private byte[] GetOpenAttributeTableBytes(out byte[] attributeNameTableBytes) { List <OpenAttributeEntry> openAttributeTable = new List <OpenAttributeEntry>(); List <AttributeNameEntry> attributeNameTable = new List <AttributeNameEntry>(); for (int index = 0; index < m_openAttributes.Count; index++) { OpenAttribute openAttribute = m_openAttributes[index]; OpenAttributeEntry entry = new OpenAttributeEntry(m_majorVersion); entry.AllocatedOrNextFree = RestartTableEntry.RestartEntryAllocated; // Note: NTFS v5.1 driver calulates AttributeOffset using entry length of 0x28, the reason is unclear but we're immitating this. entry.AttributeOffset = (uint)(RestartTableHeader.Length + index * OpenAttributeEntry.LengthV1); entry.FileReference = openAttribute.FileReference; entry.LsnOfOpenRecord = openAttribute.LsnOfOpenRecord; entry.AttributeTypeCode = openAttribute.AttributeType; openAttributeTable.Add(entry); if (openAttribute.AttributeName != String.Empty) { int openAttributeOffset = OpenAttributeIndexToOffset(index); AttributeNameEntry nameEntry = new AttributeNameEntry(); nameEntry.OpenAttributeOffset = (ushort)openAttributeOffset; nameEntry.Name = openAttribute.AttributeName; attributeNameTable.Add(nameEntry); } } attributeNameTableBytes = null; if (attributeNameTable.Count > 0) { attributeNameTableBytes = AttributeNameEntry.GetTableBytes(attributeNameTable); } return(RestartTableHelper.GetTableBytes <OpenAttributeEntry>(openAttributeTable)); }
public List <AttributeNameEntry> ReadAttributeNamesTable(NTFSRestartRecord restartRecord) { ulong attributeNamesLsn = restartRecord.AttributeNamesLsn; if (attributeNamesLsn != 0) { NTFSLogRecord record = ReadLogRecord(attributeNamesLsn); if (record.RedoOperation != NTFSLogOperation.AttributeNamesDump) { string message = String.Format("Restart record AttributeNamesLsn points to a record with RedoOperation {0}", record.RedoOperation); throw new InvalidDataException(message); } if (restartRecord.AttributeNamesLength != record.RedoData.Length) { throw new InvalidDataException("Open attribute table length does not match restart record"); } return(AttributeNameEntry.ReadTable(record.RedoData)); } else { return(null); } }
public static List <AttributeNameEntry> ReadTable(byte[] tableBytes) { List <AttributeNameEntry> result = new List <AttributeNameEntry>(); int offset = 0; while (offset < tableBytes.Length) { AttributeNameEntry entry = new AttributeNameEntry(tableBytes, offset); if (entry.OpenAttributeOffset == 0 || entry.Name.Length == 0) { break; } result.Add(entry); offset += entry.Length; } return(result); }