public byte[] ReadMFTRecordData(uint number)
{
int length = (int)(BytesPrFileRecord == 0 ? 4096 : BytesPrFileRecord);
long offset = number * length;
// Calculate location
if (InRawDiskCache(number))
{
byte[] mftData = new byte[length];
int cacheOffset = (int)(offset - MftRawCache.DataOffset);
Array.Copy(MftRawCache.Data, cacheOffset, mftData, 0, mftData.Length);
Debug.WriteLine($"Read MFT Record {number} via. RAW CACHE; bytes {offset}->{offset + (long)length} ({length} bytes)");
return(mftData);
}
if (Provider.MftFileOnly)
{
// Is a continous file - ignore MFT fragments
// Offset is still correct.
}
else if (FileMFT == null)
{
// We haven't got the $MFT yet, ignore MFT fragments
// Ofsset into the MFT beginning region
offset += (long)(Boot.MFTCluster * BytesPrCluster);
}
else if (MftStream != null)
{
byte[] mftData = new byte[length];
MftStream.Seek(offset, SeekOrigin.Begin);
MftStream.Read(mftData, 0, length);
Debug.WriteLine($"Read MFT Record {number} via. NTFSDISKSTREAM; bytes {offset}->{offset + (long)length} ({length} bytes)");
return(mftData);
}
else
{
throw new Exception("Shouldn't happen");
}
if (!Provider.CanReadBytes((ulong)offset, length))
{
Debug.WriteLine($"Couldn't read MFT Record {number}; bytes {offset}->{offset + (long)length} ({length} bytes)");
return(new byte[0]);
}
Debug.WriteLine($"Read MFT Record {number}; bytes {offset}->{offset + (long)length} ({length} bytes)");
byte[] data = new byte[length];
Provider.ReadBytes(data, 0, (ulong)offset, length);
return(data);
}
public void PrepRawDiskCache(uint number)
{
Debug.Assert(MftStream != null);
Debug.Assert(BytesPrFileRecord > 0);
Debug.Assert(number < FileRecordCount);
uint offset = number * BytesPrFileRecord;
int toRead = (int)Math.Min(MftStream.Length - offset, MftRawCache.Data.Length);
Debug.WriteLine("Fetching {0:N0} bytes (record #{1:N0}) from disk into RawDiskCache", toRead, number);
// Read
MftStream.Seek(offset, SeekOrigin.Begin);
MftStream.Read(MftRawCache.Data, 0, toRead);
// Set props
MftRawCache.DataOffset = offset;
MftRawCache.Length = toRead;
}
public byte[] ReadMftRecordData(uint number)
{
var length = BytesPerFileRecord == 0 ? 4096 : BytesPerFileRecord;
long offset = number * length;
if (MftFile == null)
{
offset += (long)(BootSector.MftCluster * BytesPerCluster);
}
else if (MftStream != null)
{
var mftData = new byte[length];
MftStream.Seek(offset, SeekOrigin.Begin);
MftStream.Read(mftData, 0, mftData.Length);
return(mftData);
}
var data = new byte[length];
DiskStream.Seek(offset, SeekOrigin.Begin);
DiskStream.Read(data, 0, data.Length);
return(data);
}