public FileSystemNTFS(IFileSystemStore store) { Store = store; LoadBPB(); _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus); _MFT = new FileNTFS(MFTRecord.Load(0, this), ""); _root = new FolderNTFS(MFTRecord.Load(5, this), "", true); _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), ""); _bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength); }
internal override FileRecoveryStatus GetChanceOfRecovery(FileSystemNode node) { FileNTFS file = node as FileNTFS; if (file == null) { return(FileRecoveryStatus.Unknown); } else { IEnumerable <IRun> runs = file.GetRuns(); if (runs == null) { // The data stream is resident, so recovery is trivial. return(FileRecoveryStatus.Resident); } else { ulong totalClusters = 0; ulong usedClusters = 0; // Check the status of each cluster in the runs. foreach (IRun run in runs) { if (run.HasRealClusters) { totalClusters += run.LengthInClusters; for (ulong i = run.LCN; i < run.LengthInClusters; i++) { if (GetClusterStatus(run.LCN + i) == SectorStatus.Used || GetClusterStatus(run.LCN + i) == SectorStatus.Bad) { usedClusters++; } } } } if (usedClusters == 0) { return(FileRecoveryStatus.MaybeOverwritten); } else if (usedClusters < totalClusters) { return(FileRecoveryStatus.PartiallyOverwritten); } else { return(FileRecoveryStatus.Overwritten); } } } }
public FolderNTFS(MFTRecord record, string path, bool isRoot = false) { _record = record; FileSystem = record.FileSystem; Deleted = _record.Deleted; _indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot); MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation); if (attr != null) { _indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation); } if (isRoot) // root { Root = true; Name = FileSystem.Store.DeviceID; Path = FileSystem.Store.DeviceID; foreach (FileSystemNode node in GetChildren("$Volume")) { FileNTFS file = node as FileNTFS; if (file != null && file.VolumeLabel != "") { Name = file.VolumeLabel; break; } } } else { Name = PathUtils.MakeFileNameValid(record.FileName); if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } } }