public Beef0004(byte[] rawBytes) : base(rawBytes) { LocalisedName = string.Empty; MFTInformation = new MFTInformation(); if (Signature != 0xbeef0004) { throw new Exception($"Signature mismatch! Should be 0xbeef0004 but is 0x{Signature:X}"); } var createdDate = Utils.ExtractDateTimeOffsetFromBytes(rawBytes.Skip(8).Take(4).ToArray()); CreatedOnTime = createdDate; var lastAccessDate = Utils.ExtractDateTimeOffsetFromBytes(rawBytes.Skip(12).Take(4).ToArray()); LastAccessTime = lastAccessDate; Identifier = BitConverter.ToInt16(rawBytes, 16); var index = 18; if (Version >= 7) { index += 2; // skip empty 2 MFTInformation = new MFTInformation(rawBytes.Skip(index).Take(8).ToArray()); index += 8; //skip mft data // skip 8 unknown index += 8; } var longstringsize = 0; if (Version >= 3) { index += 2; } if (Version >= 9) { //skip 4 unknown index += 4; } if (Version >= 8) { // unknown, but skip 4 index += 4; } // in this case we want the rest of the extension data, but again, we arent interested in the version offset yet longstringsize = rawBytes.Length - index; var stringBytes = rawBytes.Skip(index).Take(longstringsize).ToArray(); var stringpieces = Utils.GetStringsFromMultistring(stringBytes); LongName = stringpieces[0]; if (stringpieces.Count > 1) { LocalisedName = stringpieces[1]; } index += longstringsize - 2; if (index > rawBytes.Length) { index = rawBytes.Length - 2; } VersionOffset = BitConverter.ToUInt16(rawBytes, index); index += 2; #if DEBUG Trace.Assert(rawBytes.Length == index, "Still have bytes in beef0004"); #endif }
public Beef0004(byte[] rawBytes) : base(rawBytes) { LocalisedName = string.Empty; MFTInformation = new MFTInformation(); if (Signature != 0xbeef0004) { throw new Exception($"Signature mismatch! Should be 0xbeef0004 but is {Signature}"); } var createdDate = Utils.ExtractDateTimeOffsetFromBytes(rawBytes.Skip(8).Take(4).ToArray()); CreatedOnTime = createdDate; var lastAccessDate = Utils.ExtractDateTimeOffsetFromBytes(rawBytes.Skip(12).Take(4).ToArray()); LastAccessTime = lastAccessDate; Identifier = BitConverter.ToInt16(rawBytes, 16); var index = 18; if (Version >= 7) { index += 2; // skip empty 2 MFTInformation = new MFTInformation(rawBytes.Skip(index).Take(8).ToArray()); index += 8; //skip mft data // skip 8 unknown index += 8; } var longstringsize = 0; if (Version >= 3) { index += 2; } if (Version >= 9) { //skip 4 unknown index += 4; } if (Version >= 8) { // unknown, but skip 4 index += 4; } // in this case we want the rest of the extension data, but again, we arent interested in the version offset yet longstringsize = rawBytes.Length - index; var stringBytes = rawBytes.Skip(index).Take(longstringsize).ToArray(); var stringpieces = Utils.GetStringsFromMultistring(stringBytes); LongName = stringpieces[0]; if (stringpieces.Count > 1) { LocalisedName = stringpieces[1]; } index += longstringsize - 2; if (index > rawBytes.Length) { index = rawBytes.Length - 2; } VersionOffset = BitConverter.ToUInt16(rawBytes, index); index += 2; #if DEBUG Trace.Assert(rawBytes.Length == index, "Still have bytes in beef0004"); #endif }