internal byte[] GetContent(NtfsVolumeBootRecord VBR) { foreach (FileRecordAttribute attr in this.Attribute) { if (attr.Name == FileRecordAttribute.ATTR_TYPE.DATA) { if (attr.NonResident) { return((attr as NonResident).GetBytes(VBR)); } else { return((attr as Data).RawData); } } else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST) { AttributeList attrlist = attr as AttributeList; foreach (AttrRef ar in attrlist.AttributeReference) { if (ar.Name == "DATA") { FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, (int)VBR.BytesPerFileRecord, true); return(record.GetContent()); } } } } throw new Exception("Could not locate file contents"); }
public static byte[] GetSlackByPath(string path) { FileRecord record = FileRecord.Get(path, true); byte[] bytes = record.GetContent(); return(GetSlack(bytes)); }
internal static FileRecord[] GetInstances(string volume, bool fast) { FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true); byte[] mftBytes = record.GetContent(); return(GetInstances(mftBytes, volume, fast)); }
public static FileRecord[] GetInstancesTest(string volume) { FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true); byte[] mftBytes = record.GetContent(); return(GetInstancesTest(mftBytes, volume)); }
public static FileRecord[] GetInstances(string volume) { FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true); byte[] mftBytes = record.GetContent(); return(GetInstances(mftBytes, volume)); }
/// <summary> /// /// </summary> /// <param name="path"></param> /// <returns></returns> public static FileRecord[] GetInstancesByPath(string path) { FileRecord record = FileRecord.Get(path, true); byte[] mftBytes = record.GetContent(); return(GetInstances(mftBytes, Helper.GetVolumeFromPath(path), false)); }
/// <summary> /// /// </summary> /// <param name="volume"></param> /// <returns></returns> public static AttrDef[] GetInstances(string volume) { Helper.getVolumeName(ref volume); FileRecord record = FileRecord.Get(volume, MftIndex.ATTRDEF_INDEX, true); return(AttrDef.GetInstances(record.GetContent())); }
public static FileRecord[] GetInstancesByPath(string path) { string volume = Util.GetVolumeFromPath(path); FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true); byte[] mftBytes = record.GetContent(); return(GetInstances(mftBytes, volume)); }
internal byte[] GetContent(VolumeBootRecord VBR) { foreach (Attr attr in this.Attribute) { if (attr.Name == Attr.ATTR_TYPE.DATA) { if (attr.NonResident) { return (attr as NonResident).GetBytes(this.VolumePath, VBR); } else { return (attr as Data).RawData; } } else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST) { AttributeList attrlist = attr as AttributeList; foreach (AttrRef ar in attrlist.AttributeReference) { if (ar.Name == "DATA") { FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true); return record.GetContent(); } } } } throw new Exception("Could not locate file contents"); }
public static FileRecord[] GetInstancesByPath(string path) { string volume = Util.GetVolumeFromPath(path); FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true); byte[] mftBytes = record.GetContent(); return GetInstances(mftBytes, volume); }
public static FileRecord[] GetInstances(string volume) { FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true); byte[] mftBytes = record.GetContent(); return GetInstances(mftBytes, volume); }
/// <summary> /// /// </summary> /// <param name="streamToRead"></param> /// <param name="volume"></param> /// <returns></returns> internal static byte[] GetBytes(FileStream streamToRead, string volume) { FileRecord mftRecord = GetRecord(streamToRead, volume); return(mftRecord.GetContent()); }
public static byte[] GetBytesByPath(string path) { FileRecord record = FileRecord.Get(path, true); return(record.GetContent()); }
/// <summary> /// /// </summary> /// <param name="path"></param> /// <returns></returns> public static UsnJrnlInformation GetByPath(string path) { FileRecord record = FileRecord.Get(path, true); return(new UsnJrnlInformation(record.GetContent(@"$Max"))); }
/// <summary> /// /// </summary> /// <param name="path"></param> /// <param name="streamName"></param> /// <returns></returns> public static byte[] GetContentBytes(string path, string streamName) { FileRecord record = Get(path, true); return(record.GetContent(streamName)); }
/// <summary> /// /// </summary> /// <param name="path"></param> /// <returns></returns> public static AttrDef[] GetInstancesByPath(string path) { FileRecord record = FileRecord.Get(path, true); return(AttrDef.GetInstances(record.GetContent())); }
public static AttrDef[] GetInstances(string volume) { FileRecord record = FileRecord.Get(volume, ATTRDEF_INDEX, true); return(AttrDef.GetInstances(record.GetContent())); }