예제 #1
0
        public byte[] ReadMFTRecordData(uint number)
        {
            int  length = (int)(BytesPrFileRecord == 0 ? 4096 : BytesPrFileRecord);
            long offset = number * length;

            // Calculate location
            if (InRawDiskCache(number))
            {
                byte[] mftData     = new byte[length];
                int    cacheOffset = (int)(offset - MftRawCache.DataOffset);

                Array.Copy(MftRawCache.Data, cacheOffset, mftData, 0, mftData.Length);

                Debug.WriteLine($"Read MFT Record {number} via. RAW CACHE; bytes {offset}->{offset + (long)length} ({length} bytes)");
                return(mftData);
            }

            if (Provider.MftFileOnly)
            {
                // Is a continous file - ignore MFT fragments
                // Offset is still correct.
            }
            else if (FileMFT == null)
            {
                // We haven't got the $MFT yet, ignore MFT fragments
                // Ofsset into the MFT beginning region
                offset += (long)(Boot.MFTCluster * BytesPrCluster);
            }
            else if (MftStream != null)
            {
                byte[] mftData = new byte[length];

                MftStream.Seek(offset, SeekOrigin.Begin);
                MftStream.Read(mftData, 0, length);

                Debug.WriteLine($"Read MFT Record {number} via. NTFSDISKSTREAM; bytes {offset}->{offset + (long)length} ({length} bytes)");
                return(mftData);
            }
            else
            {
                throw new Exception("Shouldn't happen");
            }

            if (!Provider.CanReadBytes((ulong)offset, length))
            {
                Debug.WriteLine($"Couldn't read MFT Record {number}; bytes {offset}->{offset + (long)length} ({length} bytes)");
                return(new byte[0]);
            }

            Debug.WriteLine($"Read MFT Record {number}; bytes {offset}->{offset + (long)length} ({length} bytes)");

            byte[] data = new byte[length];
            Provider.ReadBytes(data, 0, (ulong)offset, length);

            return(data);
        }
예제 #2
0
        public void PrepRawDiskCache(uint number)
        {
            Debug.Assert(MftStream != null);
            Debug.Assert(BytesPrFileRecord > 0);
            Debug.Assert(number < FileRecordCount);

            uint offset = number * BytesPrFileRecord;
            int  toRead = (int)Math.Min(MftStream.Length - offset, MftRawCache.Data.Length);

            Debug.WriteLine("Fetching {0:N0} bytes (record #{1:N0}) from disk into RawDiskCache", toRead, number);

            // Read
            MftStream.Seek(offset, SeekOrigin.Begin);
            MftStream.Read(MftRawCache.Data, 0, toRead);

            // Set props
            MftRawCache.DataOffset = offset;
            MftRawCache.Length     = toRead;
        }
예제 #3
0
        public byte[] ReadMftRecordData(uint number)
        {
            var  length = BytesPerFileRecord == 0 ? 4096 : BytesPerFileRecord;
            long offset = number * length;

            if (MftFile == null)
            {
                offset += (long)(BootSector.MftCluster * BytesPerCluster);
            }
            else if (MftStream != null)
            {
                var mftData = new byte[length];
                MftStream.Seek(offset, SeekOrigin.Begin);
                MftStream.Read(mftData, 0, mftData.Length);
                return(mftData);
            }

            var data = new byte[length];

            DiskStream.Seek(offset, SeekOrigin.Begin);
            DiskStream.Read(data, 0, data.Length);
            return(data);
        }