protected override void DoRun() { VolumeManager volMgr = new VolumeManager(); foreach (string disk in _diskFiles.Values) { volMgr.AddDisk(VirtualDisk.OpenDisk(disk, FileAccess.Read, UserName, Password)); } Stream partitionStream = null; if (!string.IsNullOrEmpty(VolumeId)) { partitionStream = volMgr.GetVolume(VolumeId).Open(); } else if (Partition >= 0) { partitionStream = volMgr.GetPhysicalVolumes()[Partition].Open(); } else { partitionStream = volMgr.GetLogicalVolumes()[0].Open(); } SparseStream cacheStream = SparseStream.FromStream(partitionStream, Ownership.None); cacheStream = new BlockCacheStream(cacheStream, Ownership.None); NtfsFileSystem fs = new NtfsFileSystem(cacheStream); fs.NtfsOptions.HideHiddenFiles = !_showHidden.IsPresent; fs.NtfsOptions.HideSystemFiles = !_showSystem.IsPresent; fs.NtfsOptions.HideMetafiles = !_showMeta.IsPresent; fs.Dump(Console.Out, ""); }
protected override void DoRun() { VolumeManager volMgr = new VolumeManager(); foreach (var path in _inFiles.Values) { volMgr.AddDisk(VirtualDisk.OpenDisk(path, FileAccess.Read, UserName, Password)); } Console.WriteLine("PHYSICAL VOLUMES"); foreach (var physVol in volMgr.GetPhysicalVolumes()) { Console.WriteLine(" Identity: " + physVol.Identity); Console.WriteLine(" Type: " + physVol.VolumeType); Console.WriteLine(" Disk Id: " + physVol.DiskIdentity); Console.WriteLine(" Disk Sig: " + physVol.DiskSignature.ToString("X8")); Console.WriteLine(" Part Id: " + physVol.PartitionIdentity); Console.WriteLine(" Length: " + physVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + physVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + physVol.PhysicalStartSector); Console.WriteLine(); } Console.WriteLine("LOGICAL VOLUMES"); foreach (var logVol in volMgr.GetLogicalVolumes()) { Console.WriteLine(" Identity: " + logVol.Identity); Console.WriteLine(" Length: " + logVol.Length + " bytes"); Console.WriteLine(" Disk Geometry: " + logVol.PhysicalGeometry); Console.WriteLine(" First Sector: " + logVol.PhysicalStartSector); Console.WriteLine(); } }
protected override void DoRun() { VolumeManager volMgr = new VolumeManager(); foreach (string disk in _diskFiles.Values) { volMgr.AddDisk(VirtualDisk.OpenDisk(disk, _diskType.IsPresent ? _diskType.Value : null, FileAccess.Read, UserName, Password)); } VolumeInfo volInfo = null; if (!string.IsNullOrEmpty(VolumeId)) { volInfo = volMgr.GetVolume(VolumeId); } else if (Partition >= 0) { volInfo = volMgr.GetPhysicalVolumes()[Partition]; } else { volInfo = volMgr.GetLogicalVolumes()[0]; } DiscUtils.FileSystemInfo fsInfo = FileSystemManager.DetectDefaultFileSystems(volInfo)[0]; using (DiscFileSystem fs = fsInfo.Open(volInfo, FileSystemParameters)) { using (Stream source = fs.OpenFile(_inFilePath.Value, FileMode.Open, FileAccess.Read)) { using (FileStream outFile = new FileStream(_outFilePath.Value, FileMode.Create, FileAccess.ReadWrite)) { PumpStreams(source, outFile); } if (_hexDump.IsPresent) { source.Position = 0; HexDump.Generate(source, Console.Out); } } } }
protected override void DoRun() { Console.OutputEncoding = Encoding.UTF8; List<VirtualDisk> disks = new List<VirtualDisk>(); foreach (var path in _inFiles.Values) { VirtualDisk disk = VirtualDisk.OpenDisk(path, _diskType.IsPresent ? _diskType.Value : null, FileAccess.Read, UserName, Password); disks.Add(disk); Console.WriteLine(); Console.WriteLine("DISK: " + path); Console.WriteLine(); Console.WriteLine(" Capacity: {0:X16}", disk.Capacity); Console.WriteLine(" Geometry: {0}", disk.Geometry); Console.WriteLine(" BIOS Geometry: {0}", disk.BiosGeometry); Console.WriteLine(" Signature: {0:X8}", disk.Signature); if (disk.IsPartitioned) { Console.WriteLine(" GUID: {0}", disk.Partitions.DiskGuid); } Console.WriteLine(); if (!_hideExtents.IsPresent) { Console.WriteLine(); Console.WriteLine(" Stored Extents"); Console.WriteLine(); foreach (var extent in disk.Content.Extents) { Console.WriteLine(" {0:X16} - {1:X16}", extent.Start, extent.Start + extent.Length); } Console.WriteLine(); } if (_showBootCode.IsPresent) { Console.WriteLine(); Console.WriteLine(" Master Boot Record (MBR)"); Console.WriteLine(); try { byte[] mbr = new byte[512]; disk.Content.Position = 0; disk.Content.Read(mbr, 0, 512); HexDump.Generate(mbr, Console.Out); } catch (Exception e) { Console.WriteLine(e.ToString()); } Console.WriteLine(); } Console.WriteLine(); Console.WriteLine(" Partitions"); Console.WriteLine(); if (disk.IsPartitioned) { Console.WriteLine(" T Start (bytes) End (bytes) Type"); Console.WriteLine(" == ================ ================ =================="); foreach (var partition in disk.Partitions.Partitions) { Console.WriteLine(" {0:X2} {1:X16} {2:X16} {3}", partition.BiosType, partition.FirstSector * disk.SectorSize, (partition.LastSector + 1) * disk.SectorSize, partition.TypeAsString); BiosPartitionInfo bpi = partition as BiosPartitionInfo; if (bpi != null) { Console.WriteLine(" {0,-16} {1}", bpi.Start.ToString(), bpi.End.ToString()); Console.WriteLine(); } } } else { Console.WriteLine(" No partitions"); Console.WriteLine(); } } Console.WriteLine(); Console.WriteLine(); Console.WriteLine("VOLUMES"); Console.WriteLine(); VolumeManager volMgr = new VolumeManager(); foreach (var disk in disks) { volMgr.AddDisk(disk); } try { Console.WriteLine(); Console.WriteLine(" Physical Volumes"); Console.WriteLine(); foreach (var vol in volMgr.GetPhysicalVolumes()) { Console.WriteLine(" " + vol.Identity); Console.WriteLine(" Type: " + vol.VolumeType); Console.WriteLine(" BIOS Type: " + vol.BiosType.ToString("X2") + " [" + BiosPartitionTypes.ToString(vol.BiosType) + "]"); Console.WriteLine(" Size: " + vol.Length); Console.WriteLine(" Disk Id: " + vol.DiskIdentity); Console.WriteLine(" Disk Sig: " + vol.DiskSignature.ToString("X8")); Console.WriteLine(" Partition: " + vol.PartitionIdentity); Console.WriteLine(" Disk Geometry: " + vol.PhysicalGeometry); Console.WriteLine(" BIOS Geometry: " + vol.BiosGeometry); Console.WriteLine(" First Sector: " + vol.PhysicalStartSector); Console.WriteLine(); } } catch (Exception e) { Console.WriteLine(e.ToString()); } try { Console.WriteLine(); Console.WriteLine(" Logical Volumes"); Console.WriteLine(); foreach (var vol in volMgr.GetLogicalVolumes()) { Console.WriteLine(" " + vol.Identity); Console.WriteLine(" BIOS Type: " + vol.BiosType.ToString("X2") + " [" + BiosPartitionTypes.ToString(vol.BiosType) + "]"); Console.WriteLine(" Status: " + vol.Status); Console.WriteLine(" Size: " + vol.Length); Console.WriteLine(" Disk Geometry: " + vol.PhysicalGeometry); Console.WriteLine(" BIOS Geometry: " + vol.BiosGeometry); Console.WriteLine(" First Sector: " + vol.PhysicalStartSector); if (vol.Status == LogicalVolumeStatus.Failed) { Console.WriteLine(" File Systems: <unknown - failed volume>"); Console.WriteLine(); continue; } DiscUtils.FileSystemInfo[] fileSystemInfos = FileSystemManager.DetectDefaultFileSystems(vol); Console.WriteLine(" File Systems: " + string.Join<DiscUtils.FileSystemInfo>(", ", fileSystemInfos)); Console.WriteLine(); if (_showVolContent.IsPresent) { Console.WriteLine(" Binary Contents..."); try { using (Stream s = vol.Open()) { HexDump.Generate(s, Console.Out); } } catch (Exception e) { Console.WriteLine(e.ToString()); } Console.WriteLine(); } if (_showBootCode.IsPresent) { foreach (var fsi in fileSystemInfos) { Console.WriteLine(" Boot Code: {0}", fsi.Name); try { using (DiscFileSystem fs = fsi.Open(vol, FileSystemParameters)) { byte[] bootCode = fs.ReadBootCode(); if (bootCode != null) { HexDump.Generate(bootCode, Console.Out); } else { Console.WriteLine(" <file system reports no boot code>"); } } } catch (Exception e) { Console.WriteLine(" Unable to show boot code: " + e.Message); } Console.WriteLine(); } } if (_showFiles.IsPresent) { foreach (var fsi in fileSystemInfos) { using (DiscFileSystem fs = fsi.Open(vol, FileSystemParameters)) { Console.WriteLine(" {0} Volume Label: {1}", fsi.Name, fs.VolumeLabel); Console.WriteLine(" Files ({0})...", fsi.Name); ShowDir(fs.Root, 6); } Console.WriteLine(); } } } } catch (Exception e) { Console.WriteLine(e.ToString()); } try { bool foundDynDisk = false; DynamicDiskManager dynDiskManager = new DynamicDiskManager(); foreach (var disk in disks) { if (DynamicDiskManager.IsDynamicDisk(disk)) { dynDiskManager.Add(disk); foundDynDisk = true; } } if (foundDynDisk) { Console.WriteLine(); Console.WriteLine(" Logical Disk Manager Info"); Console.WriteLine(); dynDiskManager.Dump(Console.Out, " "); } } catch (Exception e) { Console.WriteLine(e.ToString()); } if (_showContent.IsPresent) { foreach (var path in _inFiles.Values) { VirtualDisk disk = VirtualDisk.OpenDisk(path, FileAccess.Read, UserName, Password); Console.WriteLine(); Console.WriteLine("DISK CONTENTS ({0})", path); Console.WriteLine(); HexDump.Generate(disk.Content, Console.Out); Console.WriteLine(); } } }
protected override void DoRun() { VolumeManager volMgr = new VolumeManager(); foreach (string disk in _diskFiles.Values) { volMgr.AddDisk(VirtualDisk.OpenDisk(disk, FileAccess.Read, UserName, Password)); } VolumeInfo volInfo = null; if (!string.IsNullOrEmpty(VolumeId)) { volInfo = volMgr.GetVolume(VolumeId); } else if (Partition >= 0) { volInfo = volMgr.GetPhysicalVolumes()[Partition]; } else { volInfo = volMgr.GetLogicalVolumes()[0]; } using (NtfsFileSystem fs = new NtfsFileSystem(volInfo.Open())) { MasterFileTable mft = fs.GetMasterFileTable(); if (_recoverFile.IsPresent) { MasterFileTableEntry entry = mft[long.Parse(_recoverFile.Value)]; IBuffer content = GetContent(entry); if (content == null) { Console.WriteLine("Sorry, unable to recover content"); Environment.Exit(1); } string outFile = _recoverFile.Value + "__recovered.bin"; if (File.Exists(outFile)) { Console.WriteLine("Sorry, the file already exists: " + outFile); Environment.Exit(1); } using (FileStream outFileStream = new FileStream(outFile, FileMode.CreateNew, FileAccess.Write)) { Pump(content, outFileStream); } Console.WriteLine("Possible file contents saved as: " + outFile); Console.WriteLine(); Console.WriteLine("Caution! It is rare for the file contents of deleted files to be intact - most"); Console.WriteLine("likely the contents recovered are corrupt as the space has been reused."); } else { foreach (var entry in mft.GetEntries(EntryStates.NotInUse)) { // Skip entries with no attributes, they've probably never been used. We're certainly // not going to manage to recover any useful data from them. if (entry.Attributes.Count == 0) continue; // Skip directories - any useful files inside will be found separately if ((entry.Flags & MasterFileTableEntryFlags.IsDirectory) != 0) continue; long size = GetSize(entry); string path = GetPath(mft, entry); if (!_showMeta.IsPresent && path.StartsWith(@"<root>\$Extend")) continue; if (!_showZeroSize.IsPresent && size == 0) continue; Console.WriteLine("Index: {0,-4} Size: {1,-8} Path: {2}", entry.Index, Utilities.ApproximateDiskSize(size), path); } } } }
protected override void DoRun() { if (DiskSize <= 0) { DisplayHelp(); return; } using (VirtualDisk sourceDisk = VirtualDisk.OpenDisk(_sourceFile.Value, FileAccess.Read, UserName, Password)) using (VirtualDisk destDisk = VirtualDisk.CreateDisk(OutputDiskType, OutputDiskVariant, _destFile.Value, DiskParameters, UserName, Password)) { if (destDisk is DiscUtils.Vhd.Disk) { ((DiscUtils.Vhd.Disk)destDisk).AutoCommitFooter = false; } // Copy the MBR from the source disk, and invent a new signature for this new disk destDisk.SetMasterBootRecord(sourceDisk.GetMasterBootRecord()); destDisk.Signature = new Random().Next(); SparseStream sourcePartStream = SparseStream.FromStream(sourceDisk.Partitions[0].Open(), Ownership.None); NtfsFileSystem sourceNtfs = new NtfsFileSystem(sourcePartStream); // Copy the OS boot code into memory, so we can apply it when formatting the new disk byte[] bootCode; using (Stream bootStream = sourceNtfs.OpenFile("$Boot", FileMode.Open, FileAccess.Read)) { bootCode = new byte[bootStream.Length]; int totalRead = 0; while (totalRead < bootCode.Length) { totalRead += bootStream.Read(bootCode, totalRead, bootCode.Length - totalRead); } } // Partition the new disk with a single NTFS partition BiosPartitionTable.Initialize(destDisk, WellKnownPartitionType.WindowsNtfs); VolumeManager volMgr = new VolumeManager(destDisk); string label = _labelSwitch.IsPresent ? _labelSwitch.Value : sourceNtfs.VolumeLabel; using (NtfsFileSystem destNtfs = NtfsFileSystem.Format(volMgr.GetLogicalVolumes()[0], label, bootCode)) { destNtfs.SetSecurity(@"\", sourceNtfs.GetSecurity(@"\")); destNtfs.NtfsOptions.ShortNameCreation = ShortFileNameOption.Disabled; sourceNtfs.NtfsOptions.HideHiddenFiles = false; sourceNtfs.NtfsOptions.HideSystemFiles = false; CopyFiles(sourceNtfs, destNtfs, @"\", true); if (destNtfs.FileExists(@"\boot\BCD")) { // Force all boot entries in the BCD to point to the newly created NTFS partition - does _not_ cope with // complex multi-volume / multi-boot scenarios at all. using (Stream bcdStream = destNtfs.OpenFile(@"\boot\BCD", FileMode.Open, FileAccess.ReadWrite)) { using (RegistryHive hive = new RegistryHive(bcdStream)) { Store store = new Store(hive.Root); foreach (var obj in store.Objects) { foreach (var elem in obj.Elements) { if (elem.Format == DiscUtils.BootConfig.ElementFormat.Device) { elem.Value = DiscUtils.BootConfig.ElementValue.ForDevice(elem.Value.ParentObject, volMgr.GetPhysicalVolumes()[0]); } } } } } } } } }
private void FixBCD(NtfsFileSystem ntfs, VolumeManager volMgr) { if (ntfs.FileExists(@"\boot\BCD")) { // Force all boot entries in the BCD to point to the newly created NTFS partition - does _not_ cope with // complex multi-volume / multi-boot scenarios at all. using (Stream bcdStream = ntfs.OpenFile(@"\boot\BCD", FileMode.Open, FileAccess.ReadWrite)) { using (RegistryHive hive = new RegistryHive(bcdStream)) { Store store = new Store(hive.Root); foreach (var obj in store.Objects) { foreach (var elem in obj.Elements) { if (elem.Format == DiscUtils.BootConfig.ElementFormat.Device) { elem.Value = DiscUtils.BootConfig.ElementValue.ForDevice(elem.Value.ParentObject, volMgr.GetPhysicalVolumes()[0]); } } } } } } }