public FileRecordSegment(byte[] buffer, int offset, long segmentNumber) { MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00); if (multiSectorHeader.Signature != ValidSignature) { throw new InvalidDataException("Invalid FILE record signature"); } LogFileSequenceNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x08); m_sequenceNumber = LittleEndianConverter.ToUInt16(buffer, offset + 0x10); ReferenceCount = LittleEndianConverter.ToUInt16(buffer, offset + 0x12); ushort firstAttributeOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x14); m_flags = (FileRecordFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x16); uint segmentLength = LittleEndianConverter.ToUInt32(buffer, offset + 0x18); uint segmentAllocatedLength = LittleEndianConverter.ToUInt32(buffer, offset + 0x1C); m_baseFileRecordSegment = new MftSegmentReference(buffer, offset + 0x20); NextAttributeInstance = LittleEndianConverter.ToUInt16(buffer, offset + 0x28); // 2 bytes padding m_segmentNumberOnDisk = LittleEndianConverter.ToUInt32(buffer, offset + 0x2C); int position = offset + multiSectorHeader.UpdateSequenceArrayOffset; List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber); MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData); // Read attributes position = offset + firstAttributeOffset; while (!IsEndMarker(buffer, position)) { AttributeRecord attribute = AttributeRecord.FromBytes(buffer, position); m_immediateAttributes.Add(attribute); position += (int)attribute.RecordLengthOnDisk; if (position > buffer.Length) { throw new InvalidDataException("Invalid attribute length"); } } m_segmentNumber = segmentNumber; }
public IndexRecord(byte[] buffer, int offset) { MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00); if (multiSectorHeader.Signature != ValidSignature) { throw new InvalidDataException("Invalid INDX record signature"); } LogFileSequenceNumber = LittleEndianConverter.ToUInt64(buffer, offset + 0x08); RecordVBN = (long)LittleEndianConverter.ToUInt64(buffer, offset + 0x10); m_indexHeader = new IndexHeader(buffer, offset + 0x18); int position = offset + multiSectorHeader.UpdateSequenceArrayOffset; List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber); MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData); int entriesOffset = 0x18 + (int)m_indexHeader.EntriesOffset; IndexEntries = IndexEntry.ReadIndexEntries(buffer, entriesOffset); }
public LogRecordPage(byte[] buffer, int offset, int dataOffset) { MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00); if (multiSectorHeader.Signature != ValidSignature) { throw new InvalidDataException("Invalid RCRD record signature"); } LastLsnOrFileOffset = LittleEndianConverter.ToUInt64(buffer, offset + 0x08); Flags = (LogRecordPageFlags)LittleEndianConverter.ToUInt32(buffer, offset + 0x10); PageCount = LittleEndianConverter.ToUInt16(buffer, offset + 0x14); PagePosition = LittleEndianConverter.ToUInt16(buffer, offset + 0x16); ushort nextRecordOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x18); LastEndLsn = LittleEndianConverter.ToUInt64(buffer, offset + 0x20); int position = offset + multiSectorHeader.UpdateSequenceArrayOffset; List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber); MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData); Data = ByteReader.ReadBytes(buffer, offset + dataOffset, (int)(nextRecordOffset - dataOffset)); }
public LogRestartPage(byte[] buffer, int offset) { MultiSectorHeader multiSectorHeader = new MultiSectorHeader(buffer, offset + 0x00); if (multiSectorHeader.Signature != ValidSignature) { throw new InvalidDataException("Invalid RSTR record signature"); } ChkDskLsn = LittleEndianConverter.ToUInt64(buffer, offset + 0x08); m_systemPageSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x10); LogPageSize = LittleEndianConverter.ToUInt32(buffer, offset + 0x14); ushort restartOffset = LittleEndianConverter.ToUInt16(buffer, offset + 0x18); MinorVersion = LittleEndianConverter.ToInt16(buffer, offset + 0x1A); MajorVersion = LittleEndianConverter.ToInt16(buffer, offset + 0x1C); int position = offset + multiSectorHeader.UpdateSequenceArrayOffset; List <byte[]> updateSequenceReplacementData = MultiSectorHelper.ReadUpdateSequenceArray(buffer, position, multiSectorHeader.UpdateSequenceArraySize, out UpdateSequenceNumber); MultiSectorHelper.DecodeSegmentBuffer(buffer, offset, UpdateSequenceNumber, updateSequenceReplacementData); LogRestartArea = new LogRestartArea(buffer, offset + restartOffset); }