protected MFTAttribute(byte[] data, int startOffset, MFTRecord record) : this() { _record = record; // Read the attribute header. Type = (AttributeType)BitConverter.ToUInt32(data, startOffset + 0); Length = BitConverter.ToUInt16(data, startOffset + 4); NonResident = data[startOffset + 8] > 0; NameLength = data[startOffset + 9]; NameOffset = BitConverter.ToUInt16(data, startOffset + 10); Compressed = data[startOffset + 0xC] > 0; Id = BitConverter.ToUInt16(data, startOffset + 0xE); if (NameLength > 0) { Name = Encoding.Unicode.GetString(data, startOffset + NameOffset, NameLength * 2); } Flags = BitConverter.ToUInt16(data, startOffset + 12); Instance = BitConverter.ToUInt16(data, startOffset + 14); if (NonResident) { LoadNonResidentHeader(data, startOffset); } else { LoadResidentHeader(data, startOffset); } }
public SparseRun(ulong vcn, ulong lengthInClusters, MFTRecord record) { VCN = vcn; LengthInClusters = lengthInClusters; ulong clusterSize = (ulong)record.BytesPerSector * (ulong)record.SectorsPerCluster; StreamLength = lengthInClusters * clusterSize; }
public NTFSDataRun(ulong vcn, ulong lcn, ulong lengthInClusters, MFTRecord record) { _vcn = vcn; _lcn = lcn; LengthInClusters = lengthInClusters; _record = record; _bytesPerCluster = (ulong)(_record.BytesPerSector * _record.SectorsPerCluster); _lengthInBytes = LengthInClusters * _bytesPerCluster; }
/// <summary> /// The constructor for a file contained as a hidden data stream. /// </summary> public FileNTFS(MFTRecord record, MFTAttribute attr, string path) { _record = record; _stream = new NTFSFileStream(_record.PartitionStream, _record, attr); FileSystem = record.FileSystem; Deleted = _record.Deleted; Name = PathUtils.MakeFileNameValid(record.FileName + "_" + attr.Name); Path = PathUtils.Combine(path, Name); }
public FileSystemNTFS(IFileSystemStore store) { Store = store; LoadBPB(); _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus); _MFT = new FileNTFS(MFTRecord.Load(0, this), ""); _root = new FolderNTFS(MFTRecord.Load(5, this), "", true); _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), ""); _bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength); }
public NTFSFileStream(IDataStream partition, MFTRecord record, MFTAttribute attr) { if (attr != null) { _nonResident = attr.NonResident; if (_nonResident) { _runs = attr.Runs; _length = attr.DataSize; } else { _residentStream = attr.ResidentData; _length = attr.ResidentData.StreamLength; } } _record = record; _partitionStream = partition; }
public FileNTFS(MFTRecord record, string path) { _record = record; if (_record.DataAttribute != null) { _stream = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.Data); } FileSystem = record.FileSystem; Deleted = _record.Deleted; Name = record.FileName; if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path. Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } }
public HiddenDataStreamFileNTFS(MFTRecord record, string path) { _record = record; FileSystem = _record.FileSystem; Name = record.FileName + "(Hidden Streams)"; if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path. Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } _children = new List<IFileSystemNode>(); _children.Add(new FileNTFS(_record, Path)); foreach (MFTAttribute attr in _record.NamedDataAttributes) { _children.Add(new FileNTFS(_record, attr, Path)); } }
private void MftScan(FileSystem.NodeVisitCallback callback) { ulong numFiles = _MFT.StreamLength / (ulong)(SectorsPerMFTRecord * BytesPerSector); for (ulong i = 0; i < numFiles; i++) { MFTRecord record = MFTRecord.Load(i, this, MFTLoadDepth.NameAttributeOnly); if (record.Valid) { if (!callback(record, i, numFiles)) { return; } } } }
public FolderNTFS(MFTRecord record, string path, bool isRoot = false) { _record = record; FileSystem = record.FileSystem; Deleted = _record.Deleted; _indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot); MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation); if (attr != null) { _indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation); } if (isRoot) // root { Root = true; Name = FileSystem.Store.DeviceID; Path = FileSystem.Store.DeviceID; foreach (FileSystemNode node in GetChildren("$Volume")) { FileNTFS file = node as FileNTFS; if (file != null && file.VolumeLabel != "") { Name = file.VolumeLabel; break; } } } else { Name = PathUtils.MakeFileNameValid(record.FileName); if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } } }
public HiddenDataStreamFileNTFS(MFTRecord record, string path) { _record = record; FileSystem = _record.FileSystem; Name = record.FileName + "(Hidden Streams)"; if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path. Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } _children = new List <IFileSystemNode>(); _children.Add(new FileNTFS(_record, Path)); foreach (MFTAttribute attr in _record.NamedDataAttributes) { _children.Add(new FileNTFS(_record, attr, Path)); } }
private void LoadExternalAttributeList(int startOffset, MFTAttribute attrList) { int offset = 0; while (true) { //Align to 8 byte boundary if (offset % 8 != 0) { offset = (offset / 8 + 1) * 8; } // Load the header for this external attribute reference. AttributeType type = (AttributeType)BitConverter.ToUInt32(_data, offset + startOffset + 0x0); // 0xFFFFFFFF marks end of attributes. if (offset == attrList.ValueLength || type == AttributeType.End) { break; } ushort length = BitConverter.ToUInt16(_data, offset + startOffset + 0x4); byte nameLength = _data[offset + startOffset + 0x6]; ushort id = BitConverter.ToUInt16(_data, offset + startOffset + 0x18); ulong vcn = BitConverter.ToUInt64(_data, offset + startOffset + 0x8); ulong extensionRecordNumber = (BitConverter.ToUInt64(_data, offset + startOffset + 0x10) & 0x00000000FFFFFFFF); if (extensionRecordNumber != RecordNum && extensionRecordNumber != MFTRecordNumber) // TODO: Are these ever different? // Load the MFT extension record, locate the attribute we want, and copy it over. { MFTRecord extensionRecord = MFTRecord.Load(extensionRecordNumber, this.FileSystem); if (extensionRecord.Valid) { foreach (MFTAttribute externalAttribute in extensionRecord._attributes) { if (id == externalAttribute.Id) { if (externalAttribute.NonResident && externalAttribute.Type == AttributeType.Data) { // Find the corresponding data attribute on this record and merge the runlists bool merged = false; foreach (MFTAttribute attribute in _attributes) { if (attribute.Type == AttributeType.Data && externalAttribute.Name == attribute.Name) { MergeRunLists(ref attribute.Runs, externalAttribute.Runs); merged = true; break; } } if (!merged) { this._attributes.Add(externalAttribute); } } else { this._attributes.Add(externalAttribute); } } } } } offset += 0x1A + (nameLength * 2); } }
public static MFTAttribute Load(byte[] data, int startOffset, MFTRecord record) { return(new MFTAttribute(data, startOffset, record)); }
public LightweightMFTRecord(MFTRecord record) { FileName = record.FileName; IsDirectory = record.IsDirectory; RecordNumber = record.RecordNum; ParentRecord = record.ParentDirectory; }
public NTFSFileStream(IDataStream partition, MFTRecord record, AttributeType attrType) : this(partition, record, record.GetAttribute(attrType)) { }
public FolderNTFS(MFTRecord record, string path, bool isRoot = false) { _record = record; FileSystem = record.FileSystem; Deleted = _record.Deleted; _indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot); MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation); if (attr != null) { _indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation); } if (isRoot) { // root Root = true; Name = FileSystem.Store.DeviceID; Path = FileSystem.Store.DeviceID; foreach (FileSystemNode node in GetChildren("$Volume")) { FileNTFS file = node as FileNTFS; if (file != null && file.VolumeLabel != "") { Name = file.VolumeLabel; break; } } } else { Name = record.FileName; if (!string.IsNullOrEmpty(path)) { Path = PathUtils.Combine(path, Name); } else { // We don't know the path Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name); } } }