internal IndexAllocation(NonResident header, string volume) { // Headers Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = header.NameString; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // Get IndexAllocation Bytes byte[] bytes = header.GetBytes(volume); // Instantiate empty IndexEntry List List<IndexEntry> indexEntryList = new List<IndexEntry>(); // Iterate through IndexBlocks (4096 bytes in size) for (int offset = 0; offset < bytes.Length; offset += 4096) { // Detemine size of Update Sequence ushort usOffset = BitConverter.ToUInt16(bytes, offset + 0x04); ushort usSize = BitConverter.ToUInt16(bytes, offset + 0x06); int indexBlockSize = usOffset + (usSize * 2); if (indexBlockSize == 0) { break; } IndexBlock.ApplyFixup(ref bytes, offset); // Instantiate IndexBlock Object (Header) IndexBlock indexBlock = new IndexBlock(Helper.GetSubArray(bytes, offset, indexBlockSize)); if (indexBlock.Signature == "INDX") { // Create byte array for IndexEntry object // 0x18 represents the offset of the EntryOffset value, so it must be added on byte[] indexEntryBytes = Helper.GetSubArray(bytes, offset + (int)indexBlock.EntryOffset + 0x18, (int)indexBlock.TotalEntrySize); int entryOffset = 0; do { // Instantiate an IndexEntry Object IndexEntry indexEntry = new IndexEntry(Helper.GetSubArray(indexEntryBytes, entryOffset, BitConverter.ToUInt16(indexEntryBytes, entryOffset + 0x08))); entryOffset += indexEntry.Size; // Check if entry is the last in the Entry array if (indexEntry.Flags == 0x02 || indexEntry.Flags == 0x03) { break; } // Add IndexEntry Object to list indexEntryList.Add(indexEntry); } while (entryOffset < indexEntryBytes.Length); } } Entries = indexEntryList.ToArray(); }
public static IndexEntry[] GetInstances(string path) { string[] paths = path.TrimEnd('\\').Split('\\'); // Determine Volume Name string volume = Helper.GetVolumeFromPath(path); // Test volume path Helper.getVolumeName(ref volume); int index = -1; List<IndexEntry> indexEntryList = new List<IndexEntry>(); for (int i = 0; i < paths.Length; i++) { if (index == -1) { index = 5; } else { bool match = false; foreach (IndexEntry entry in indexEntryList) { if (entry.Entry.Filename.ToUpper() == paths[i].ToUpper()) { index = (int)entry.RecordNumber; match = true; } } if (!(match)) { throw new Exception("Path " + path + " not found."); } } FileRecord record = FileRecord.Get(volume, index, true); indexEntryList.Clear(); if (record.Directory) { foreach (FileRecordAttribute attr in record.Attribute) { if (attr.Name == FileRecordAttribute.ATTR_TYPE.INDEX_ROOT) { try { foreach (IndexEntry entry in (attr as IndexRoot).Entries) { if (entry.Entry.Namespace != 0x02) { StringBuilder sb = new StringBuilder(); sb.Append(path.TrimEnd('\\')); sb.Append("\\"); sb.Append(entry.Filename); entry.FullName = sb.ToString(); indexEntryList.Add(entry); } } } catch { return null; } } else if (attr.Name == FileRecordAttribute.ATTR_TYPE.INDEX_ALLOCATION) { // Get INDEX_ALLOCATION bytes IndexAllocation IA = new IndexAllocation(attr as NonResident, volume); foreach (IndexEntry entry in IA.Entries) { if (entry.Entry.Namespace != 0x02) { StringBuilder sb = new StringBuilder(); sb.Append(path.TrimEnd('\\')); sb.Append("\\"); sb.Append(entry.Filename); entry.FullName = sb.ToString(); indexEntryList.Add(entry); } } } } } else { IndexEntry[] indexArray = new IndexEntry[1]; indexArray[0] = new IndexEntry(record); return indexArray; } } return indexEntryList.ToArray(); }
internal IndexRoot(ResidentHeader header, byte[] bytes, int offset, string attrName) { #region ResidentHeader // Get ResidentHeader (includes Common Header) Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; AttributeSize = header.commonHeader.TotalSize; #endregion ResidentHeader #region IndexRoot // IndexRoot AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(bytes, 0x00 + offset); CollationSortingRule = BitConverter.ToUInt32(bytes, 0x04 + offset); IndexSize = BitConverter.ToUInt32(bytes, 0x08 + offset); ClustersPerIndexRecord = bytes[0x0C + offset]; #endregion IndexRoot #region IndexHeader // IndexHeader StartOffset = (BitConverter.ToInt32(bytes, 0x10 + offset) + 0x10 + offset); // Add 0x10 bytes to start offset to account for its offset TotalSize = BitConverter.ToInt32(bytes, 0x14 + offset); AllocatedSize = BitConverter.ToInt32(bytes, 0x18 + offset); Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(bytes, 0x1C + offset)); #endregion IndexHeader #region IndexEntryArray // IndexEntry[] byte[] EntryBytes = Helper.GetSubArray(bytes, StartOffset, TotalSize); // Iterate through IndexEntry object int indexEntryOffset = 0; if (AttributeType == ATTR_TYPE.FILE_NAME) { // Instantiate empty IndexEntry List List<IndexEntry> entryList = new List<IndexEntry>(); while (indexEntryOffset < (EntryBytes.Length - 0x10)) { // There has to be a better way if(BitConverter.ToUInt16(EntryBytes, 0x0A + indexEntryOffset) == 0) { break; } // Instantiate an IndexEntry Object IndexEntry indexEntry = new IndexEntry(EntryBytes, indexEntryOffset); // Add IndexEntry Object to FileName List entryList.Add(indexEntry); // Increment indexEntryOffset indexEntryOffset += indexEntry.Size; } Entries = entryList.ToArray(); } #endregion IndexEntryArray }
internal IndexRoot(ResidentHeader header, byte[] attrBytes, string attrName) { #region ResidentHeader // Get ResidentHeader (includes Common Header) Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; #endregion ResidentHeader #region IndexRoot // IndexRoot AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(attrBytes, 0x00); CollationSortingRule = BitConverter.ToUInt32(attrBytes, 0x04); IndexSize = BitConverter.ToUInt32(attrBytes, 0x08); ClustersPerIndexRecord = attrBytes[0x0C]; #endregion IndexRoot #region IndexHeader // IndexHeader StartOffset = (BitConverter.ToUInt32(attrBytes, 0x10) + 0x10); // Add 0x10 bytes to start offset to account for its offset TotalSize = BitConverter.ToUInt32(attrBytes, 0x14); AllocatedSize = BitConverter.ToUInt32(attrBytes, 0x18); Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(attrBytes, 0x1C)); #endregion IndexHeader #region IndexEntryArray if(TotalSize > StartOffset){ // IndexEntry[] byte[] EntryBytes = Util.GetSubArray(attrBytes, StartOffset, TotalSize - StartOffset); // Iterate through IndexEntry object int indexEntryOffset = 0; if (AttributeType == ATTR_TYPE.FILE_NAME) { // Instantiate empty IndexEntry List List<IndexEntry> entryList = new List<IndexEntry>(); while (indexEntryOffset < (EntryBytes.Length - 0x10)) { // Creat byte array representing IndexEntry Object int indexEntrySizeOffset = indexEntryOffset + 0x08; // Instantiate an IndexEntry Object IndexEntry indexEntry = new IndexEntry(Util.GetSubArray(EntryBytes, (uint)indexEntryOffset, (uint)BitConverter.ToUInt16(EntryBytes, indexEntrySizeOffset))); // Add IndexEntry Object to FileName List entryList.Add(indexEntry); // Increment indexEntryOffset indexEntryOffset += indexEntry.Size; } Entries = entryList.ToArray(); } } #endregion IndexEntryArray }
public static IndexEntry[] GetInstances(string path) { string[] paths = path.TrimEnd('\\').Split('\\'); // Determine Volume Name string volume = Helper.GetVolumeFromPath(path); // Test volume path Helper.getVolumeName(ref volume); int index = -1; List <IndexEntry> indexEntryList = new List <IndexEntry>(); for (int i = 0; i < paths.Length; i++) { if (index == -1) { index = 5; } else { bool match = false; foreach (IndexEntry entry in indexEntryList) { if (entry.Entry.Filename.ToUpper() == paths[i].ToUpper()) { index = (int)entry.RecordNumber; match = true; } } if (!(match)) { throw new Exception("Path " + path + " not found."); } } FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, index), volume, true); indexEntryList.Clear(); if (record.Directory) { foreach (FileRecordAttribute attr in record.Attribute) { if (attr.Name == FileRecordAttribute.ATTR_TYPE.INDEX_ROOT) { try { foreach (IndexEntry entry in (attr as IndexRoot).Entries) { if (entry.Entry.Namespace != 0x02) { StringBuilder sb = new StringBuilder(); sb.Append(path.TrimEnd('\\')); sb.Append("\\"); sb.Append(entry.Filename); entry.FullName = sb.ToString(); indexEntryList.Add(entry); } } } catch { return(null); } } else if (attr.Name == FileRecordAttribute.ATTR_TYPE.INDEX_ALLOCATION) { // Get INDEX_ALLOCATION bytes IndexAllocation IA = new IndexAllocation(attr as NonResident, volume); foreach (IndexEntry entry in IA.Entries) { if (entry.Entry.Namespace != 0x02) { StringBuilder sb = new StringBuilder(); sb.Append(path.TrimEnd('\\')); sb.Append("\\"); sb.Append(entry.Filename); entry.FullName = sb.ToString(); indexEntryList.Add(entry); } } } } } else { IndexEntry[] indexArray = new IndexEntry[1]; indexArray[0] = new IndexEntry(record); return(indexArray); } } return(indexEntryList.ToArray()); }
public static UsnJrnl[] GetInstances(string volume) { IndexEntry entry = IndexEntry.Get(volume.Split('\\')[3] + "\\$Extend\\$UsnJrnl"); return(GetInstances(volume, (int)entry.RecordNumber)); }
internal IndexRoot(ResidentHeader header, byte[] attrBytes, string attrName) { #region ResidentHeader // Get ResidentHeader (includes Common Header) Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; #endregion ResidentHeader #region IndexRoot // IndexRoot AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(attrBytes, 0x00); CollationSortingRule = BitConverter.ToUInt32(attrBytes, 0x04); IndexSize = BitConverter.ToUInt32(attrBytes, 0x08); ClustersPerIndexRecord = attrBytes[0x0C]; #endregion IndexRoot #region IndexHeader // IndexHeader StartOffset = (BitConverter.ToUInt32(attrBytes, 0x10) + 0x10); // Add 0x10 bytes to start offset to account for its offset TotalSize = BitConverter.ToUInt32(attrBytes, 0x14); AllocatedSize = BitConverter.ToUInt32(attrBytes, 0x18); Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(attrBytes, 0x1C)); #endregion IndexHeader #region IndexEntryArray if (TotalSize > StartOffset) { // IndexEntry[] byte[] EntryBytes = NativeMethods.GetSubArray(attrBytes, StartOffset, TotalSize - StartOffset); // Iterate through IndexEntry object int indexEntryOffset = 0; if (AttributeType == ATTR_TYPE.FILE_NAME) { // Instantiate empty IndexEntry List List <IndexEntry> entryList = new List <IndexEntry>(); while (indexEntryOffset < (EntryBytes.Length - 0x10)) { // Creat byte array representing IndexEntry Object int indexEntrySizeOffset = indexEntryOffset + 0x08; // Instantiate an IndexEntry Object IndexEntry indexEntry = new IndexEntry(NativeMethods.GetSubArray(EntryBytes, (uint)indexEntryOffset, (uint)BitConverter.ToUInt16(EntryBytes, indexEntrySizeOffset))); // Add IndexEntry Object to FileName List entryList.Add(indexEntry); // Increment indexEntryOffset indexEntryOffset += indexEntry.Size; } Entries = entryList.ToArray(); } } #endregion IndexEntryArray }
internal IndexRoot(ResidentHeader header, byte[] bytes, int offset, string attrName) { #region ResidentHeader // Get ResidentHeader (includes Common Header) Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; AttributeSize = header.commonHeader.TotalSize; #endregion ResidentHeader #region IndexRoot // IndexRoot AttributeType = (ATTR_TYPE)BitConverter.ToUInt32(bytes, 0x00 + offset); CollationSortingRule = BitConverter.ToUInt32(bytes, 0x04 + offset); IndexSize = BitConverter.ToUInt32(bytes, 0x08 + offset); ClustersPerIndexRecord = bytes[0x0C + offset]; #endregion IndexRoot #region IndexHeader // IndexHeader StartOffset = (BitConverter.ToInt32(bytes, 0x10 + offset) + 0x10 + offset); // Add 0x10 bytes to start offset to account for its offset TotalSize = BitConverter.ToInt32(bytes, 0x14 + offset); AllocatedSize = BitConverter.ToInt32(bytes, 0x18 + offset); Flags = ((INDEX_ROOT_FLAGS)BitConverter.ToUInt32(bytes, 0x1C + offset)); #endregion IndexHeader #region IndexEntryArray // IndexEntry[] byte[] EntryBytes = Helper.GetSubArray(bytes, StartOffset, TotalSize); // Iterate through IndexEntry object int indexEntryOffset = 0; if (AttributeType == ATTR_TYPE.FILE_NAME) { // Instantiate empty IndexEntry List List <IndexEntry> entryList = new List <IndexEntry>(); while (indexEntryOffset < (EntryBytes.Length - 0x10)) { // There has to be a better way if (BitConverter.ToUInt16(EntryBytes, 0x0A + indexEntryOffset) == 0) { break; } // Instantiate an IndexEntry Object IndexEntry indexEntry = new IndexEntry(EntryBytes, indexEntryOffset); // Add IndexEntry Object to FileName List entryList.Add(indexEntry); // Increment indexEntryOffset indexEntryOffset += indexEntry.Size; } Entries = entryList.ToArray(); } #endregion IndexEntryArray }