internal ulong StartVCN; // Starting VCN #endregion Fields #region Constructors internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List<DataRun> dataRunList = new List<DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List <DataRun> dataRunList = new List <DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
internal NonResident(NonResidentHeader header, byte[] bytes, int offset, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; DataRun = Ntfs.DataRun.GetInstances(bytes, offset); }
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; DataRun = Ntfs.DataRun.GetInstances(bytes); }
internal static FileRecordAttribute Get(byte[] bytes, int offset, string volume) { #region CommonHeader // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes, offset); // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, commonHeader.NameOffset + offset, commonHeader.NameLength); #endregion CommonHeader #region NonResidentAttribute // If Attribute is NonResident if (commonHeader.NonResident) { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(bytes, commonHeader, COMMONHEADERSIZE + offset); #endregion NonResidentHeader #region DataRun int headerSize = 0x00; if (commonHeader.NameOffset != 0x00) { headerSize = commonHeader.NameOffset + commonHeader.NameLength + (commonHeader.NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } int attributeoffset = headerSize + offset; return new NonResident(nonresidentHeader, bytes, attributeoffset, attributeName); #endregion DataRun } #endregion NonResidentAttribute #region ResidentAttribute // Else Attribute is Resident else { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE + offset, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + commonHeader.NameLength; int attributeoffset = headerSize + offset; #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION: return new StandardInformation(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST: return new AttributeList(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME: return new FileName(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID: return new ObjectId(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME: return new VolumeName(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION: return new VolumeInformation(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.DATA: return new Data(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT: return new IndexRoot(residentHeader, bytes, attributeoffset, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.EA: //Console.WriteLine("EA"); return null; case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION: //Console.WriteLine("EA_INFORMATION"); return null; default: return null; } #endregion ATTRSwitch } #endregion ResidentAttribute }
internal static FileRecordAttribute Get(byte[] bytes, int offset, string volume) { #region CommonHeader // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes, offset); // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, commonHeader.NameOffset + offset, commonHeader.NameLength); #endregion CommonHeader #region NonResidentAttribute // If Attribute is NonResident if (commonHeader.NonResident) { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(bytes, commonHeader, COMMONHEADERSIZE + offset); #endregion NonResidentHeader #region DataRun int headerSize = 0x00; if (commonHeader.NameOffset != 0x00) { headerSize = commonHeader.NameOffset + commonHeader.NameLength + (commonHeader.NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } int attributeoffset = headerSize + offset; return(new NonResident(nonresidentHeader, bytes, attributeoffset, attributeName)); #endregion DataRun } #endregion NonResidentAttribute #region ResidentAttribute // Else Attribute is Resident else { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE + offset, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + commonHeader.NameLength; int attributeoffset = headerSize + offset; #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION: return(new StandardInformation(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST: return(new AttributeList(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME: return(new FileName(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID: return(new ObjectId(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME: return(new VolumeName(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION: return(new VolumeInformation(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.DATA: return(new Data(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT: return(new IndexRoot(residentHeader, bytes, attributeoffset, attributeName)); case (Int32)FileRecordAttribute.ATTR_TYPE.EA: //Console.WriteLine("EA"); return(null); case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION: //Console.WriteLine("EA_INFORMATION"); return(null); default: return(null); } #endregion ATTRSwitch } #endregion ResidentAttribute }
internal static Attr Get(byte[] bytes, string volume) { #region CommonHeader if (bytes.Length == 0) { return(null); } // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes); #endregion CommonHeader uint NameLength = (uint)commonHeader.NameLength * 2; // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength); // Determine if Attribute is Resident or NonResident bool resident = (bytes[8] == 0x00); #region ResidentAttribute // If Attribute is Resident if (resident) { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(Util.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader #region AttributeBytes // Create a byte[] representing the attribute itself int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength; byte[] attributeBytes = Util.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize); #endregion AttributeBytes #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)Attr.ATTR_TYPE.STANDARD_INFORMATION: return(new StandardInformation(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.ATTRIBUTE_LIST: return(new AttributeList(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.FILE_NAME: return(new FileName(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.OBJECT_ID: return(new ObjectId(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.VOLUME_NAME: return(new VolumeName(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.VOLUME_INFORMATION: return(new VolumeInformation(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.DATA: return(new Data(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.INDEX_ROOT: return(new IndexRoot(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.EA: //Console.WriteLine("EA"); return(null); case (Int32)Attr.ATTR_TYPE.EA_INFORMATION: //Console.WriteLine("EA_INFORMATION"); return(null); default: return(null); } #endregion ATTRSwitch } #endregion ResidentAttribute #region NonResidentAttribute // Else Attribute is Non-Resident else { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(Util.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader); #endregion NonResidentHeader #region DataRun int headerSize = 0; if (commonHeader.NameOffset != 0) { headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } return(new NonResident(nonresidentHeader, Util.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize), attributeName)); #endregion DataRun } #endregion NonResidentAttribute }
internal static FileRecordAttribute Get(byte[] bytes, string volume) { #region CommonHeader if (bytes.Length == 0) { return null; } // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes); #endregion CommonHeader uint NameLength = (uint)commonHeader.NameLength * 2; // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength); // Determine if Attribute is Resident or NonResident bool resident = (bytes[8] == 0x00); #region ResidentAttribute // If Attribute is Resident if (resident) { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader #region AttributeBytes // Create a byte[] representing the attribute itself int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength; byte[] attributeBytes = Helper.GetSubArray(bytes, headerSize, (int)commonHeader.TotalSize - headerSize); #endregion AttributeBytes #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)FileRecordAttribute.ATTR_TYPE.STANDARD_INFORMATION: return new StandardInformation(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST: return new AttributeList(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.FILE_NAME: return new FileName(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.OBJECT_ID: return new ObjectId(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_NAME: return new VolumeName(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.VOLUME_INFORMATION: return new VolumeInformation(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.DATA: return new Data(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.INDEX_ROOT: return new IndexRoot(residentHeader, attributeBytes, attributeName); case (Int32)FileRecordAttribute.ATTR_TYPE.EA: //Console.WriteLine("EA"); return null; case (Int32)FileRecordAttribute.ATTR_TYPE.EA_INFORMATION: //Console.WriteLine("EA_INFORMATION"); return null; default: return null; } #endregion ATTRSwitch } #endregion ResidentAttribute #region NonResidentAttribute // Else Attribute is Non-Resident else { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(Helper.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader); #endregion NonResidentHeader #region DataRun int headerSize = 0x00; if (commonHeader.NameOffset != 0x00) { headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } return new NonResident(nonresidentHeader, Helper.GetSubArray(bytes, headerSize, (int)commonHeader.TotalSize - headerSize), attributeName); #endregion DataRun } #endregion NonResidentAttribute }