// Get Master File Table Bytes for "Get" Methods
// GetBytes will clean up IntPtr (Volume Handle) and FileStream objects
public static byte[] GetBytes(string volume)
{
// Get a handle to the specified volume
IntPtr hVolume = NativeMethods.getHandle(volume);
// Instatiate null byte array
byte[] mftBytes = null;
// Create FileStream to read from the Volume file handle
using (FileStream streamToRead = NativeMethods.getFileStream(hVolume))
{
// Instantiate VolumeData object
VolumeData volData = new VolumeData(hVolume);
// Calculate byte offset to the Master File Table (MFT)
ulong mftOffset = ((ulong)volData.BytesPerCluster * volData.MFTStartCluster);
// Read bytes belonging to specified MFT Record and store in byte array
MFTRecord mftRecord = new MFTRecord(NativeMethods.readDrive(streamToRead, mftOffset, (ulong)volData.BytesPerMFTRecord));
mftBytes = MFTRecord.getFile(streamToRead, mftRecord);
}
NativeMethods.CloseHandle(hVolume);
// Return byte array representing the Master File Table
return(mftBytes);
}
public static byte[] GetBytes(IntPtr hVolume, FileStream streamToRead)
{
VolumeData volData = new VolumeData(hVolume);
// Calculate byte offset to the Master File Table (MFT)
ulong mftOffset = ((ulong)volData.BytesPerCluster * volData.MFTStartCluster);
// Read bytes belonging to specified MFT Record and store in byte array
byte[] mftBytes = NativeMethods.readDrive(streamToRead, mftOffset, volData.MFTSize);
return(mftBytes);
}
// Get Master File Table Bytes for "GetInstance" Functions
// Caller is responsible for cleaning up streamToRead and hVolume
public static byte[] GetBytes(IntPtr hVolume, FileStream streamToRead)
{
// Instantiate VolumeData object
VolumeData volData = new VolumeData(hVolume);
// Calculate byte offset to the Master File Table (MFT)
ulong mftOffset = ((ulong)volData.BytesPerCluster * volData.MFTStartCluster);
// Read bytes belonging to specified MFT Record and store in byte array
MFTRecord mftRecord = new MFTRecord(NativeMethods.readDrive(streamToRead, mftOffset, (ulong)volData.BytesPerMFTRecord));
// Return byte array representing the Master File Table
return(MFTRecord.getFile(streamToRead, mftRecord));
}
internal static byte[] getMFTRecordBytes(string volume, int index)
{
// Get handle for volume
IntPtr hVolume = NativeMethods.getHandle(volume);
// Get filestream based on hVolume
FileStream streamToRead = NativeMethods.getFileStream(hVolume);
//
VolumeData volData = new VolumeData(hVolume);
ulong mftStartOffset = volData.MFTStartCluster * (ulong)volData.BytesPerCluster;
ulong recordOffset = mftStartOffset + ((ulong)index * 1024);
return(NativeMethods.readDrive(streamToRead, recordOffset, 1024));
}
internal static AttrDef[] GetInstances(string volumeName)
{
// Get correct volume name from user input
NativeMethods.getVolumeName(ref volumeName);
// Get handle to Logical Volume
IntPtr hVolume = NativeMethods.getHandle(volumeName);
// Instantiate a List of AttrDef objects for output
List <AttrDef> adList = new List <AttrDef>();
// Create a FileStream object for the Volume
using (FileStream streamToRead = NativeMethods.getFileStream(hVolume))
{
// Instantiate a VolumeData object
VolumeData volData = new VolumeData(hVolume);
ulong attrDefOffset = ((volData.MFTStartCluster * (ulong)volData.BytesPerCluster) + ((ulong)volData.BytesPerMFTRecord * 4));
// Get the MFTRecord for the file with a record index of 4 ($AttrDef)
MFTRecord record = new MFTRecord(NativeMethods.readDrive(streamToRead, attrDefOffset, (ulong)volData.BytesPerMFTRecord));
// Get the content of the $AttrDef file in a byte array
byte[] bytes = MFTRecord.getFile(streamToRead, record);
// Iterate through 160 byte chunks (representing an AttrDef object)
for (int i = 0; (i < bytes.Length) && (bytes[i] != 0); i += 160)
{
byte[] attrDefBytes = new byte[160];
Array.Copy(bytes, i, attrDefBytes, 0, attrDefBytes.Length);
// Intantiate a new AttrDef object and add it to the adList List of AttrDef objects
adList.Add(new AttrDef(attrDefBytes));
}
}
NativeMethods.CloseHandle(hVolume);
// Return an array of AttrDef objects
return(adList.ToArray());
}