/// <summary>
/// 添加卷;
/// </summary>
/// <param name="path">卷实体</param>
public void AddVolume(LocalVolume volume)
{
if (volume == null)
{
throw new ArgumentNullException(nameof(volume));
}
var csEvidence = CaseService.Current.
CreateNewCaseEvidence(
new string[] {
EvidenceType_LocalVolume
},
volume.Sign.ToString(),
volume.Sign.ToString()
);
csEvidence[nameof(volume.Sign)] = volume.Sign.ToString();
csEvidence[nameof(volume.Size)] = volume.Size.ToString();
CaseService.Current.CurrentCase.AddNewCaseEvidence(csEvidence);
CaseService.Current.CurrentCase.LoadCaseEvidence(csEvidence);
}
//初始化本地盘符;
private void InitilizeVolumes()
{
var partitionPtr = cdfc_devices_patitionlist();
var partitionNode = partitionPtr;
while (partitionNode != IntPtr.Zero)
{
var ptList = partitionNode.GetStructure <PartitonListStruct>();
//为避免编写重复的continue代码,此处编写一个循环内方法,进行判断,分区添加工作;
//return 即为continue;
void CheckAndAdd()
{
//判断_mThisPartition是否为空;
if (ptList.m_ThisPartition == IntPtr.Zero)
{
LoggerService.Current.WriteCallerLine($"{nameof(ptList.m_ThisPartition)} is null.");
return;
}
var partitionStruct = ptList.m_ThisPartition.GetStructure <VolumeStruct>();
//若挂载号不是有效的盘标号,则不可用,需跳过;
var sign = Convert.ToChar(partitionStruct.m_Sign);
if (!char.IsLetter(sign))
{
LoggerService.Current.WriteCallerLine($"{nameof(partitionStruct.m_Sign)} is not a valid volume sign-{sign}");
return;
}
var device = _localHdds.FirstOrDefault(p => p.DeviceID == partitionStruct.m_LoGo);
if (device == null)
{
LoggerService.Current?.WriteCallerLine(
$"Matched Hdd not found:{nameof(partitionStruct.m_LoGo)}-{partitionStruct.m_LoGo}"
);
return;
}
if (device != null)
{
var partition = new LocalVolume(partitionStruct)
{
InternalSecSize = device.SectorSize
};
device.InternalVolumes.Add(partition);
LoggerService.Current?.WriteCallerLine(
$"Partition aquired:{Convert.ToChar(partitionStruct.m_Sign)}" +
$"Size:{partitionStruct.m_Size}"
);
}
}
CheckAndAdd();
partitionNode = ptList.m_next;
}
//附载分区到硬盘上;
_localHdds.ForEach(p => {
if (p.Volumes == null)
{
return;
}
foreach (var volume in p.Volumes)
{
var devName = @"\\.\" + volume.Sign + ":";
var partitionInDevice = _partitionInDeviceStructs.FirstOrDefault(t => t.Value.DevName == devName);
if ((partitionInDevice?.Handle ?? IntPtr.Zero) != IntPtr.Zero)
{
volume.InternalHandle = new SafeFileHandle(partitionInDevice.Value.Handle, false);
}
}
});
}
