예제 #1
0
        public string GetFullPath(FileNameAndParentFrn frn)
        {
            string address = "";

            while (frn.ParentFrn != 0)
            {
                address = Path.Combine(frn.Name, address);
                frn     = _directories[frn.ParentFrn];
            }

            return(this.Drive + @"\" + address);
        }
예제 #2
0
        private void GetRootFrnEntry()
        {
            string driveRoot = string.Concat("\\\\.\\", _drive);

            driveRoot = string.Concat(driveRoot, Path.DirectorySeparatorChar);
            IntPtr hRoot = MFTReader.CreateFile(driveRoot,
                                                0,
                                                MFTReader.FILE_SHARE_READ | MFTReader.FILE_SHARE_WRITE,
                                                IntPtr.Zero,
                                                MFTReader.OPEN_EXISTING,
                                                MFTReader.FILE_FLAG_BACKUP_SEMANTICS,
                                                IntPtr.Zero);

            if (hRoot.ToInt32() != MFTReader.INVALID_HANDLE_VALUE)
            {
                MFTReader.BY_HANDLE_FILE_INFORMATION fi = new MFTReader.BY_HANDLE_FILE_INFORMATION();
                bool bRtn = MFTReader.GetFileInformationByHandle(hRoot, out fi);
                if (bRtn)
                {
                    UInt64 fileIndexHigh = fi.FileIndexHigh;
                    UInt64 indexRoot     = (fileIndexHigh << 32) | fi.FileIndexLow;

                    FileNameAndParentFrn f = new FileNameAndParentFrn(driveRoot, 0);
                    _directories.Add(indexRoot, f);
                }
                else
                {
                    throw new IOException("GetFileInformationbyHandle() returned invalid handle",
                                          new Win32Exception(Marshal.GetLastWin32Error()));
                }
                MFTReader.CloseHandle(hRoot);
            }
            else
            {
                throw new IOException("Unable to get root frn entry", new Win32Exception(Marshal.GetLastWin32Error()));
            }
        }
예제 #3
0
        public unsafe void EnumerateFiles(IntPtr medBuffer, ref Dictionary <ulong, FileNameAndParentFrn> files, string[] fileExtensions)
        {
            IntPtr pData = Marshal.AllocHGlobal(sizeof(UInt64) + 0x10000);

            MFTReader.ZeroMemory(pData, sizeof(UInt64) + 0x10000);
            uint outBytesReturned = 0;

            while (false != MFTReader.DeviceIoControl(_changeJournalRootHandle, MFTReader.FSCTL_ENUM_USN_DATA, medBuffer,
                                                      sizeof(MFTReader.MFT_ENUM_DATA), pData, sizeof(UInt64) + 0x10000, out outBytesReturned,
                                                      IntPtr.Zero))
            {
                IntPtr pUsnRecord = new IntPtr(pData.ToInt32() + sizeof(Int64));
                while (outBytesReturned > 60)
                {
                    MFTReader.USN_RECORD usn = new MFTReader.USN_RECORD(pUsnRecord);
                    if (0 != (usn.FileAttributes & MFTReader.FILE_ATTRIBUTE_DIRECTORY))
                    {
                        //
                        // handle directories
                        //
                        if (!_directories.ContainsKey(usn.FileReferenceNumber))
                        {
                            _directories.Add(usn.FileReferenceNumber,
                                             new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                        }
                        else       // this is debug code and should be removed when we are certain that
                        // duplicate frn's don't exist on a given drive.  To date, this exception has
                        // never been thrown.  Removing this code improves performance....
                        {
                            throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                              usn.FileReferenceNumber, usn.FileName));
                        }
                    }
                    else
                    {
                        //
                        // handle files
                        //

                        // at this point we could get the * for the extension
                        bool add      = true;
                        bool fullpath = false;
                        if (fileExtensions != null && fileExtensions.Length != 0)
                        {
                            if (fileExtensions[0].ToString() == "*")
                            {
                                add      = true;
                                fullpath = true;
                            }
                            else
                            {
                                add = false;
                                string s = Path.GetExtension(usn.FileName);
                                foreach (string extension in fileExtensions)
                                {
                                    if (0 == string.Compare(s, extension, true))
                                    {
                                        add = true;
                                        break;
                                    }
                                }
                            }
                        }
                        if (add)
                        {
                            if (fullpath)
                            {
                                if (!files.ContainsKey(usn.FileReferenceNumber))
                                {
                                    files.Add(usn.FileReferenceNumber,
                                              new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                                }
                                else
                                {
                                    FileNameAndParentFrn frn = files[usn.FileReferenceNumber];
                                    if (0 != string.Compare(usn.FileName, frn.Name, true))
                                    {
                                        //	Log.InfoFormat(
                                        //	"Attempt to add duplicate file reference number: {0} for file {1}, file from index {2}",
                                        //	usn.FileReferenceNumber, usn.FileName, frn.Name);
                                        throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                                          usn.FileReferenceNumber, usn.FileName));
                                    }
                                }
                            }
                            else
                            {
                                if (!files.ContainsKey(usn.FileReferenceNumber))
                                {
                                    files.Add(usn.FileReferenceNumber,
                                              new FileNameAndParentFrn(usn.FileName, usn.ParentFileReferenceNumber));
                                }
                                else
                                {
                                    FileNameAndParentFrn frn = files[usn.FileReferenceNumber];
                                    if (0 != string.Compare(usn.FileName, frn.Name, true))
                                    {
                                        //	Log.InfoFormat(
                                        //	"Attempt to add duplicate file reference number: {0} for file {1}, file from index {2}",
                                        //	usn.FileReferenceNumber, usn.FileName, frn.Name);
                                        throw new Exception(string.Format("Duplicate FRN: {0} for {1}",
                                                                          usn.FileReferenceNumber, usn.FileName));
                                    }
                                }
                            }
                        }
                    }
                    pUsnRecord        = new IntPtr(pUsnRecord.ToInt32() + usn.RecordLength);
                    outBytesReturned -= usn.RecordLength;
                }
                Marshal.WriteInt64(medBuffer, Marshal.ReadInt64(pData, 0));
            }
            Marshal.FreeHGlobal(pData);
        }