예제 #1
0
        private void Initialize()
        {
            byte[] data = new byte[512];
            DiskStream.Seek(0, SeekOrigin.Begin);
            DiskStream.Read(data, 0, data.Length);
            BootSector = BootSector.ParseData(data, 512, 0);

            BytesPerFileRecord = BootSector.MftRecordSizeBytes;
            SectorsPerRecord   = BytesPerFileRecord / BytesPerSector;

            MftFile   = ParseMftRecordData(ReadMftRecordData((uint)MetadataMftFiles.Mft));
            MftStream = OpenFileRecord(MftFile);

            AttributeData mftFileData = null;

            foreach (var att in MftFile.Attributes)
            {
                if (att is AttributeData attributeData)
                {
                    mftFileData = attributeData;
                }
            }

            if (mftFileData == null)
            {
                throw new Exception("ntfs error: unable to load mft data");
            }

            long clusterBytes = 0;

            foreach (var frag in mftFileData.DataFragments)
            {
                clusterBytes += frag.Clusters * BytesPerCluster;
            }

            FileRecordCount = (uint)(clusterBytes / BytesPerFileRecord);
            FileRecords     = new FileRecord[FileRecordCount];
            FileRecords[0]  = MftFile;

            Console.WriteLine("[NTFSDRV2] Initialized with " + FileRecordCount + " file records");
        }
예제 #2
0
        public byte[] ReadMftRecordData(uint number)
        {
            var  length = BytesPerFileRecord == 0 ? 4096 : BytesPerFileRecord;
            long offset = number * length;

            if (MftFile == null)
            {
                offset += (long)(BootSector.MftCluster * BytesPerCluster);
            }
            else if (MftStream != null)
            {
                var mftData = new byte[length];
                MftStream.Seek(offset, SeekOrigin.Begin);
                MftStream.Read(mftData, 0, mftData.Length);
                return(mftData);
            }

            var data = new byte[length];

            DiskStream.Seek(offset, SeekOrigin.Begin);
            DiskStream.Read(data, 0, data.Length);
            return(data);
        }