber), volume, bytesPerFileRecord, false);
if (parent.SequenceNumber == this.ParentSequenceNumber)
{
sb.Append(parent.FullName);
}
else
{
sb.Append(@"$OrphanFiles");
}
if (Name != null)
{
sb.Append('\\');
FullName = sb.Append(Name).ToString();
}
else
{
FullName = sb.ToString();
}
}
}
#endregion FullName
}
}
