public List <AttributeListEntry> ReadEntries() { byte[] data = ReadClusters(0, (int)ClusterCount); List <AttributeListEntry> entries = new List <AttributeListEntry>(); int position = 0; while (position < data.Length) { AttributeListEntry entry = new AttributeListEntry(data, position); entries.Add(entry); position += entry.LengthOnDisk; } return(entries); }
public AttributeListRecord(NTFSVolume volume, AttributeRecord record) { m_volume = volume; m_record = record; byte[] data = m_record.GetData(volume); int position = 0; while (position < data.Length) { AttributeListEntry entry = new AttributeListEntry(data, position); AttributeList.Add(entry); position += entry.Length; if (entry.Length < AttributeListEntry.HeaderLength) { string message = String.Format("Invalid attribute list entry, data length: {0}, position: {1}", data.Length, position); throw new Exception(message); } } }
/// <remarks> /// An attribute list MUST be sorted by AttributeType with a secondary sort by AttributeName. /// </remarks> public static List <AttributeListEntry> BuildAttributeList(List <FileRecordSegment> segments, int bytesPerFileRecordSegment, ushort minorNTFSVersion) { int bytesAvailableInSegment = FileRecordSegment.GetNumberOfBytesAvailable(bytesPerFileRecordSegment, minorNTFSVersion); List <AttributeListEntry> result = new List <AttributeListEntry>(); foreach (FileRecordSegment segment in segments) { foreach (AttributeRecord attribute in segment.ImmediateAttributes) { AttributeListEntry entry = new AttributeListEntry(); entry.AttributeType = attribute.AttributeType; if (attribute is NonResidentAttributeRecord) { entry.LowestVCN = ((NonResidentAttributeRecord)attribute).LowestVCN; } entry.SegmentReference = segment.SegmentReference; entry.Instance = attribute.Instance; entry.AttributeName = attribute.Name; result.Add(entry); } } return(result); }