private VolumeBootRecord(byte[] bytes)
{
// Get VolumeBootRecord Signature to determine File System Type
Signature = Encoding.ASCII.GetString(bytes, 0x03, 0x08);
// Check if NTFS Partition
if (Signature == "NTFS ")
{
BytesPerSector = BitConverter.ToUInt16(bytes, 11);
BytesPerCluster = (uint)(bytes[13] * BytesPerSector);
ReservedSectors = BitConverter.ToUInt16(bytes, 14);
MediaDescriptor = (MEDIA_DESCRIPTOR)bytes[21];
SectorsPerTrack = BitConverter.ToUInt16(bytes, 24);
NumberOfHeads = BitConverter.ToUInt16(bytes, 26);
HiddenSectors = BitConverter.ToUInt32(bytes, 28);
TotalSectors = BitConverter.ToUInt64(bytes, 40);
MFTStartIndex = BitConverter.ToUInt64(bytes, 48);
MFTMirrStartIndex = BitConverter.ToUInt64(bytes, 56);
#region BytesPerFileRecord
sbyte clustersPerFileRecord = (sbyte)bytes[64];
if (clustersPerFileRecord < 0)
{
BytesPerFileRecord = Math.Pow(2, Math.Abs(clustersPerFileRecord));
}
else
{
BytesPerFileRecord = clustersPerFileRecord * BytesPerCluster;
}
#endregion BytesPerFileRecord
#region BytesPerIndexBlock
sbyte clustersPerIndexBlock = (sbyte)bytes[68];
if (clustersPerIndexBlock < 0)
{
BytesPerIndexBlock = Math.Pow(2, Math.Abs(clustersPerIndexBlock));
}
else
{
BytesPerIndexBlock = clustersPerIndexBlock * BytesPerCluster;
}
#endregion BytesPerIndexBlock
#region VolumeSerialNumber
byte[] serialNumberBytes = Util.GetSubArray(bytes, 0x48, 0x04);
Array.Reverse(serialNumberBytes);
VolumeSerialNumber = BitConverter.ToString(serialNumberBytes).Remove(2, 1).Remove(7, 1);
#endregion VolumeSerialNumber
CodeSection = Util.GetSubArray(bytes, 0x50, 0x1AE);
}
else
{
throw new Exception("Volume is not NTFS formatted.");
}
}
private VolumeBootRecord(byte[] bytes)
{
// Get VolumeBootRecord Signature to determine File System Type
Signature = Encoding.ASCII.GetString(bytes, 0x03, 0x08);
// Check if NTFS Partition
if (Signature == "NTFS ")
{
BytesPerSector = BitConverter.ToUInt16(bytes, 11);
BytesPerCluster = (uint)(bytes[13] * BytesPerSector);
ReservedSectors = BitConverter.ToUInt16(bytes, 14);
MediaDescriptor = (MEDIA_DESCRIPTOR)bytes[21];
SectorsPerTrack = BitConverter.ToUInt16(bytes, 24);
NumberOfHeads = BitConverter.ToUInt16(bytes, 26);
HiddenSectors = BitConverter.ToUInt32(bytes, 28);
TotalSectors = BitConverter.ToUInt64(bytes, 40);
MFTStartIndex = BitConverter.ToUInt64(bytes, 48);
MFTMirrStartIndex = BitConverter.ToUInt64(bytes, 56);
#region BytesPerFileRecord
sbyte clustersPerFileRecord = (sbyte)bytes[64];
if (clustersPerFileRecord < 0)
{
BytesPerFileRecord = Math.Pow(2, Math.Abs(clustersPerFileRecord));
}
else
{
BytesPerFileRecord = clustersPerFileRecord * BytesPerCluster;
}
#endregion BytesPerFileRecord
#region BytesPerIndexBlock
sbyte clustersPerIndexBlock = (sbyte)bytes[68];
if (clustersPerIndexBlock < 0)
{
BytesPerIndexBlock = Math.Pow(2, Math.Abs(clustersPerIndexBlock));
}
else
{
BytesPerIndexBlock = clustersPerIndexBlock * BytesPerCluster;
}
#endregion BytesPerIndexBlock
#region VolumeSerialNumber
byte[] serialNumberBytes = NativeMethods.GetSubArray(bytes, 0x48, 0x04);
Array.Reverse(serialNumberBytes);
VolumeSerialNumber = BitConverter.ToString(serialNumberBytes).Remove(2, 1).Remove(7, 1);
#endregion VolumeSerialNumber
CodeSection = NativeMethods.GetSubArray(bytes, 0x50, 0x1AE);
}
else
{
throw new Exception("Volume is not NTFS formatted.");
}
}
internal FatVolumeBootRecord(byte[] bytes) //, string volume)
{
//Volume = volume;
BS_OEMName = Encoding.ASCII.GetString(bytes, 3, 8);
BytesPerSector = BitConverter.ToUInt16(bytes, 11);
SectorsPerCluster = bytes[13];
BytesPerCluster = BytesPerSector * SectorsPerCluster;
ReservedSectors = BitConverter.ToUInt16(bytes, 14);
BPB_NumberOfFATs = bytes[16];
BPB_RootEntryCount = BitConverter.ToUInt16(bytes, 17);
BPB_TotalSector16 = BitConverter.ToUInt16(bytes, 19);
BPB_Media = (MEDIA_DESCRIPTOR)bytes[21];
BPB_FatSize16 = BitConverter.ToUInt16(bytes, 22);
SectorsPerTrack = BitConverter.ToUInt16(bytes, 24);
NumberOfHeads = BitConverter.ToUInt16(bytes, 26);
HiddenSectors = BitConverter.ToUInt32(bytes, 28);
BPB_TotalSector32 = BitConverter.ToUInt32(bytes, 32);
//At this point, the BPB/boot sector for FAT12 and FAT16 differs from the BPB/boot sector for FAT32.
//The first table shows the structure for FAT12 and FAT16 starting at offset 36 of the boot sector.
//Fat12 and Fat16 Structure Starting at Offset 36
FatType = GetFatType(bytes);
if (FatType == "FAT12" || FatType == "FAT16")
{
/* Volume is FAT12 or FAT16 */
BS_DriveNumber = bytes[36];
BS_BootSignature = bytes[38];
BS_VolumeId = BitConverter.ToUInt32(bytes, 39);
BS_VolumeLabel = Encoding.ASCII.GetString(bytes, 43, 11);
BS_FileSystemType = Encoding.ASCII.GetString(bytes, 54, 8);
CodeSection = Helper.GetSubArray(bytes, 62, 450);
}
else
{
/* Volume is FAT32 */
BPB_FatSize32 = BitConverter.ToUInt32(bytes, 36);
BPB_ExtFlags = BitConverter.ToUInt16(bytes, 40);
BPB_FileSystemVersion = BitConverter.ToUInt16(bytes, 42);
BPB_RootCluster = BitConverter.ToUInt32(bytes, 44);
BPB_FileSytemInfo = BitConverter.ToUInt16(bytes, 48);
BPB_BackupBootSector = BitConverter.ToUInt16(bytes, 50);
BS_DriveNumber = bytes[64];
BS_BootSignature = bytes[66];
BS_VolumeId = BitConverter.ToUInt32(bytes, 67);
BS_VolumeLabel = Encoding.ASCII.GetString(bytes, 71, 11);
BS_FileSystemType = Encoding.ASCII.GetString(bytes, 82, 8);
CodeSection = Helper.GetSubArray(bytes, 90, 422);
}
}
