static void TestStream() { const string IMAGE_FILE = @"test.jpg"; const string THUMB_STREAM = "thumb"; //List all of the alternative streams for the file: NTFS.FileStreams FS = new NTFS.FileStreams(IMAGE_FILE); Console.WriteLine(FS.FileName); foreach (NTFS.StreamInfo s in FS) { Console.WriteLine("\t" + s.Name); } //Using an alternative stream to store a thumbnail image: System.Drawing.Image thm; System.IO.FileStream FileStream; int i = FS.IndexOf(THUMB_STREAM); if (i == -1) { //Thumbnail stream not found - create and store the thumbnail: Console.WriteLine("Creating thumbnail:"); System.Drawing.Image img = System.Drawing.Image.FromFile(IMAGE_FILE); int Width = 100; int Height = 100; //Maintain aspect ratio: int lW = (int)(img.Width * Height / img.Height); int lH = (int)(img.Height * Width / img.Width); if (lW > Width) { Height = lH; } else if (lH > Height) { Width = lW; } thm = img.GetThumbnailImage(Width, Height, null, IntPtr.Zero); //Save the thumbnail to the stream FS.Add(THUMB_STREAM); FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.OpenOrCreate, System.IO.FileAccess.Write); thm.Save(FileStream, System.Drawing.Imaging.ImageFormat.Jpeg); FileStream.Close(); Console.WriteLine("Created thumbnail: Size {0}x{1}", thm.Width, thm.Height); } else { //Thumbnail stream exists - read the thumbnail back Console.WriteLine("Thumbnail already exists!"); FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.Open, System.IO.FileAccess.Read); thm = System.Drawing.Image.FromStream(FileStream); FileStream.Close(); Console.WriteLine("Read thumbnail: Size {0}x{1}", thm.Width, thm.Height); //Remove the thumbnail stream, for demo purposes only! FS.Remove(THUMB_STREAM); } }
/// <summary> /// Exports a streams' content to a file. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void exportStreamToFileToolStripMenuItem_Click(object sender, EventArgs e) { DataRowView drv = dataGridResult.SelectedRows[0].DataBoundItem as DataRowView; FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow; NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name); foreach (NTFS.StreamInfo s in FS) { if (s.Name == fir.Stream_Name) { if (saveFileDialogExport.ShowDialog() == DialogResult.OK) { using (FileStream input = s.Open(FileMode.Open)) { using (FileStream output = new FileStream(saveFileDialogExport.FileName, FileMode.Create)) { int bufferSize = 4096; byte[] buffer = new byte[bufferSize]; while (true) { int read = input.Read(buffer, 0, buffer.Length); if (read <= 0) { return; } output.Write(buffer, 0, read); } } } } } } }
static void TestStream() { const string IMAGE_FILE = @"..\..\test.jpg"; const string THUMB_STREAM = "thumb"; //List all of the alternative streams for the file: NTFS.FileStreams FS = new NTFS.FileStreams(IMAGE_FILE); Console.WriteLine(FS.FileName); foreach(NTFS.StreamInfo s in FS) Console.WriteLine("\t" + s.Name); //Using an alternative stream to store a thumbnail image: System.Drawing.Image thm; System.IO.FileStream FileStream; int i = FS.IndexOf(THUMB_STREAM); if (i==-1) { //Thumbnail stream not found - create and store the thumbnail: Console.WriteLine("Creating thumbnail:"); System.Drawing.Image img = System.Drawing.Image.FromFile(IMAGE_FILE); int Width = 100; int Height = 100; //Maintain aspect ratio: int lW = (int)(img.Width * Height / img.Height); int lH = (int)(img.Height * Width / img.Width); if (lW>Width) Height = lH; else if (lH>Height) Width = lW; thm = img.GetThumbnailImage(Width, Height, null, IntPtr.Zero); //Save the thumbnail to the stream FS.Add(THUMB_STREAM); FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.OpenOrCreate, System.IO.FileAccess.Write); thm.Save(FileStream, System.Drawing.Imaging.ImageFormat.Jpeg); FileStream.Close(); Console.WriteLine("Created thumbnail: Size {0}x{1}", thm.Width, thm.Height); } else { //Thumbnail stream exists - read the thumbnail back Console.WriteLine("Thumbnail already exists!"); FileStream = FS[THUMB_STREAM].Open(System.IO.FileMode.Open, System.IO.FileAccess.Read); thm = System.Drawing.Image.FromStream(FileStream); FileStream.Close(); Console.WriteLine("Read thumbnail: Size {0}x{1}", thm.Width, thm.Height); //Remove the thumbnail stream, for demo purposes only! FS.Remove(THUMB_STREAM); } }
/// <summary> /// If the user deletes one or more rows, delete the streams on the file system. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void dataGridResult_UserDeletingRow(object sender, DataGridViewRowCancelEventArgs e) { DataRowView drv = e.Row.DataBoundItem as DataRowView; FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow; NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name); foreach (NTFS.StreamInfo s in FS) { if (s.Name == fir.Stream_Name) { s.Delete(); } } }
/// <summary> /// Scans a given directory for alternate data streams. /// </summary> /// <param name="sDir">The directory root.</param> /// <param name="subFolders">Scan subdirectories recursive?</param> private void DirSearch(string sDir, bool subFolders) { try { foreach (string f in Directory.GetFiles(sDir)) { ReportDirName(f); FileInfo FSInfo = new FileInfo(f); NTFS.FileStreams FS = new NTFS.FileStreams(f); foreach (NTFS.StreamInfo s in FS) { if (backgroundWorkerScan.CancellationPending) { return; } FileInfoStruct fis; fis.File_Name = FS.FileName; fis.Stream_Name = s.Name; fis.Stream_Size = s.Size; fis.Location = FSInfo.DirectoryName; fis.Creation_Date = FSInfo.CreationTime; ArrayFileInfo.Add(fis); } } // update the results label backgroundWorkerScan.ReportProgress(this.ArrayFileInfo.Count); if (subFolders) { foreach (string d in Directory.GetDirectories(sDir)) { if (backgroundWorkerScan.CancellationPending) { return; } DirSearch(d, subFolders); } } } catch { } }
/// <summary> /// Opens hex editor on row double click. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void dataGridResult_CellDoubleClick(object sender, DataGridViewCellEventArgs e) { DataGridView dgv = sender as DataGridView; DataRowView drv = dgv.Rows[e.RowIndex].DataBoundItem as DataRowView; FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow; HexEditor he = new HexEditor(); NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name); foreach (NTFS.StreamInfo s in FS) { if (s.Name == fir.Stream_Name) { using (FileStream fs = s.Open(FileMode.Open)) { if (fs == null) { MessageBox.Show("Accessing acquired file failed, " + "maybe you have insufficient rights or the file is in use.", "Access failed", MessageBoxButtons.OK, MessageBoxIcon.Error); return; } he.labelFileName.Text = fir.File_Name; he.labelStreamName.Text = fir.Stream_Name; he.fileStream = fs; he.hexBoxFileContent.ByteProvider = new DynamicFileByteProvider(fs); he.ShowDialog(); } } } he.Dispose(); he = null; }
/// <summary> /// Scans a given directory for alternate data streams. /// </summary> /// <param name="sDir">The directory root.</param> /// <param name="subFolders">Scan subdirectories recursive?</param> private void DirSearch(string sDir, bool subFolders) { try { foreach (string f in Directory.GetFiles(sDir)) { ReportDirName(f); FileInfo FSInfo = new FileInfo(f); NTFS.FileStreams FS = new NTFS.FileStreams(f); foreach (NTFS.StreamInfo s in FS) { if (backgroundWorkerScan.CancellationPending) return; FileInfoStruct fis; fis.File_Name = FS.FileName; fis.Stream_Name = s.Name; fis.Stream_Size = s.Size; fis.Location = FSInfo.DirectoryName; fis.Creation_Date = FSInfo.CreationTime; ArrayFileInfo.Add(fis); } } // update the results label backgroundWorkerScan.ReportProgress(this.ArrayFileInfo.Count); if (subFolders) { foreach (string d in Directory.GetDirectories(sDir)) { if (backgroundWorkerScan.CancellationPending) return; DirSearch(d, subFolders); } } } catch { } }
/// <summary> /// If the user deletes one or more rows, delete the streams on the file system. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void dataGridResult_UserDeletingRow(object sender, DataGridViewRowCancelEventArgs e) { DataRowView drv = e.Row.DataBoundItem as DataRowView; FileInfoData.FileInfoRow fir = drv.Row as FileInfoData.FileInfoRow; NTFS.FileStreams FS = new NTFS.FileStreams(fir.File_Name); foreach (NTFS.StreamInfo s in FS) if (s.Name == fir.Stream_Name) s.Delete(); }