public virtual void Dump(TextWriter writer, string indent) { writer.WriteLine(indent + "FILE (" + ToString() + ")"); writer.WriteLine(indent + " File Number: " + _records[0].MasterFileTableIndex); _records[0].Dump(writer, indent + " "); foreach (AttributeRecord attrRec in _records[0].Attributes) { NtfsAttribute.FromRecord(this, MftReference, attrRec).Dump(writer, indent + " "); } }
/// <summary> /// Creates a new attribute at a fixed cluster. /// </summary> /// <param name="type">The type of the new attribute</param> /// <param name="name">The name of the new attribute</param> /// <param name="flags">The flags of the new attribute</param> /// <param name="firstCluster">The first cluster to assign to the attribute</param> /// <param name="numClusters">The number of sequential clusters to assign to the attribute</param> /// <param name="bytesPerCluster">The number of bytes in each cluster</param> /// <returns>The new attribute</returns> private NtfsAttribute CreateAttribute(AttributeType type, string name, AttributeFlags flags, long firstCluster, ulong numClusters, uint bytesPerCluster) { bool indexed = _context.AttributeDefinitions.IsIndexed(type); ushort id = _records[0].CreateNonResidentAttribute(type, name, flags, firstCluster, numClusters, bytesPerCluster); AttributeRecord newAttrRecord = _records[0].GetAttribute(id); NtfsAttribute newAttr = NtfsAttribute.FromRecord(this, MftReference, newAttrRecord); _attributes.Add(newAttr); UpdateAttributeList(); MarkMftRecordDirty(); return(newAttr); }
/// <summary> /// Creates a new attribute. /// </summary> /// <param name="type">The type of the new attribute</param> /// <param name="name">The name of the new attribute</param> /// <param name="flags">The flags of the new attribute</param> /// <returns>The new attribute</returns> private NtfsAttribute CreateAttribute(AttributeType type, string name, AttributeFlags flags) { bool indexed = _context.AttributeDefinitions.IsIndexed(type); ushort id = _records[0].CreateAttribute(type, name, indexed, flags); AttributeRecord newAttrRecord = _records[0].GetAttribute(id); NtfsAttribute newAttr = NtfsAttribute.FromRecord(this, MftReference, newAttrRecord); _attributes.Add(newAttr); UpdateAttributeList(); MarkMftRecordDirty(); return(newAttr); }
public override string ToString() { foreach (AttributeRecord attr in _attributes) { if (attr.AttributeType == AttributeType.FileName) { StructuredNtfsAttribute <FileNameRecord> fnAttr = (StructuredNtfsAttribute <FileNameRecord>)NtfsAttribute.FromRecord(null, new FileRecordReference(0), attr); return(fnAttr.Content.FileName); } } return("No Name"); }
private void CreateAttributeList() { ushort id = _records[0].CreateAttribute(AttributeType.AttributeList, null, false, AttributeFlags.None); StructuredNtfsAttribute <AttributeList> newAttr = (StructuredNtfsAttribute <AttributeList>)NtfsAttribute.FromRecord(this, MftReference, _records[0].GetAttribute(id)); _attributes.Add(newAttr); UpdateAttributeList(); }
private void LoadAttributes() { Dictionary <long, FileRecord> extraFileRecords = new Dictionary <long, FileRecord>(); AttributeRecord attrListRec = _records[0].GetAttribute(AttributeType.AttributeList); if (attrListRec != null) { NtfsAttribute lastAttr = null; StructuredNtfsAttribute <AttributeList> attrListAttr = (StructuredNtfsAttribute <AttributeList>)NtfsAttribute.FromRecord(this, MftReference, attrListRec); var attrList = attrListAttr.Content; _attributes.Add(attrListAttr); foreach (var record in attrList) { FileRecord attrFileRecord = _records[0]; if (record.BaseFileReference.MftIndex != _records[0].MasterFileTableIndex) { if (!extraFileRecords.TryGetValue(record.BaseFileReference.MftIndex, out attrFileRecord)) { attrFileRecord = _context.Mft.GetRecord(record.BaseFileReference); if (attrFileRecord != null) { extraFileRecords[attrFileRecord.MasterFileTableIndex] = attrFileRecord; } } } if (attrFileRecord != null) { AttributeRecord attrRec = attrFileRecord.GetAttribute(record.AttributeId); if (attrRec != null) { if (record.StartVcn == 0) { lastAttr = NtfsAttribute.FromRecord(this, record.BaseFileReference, attrRec); _attributes.Add(lastAttr); } else { lastAttr.AddExtent(record.BaseFileReference, attrRec); } } } } foreach (var extraFileRecord in extraFileRecords) { _records.Add(extraFileRecord.Value); } } else { foreach (var record in _records[0].Attributes) { _attributes.Add(NtfsAttribute.FromRecord(this, MftReference, record)); } } }