static string GetPath(MasterFileTable mft, MasterFileTableEntry entry) { if (entry.SequenceNumber == MasterFileTable.RootDirectoryIndex) { return "<root>"; } FileNameAttribute fna = null; foreach (var attr in entry.Attributes) { FileNameAttribute thisFna = attr as FileNameAttribute; if (thisFna != null) { if (fna == null || thisFna.FileNameNamespace == NtfsNamespace.Win32 || thisFna.FileNameNamespace == NtfsNamespace.Win32AndDos) { fna = thisFna; } } } if (fna == null) { return "<unknown>"; } string parentPath = "<unknown>"; MasterFileTableEntry parentEntry = mft[fna.ParentDirectory.RecordIndex]; if (parentEntry != null) { if (parentEntry.SequenceNumber == fna.ParentDirectory.RecordSequenceNumber || parentEntry.SequenceNumber == fna.ParentDirectory.RecordSequenceNumber + 1) { parentPath = GetPath(mft, parentEntry); } } return parentPath + "\\" + fna.FileName; }
static long GetSize(MasterFileTableEntry entry) { foreach (var attr in entry.Attributes) { FileNameAttribute fna = attr as FileNameAttribute; if (fna != null) { return fna.RealSize; } } return 0; }
static IBuffer GetContent(MasterFileTableEntry entry) { foreach (var attr in entry.Attributes) { if (attr.AttributeType == AttributeType.Data) { return attr.Content; } } return null; }