internal byte[] GetContent(NtfsVolumeBootRecord VBR) { foreach (FileRecordAttribute attr in this.Attribute) { if (attr.Name == FileRecordAttribute.ATTR_TYPE.DATA) { if (attr.NonResident) { return((attr as NonResident).GetBytes(VBR)); } else { return((attr as Data).RawData); } } else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST) { AttributeList attrlist = attr as AttributeList; foreach (AttrRef ar in attrlist.AttributeReference) { if (ar.Name == "DATA") { FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, (int)VBR.BytesPerFileRecord, true); return(record.GetContent()); } } } } throw new Exception("Could not locate file contents"); }
/// <summary> /// /// </summary> /// <returns></returns> public byte[] GetMftSlack() { byte[] bytes = FileRecord.GetRecordBytes(this.VolumePath, (int)this.RecordNumber); return(Helper.GetSubArray(bytes, this.RealSize - 1, this.AllocatedSize - this.RealSize)); }