C# (CSharp) PowerForensics.EventLog BinaryXml 예제들

예제 #1

파일: EventRecord.cs 프로젝트: deneme056/PowerForensics

 // Check Signature
 internal EventRecord(byte[] bytes, int chunkOffset, int recordOffset, string path)
 {
     LogPath   = path;
     Signature = BitConverter.ToUInt32(bytes, recordOffset);
     if (Signature == 10794)
     {
         Size          = BitConverter.ToUInt32(bytes, recordOffset + 0x04);
         EventRecordId = BitConverter.ToUInt64(bytes, recordOffset + 0x08);
         WriteTime     = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, recordOffset + 0x10));;
         EventData     = new BinaryXml(bytes, chunkOffset, recordOffset + 0x18, (int)Size - 0x1C);
         CopyOfSize    = BitConverter.ToUInt32(bytes, recordOffset + (int)Size - 0x04);
     }
     else
     {
         throw new Exception("Invalid EventRecord object");
     }
 }

예제 #2

파일: EventRecord.cs 프로젝트: juneb/PowerForensics_Source

 // Check Signature
 internal EventRecord(byte[] bytes, int chunkOffset, int recordOffset, string path)
 {
     LogPath = path;
     Signature = BitConverter.ToUInt32(bytes, recordOffset);
     if (Signature == 10794)
     {
         Size = BitConverter.ToUInt32(bytes, recordOffset + 0x04);
         EventRecordId = BitConverter.ToUInt64(bytes, recordOffset + 0x08);
         WriteTime = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, recordOffset + 0x10));;
         EventData = new BinaryXml(bytes, chunkOffset, recordOffset + 0x18, (int)Size - 0x1C);
         CopyOfSize = BitConverter.ToUInt32(bytes, recordOffset + (int)Size - 0x04);
     }
     else
     {
         throw new Exception("Invalid EventRecord object");
     }
 }