protected NtfsFileEntry(Ntfs ntfs, FileRecord record, AttributeFileName fileName)
{
this.ntfs = ntfs;
MFTRecord = record;
FileName = fileName;
Init();
}
private void _read()
{
_code = ((Zip.ExtraCodes)m_io.ReadU2le());
_lenBody = m_io.ReadU2le();
switch (Code)
{
case Zip.ExtraCodes.Ntfs: {
__raw_body = m_io.ReadBytes(LenBody);
var io___raw_body = new KaitaiStream(__raw_body);
_body = new Ntfs(io___raw_body, this, m_root);
break;
}
case Zip.ExtraCodes.ExtendedTimestamp: {
__raw_body = m_io.ReadBytes(LenBody);
var io___raw_body = new KaitaiStream(__raw_body);
_body = new ExtendedTimestamp(io___raw_body, this, m_root);
break;
}
case Zip.ExtraCodes.InfozipUnixVarSize: {
__raw_body = m_io.ReadBytes(LenBody);
var io___raw_body = new KaitaiStream(__raw_body);
_body = new InfozipUnixVarSize(io___raw_body, this, m_root);
break;
}
default: {
_body = m_io.ReadBytes(LenBody);
break;
}
}
}
internal override void ParseAttributeNonResidentBody(Ntfs ntfsInfo)
{
byte[] data = NtfsUtils.ReadFragments(ntfsInfo, NonResidentHeader.Fragments);
List <IndexAllocationChunk> indexes = new List <IndexAllocationChunk>();
List <IndexEntry> entries = new List <IndexEntry>();
// Parse
for (int i = 0; i < NonResidentHeader.Fragments.Count; i++)
{
for (int j = 0; j < NonResidentHeader.Fragments[i].Clusters; j++)
{
int offset = (int)((NonResidentHeader.Fragments[i].StartingVCN - NonResidentHeader.Fragments[0].StartingVCN) * ntfsInfo.BytesPerCluster + j * ntfsInfo.BytesPerCluster);
if (!IndexAllocationChunk.IsIndexAllocationChunk(data, offset))
{
continue;
}
IndexAllocationChunk index = IndexAllocationChunk.ParseBody(ntfsInfo, data, offset);
indexes.Add(index);
foreach (var f in index.Entries)
{
entries.Add(f);
}
}
}
Indexes = indexes;
Entries = entries;
}
internal void Dump()
{
Ntfs.Dump();
Console.WriteLine(
"Seq {0}, #lnk {1}, aOff {2}, flg {3}, usd {4}, all {5}, bfr 0x{6:X8}, nxA {7}",
SequenceNumber, LinkCount, AttributesOffset, Flags, BytesInUse, BytesAllocated,
BaseFileRecord, NextAttributeNumber);
}
public static IndexAllocationChunk ParseBody(Ntfs ntfsInfo, byte[] data, int offset)
{
// Debug.Assert(data.Length >= 36);
IndexAllocationChunk res = new IndexAllocationChunk();
// Parse
res.Signature = Encoding.ASCII.GetString(data, offset + 0, 4);
// Debug.Assert(res.Signature == "INDX");
res.OffsetToUSN = BitConverter.ToUInt16(data, offset + 4);
res.USNSizeWords = BitConverter.ToUInt16(data, offset + 6);
res.LogFileUSN = BitConverter.ToUInt64(data, offset + 8);
res.VCNInIndexAllocation = BitConverter.ToUInt64(data, offset + 16);
res.OffsetToFirstIndex = BitConverter.ToUInt32(data, offset + 24);
res.SizeOfIndexTotal = BitConverter.ToUInt32(data, offset + 28);
res.SizeOfIndexAllocated = BitConverter.ToUInt32(data, offset + 32);
res.HasChildren = data[36];
// Debug.Assert(data.Length >= offset + res.OffsetToUSN + 2 + res.USNSizeWords * 2);
res.USNNumber = new byte[2];
Array.Copy(data, offset + res.OffsetToUSN, res.USNNumber, 0, 2);
res.USNData = new byte[res.USNSizeWords * 2 - 2];
Array.Copy(data, offset + res.OffsetToUSN + 2, res.USNData, 0, res.USNData.Length);
// Patch USN Data
NtfsUtils.ApplyUSNPatch(data, offset, (res.SizeOfIndexAllocated + 24) / ntfsInfo.BytesPerSector, (ushort)ntfsInfo.BytesPerSector, res.USNNumber, res.USNData);
// Debug.Assert(offset + res.SizeOfIndexTotal <= data.Length);
// Parse entries
List <IndexEntry> entries = new List <IndexEntry>();
int pointer = offset + (int)(res.OffsetToFirstIndex + 24); // Offset is relative to 0x18
while (pointer <= offset + res.SizeOfIndexTotal + 24)
{
IndexEntry entry = IndexEntry.ParseData(data, offset + (int)res.SizeOfIndexTotal - pointer + 24, pointer);
if ((entry.Flags & MFTIndexEntryFlags.LastEntry) != 0)
{
break;
}
entries.Add(entry);
pointer += entry.Size;
}
res.Entries = entries;
return(res);
}
internal static NtfsFileEntry CreateEntry(Ntfs ntfs, uint fileId, AttributeFileName fileName = null)
{
var record = ntfs.ReadMftRecord(fileId);
if (fileName == null)
{
fileName = NtfsUtils.GetPreferredDisplayName(record);
}
if ((record.Flags & FileEntryFlags.Directory) != 0)
{
return(new NtfsDirectory(ntfs, record, fileName));
}
return(new NtfsFile(ntfs, record, fileName));
}
public static byte[] ReadFragments(Ntfs ntfsInfo, List <DataFragment> fragments)
{
long totalLength = 0;
foreach (var frag in fragments)
{
totalLength += frag.Clusters * ntfsInfo.BytesPerCluster;
}
var data = new byte[totalLength];
Stream diskStream = ntfsInfo.DiskStream;
using (NtfsDiskStream stream = new NtfsDiskStream(diskStream, false, fragments, ntfsInfo.BytesPerCluster, 0, totalLength))
{
stream.Read(data, 0, data.Length);
}
// Return the data
return(data);
}
internal override void ParseAttributeNonResidentBody(Ntfs ntfsInfo)
{
base.ParseAttributeNonResidentBody(ntfsInfo);
// Get all chunks
byte[] data = NtfsUtils.ReadFragments(ntfsInfo, NonResidentHeader.Fragments);
// Parse
List <AttributeListItem> results = new List <AttributeListItem>();
int pointer = 0;
int contentSize = (int)NonResidentHeader.ContentSize;
while (pointer + 26 <= contentSize) // 26 is the smallest possible MFTAttributeListItem
{
AttributeListItem item = AttributeListItem.ParseListItem(data, data.Length - pointer, pointer);
if (item.Type == AttributeType.EndOfAttributes)
{
break;
}
if (item.Length == 0)
{
break;
}
results.Add(item);
pointer += item.Length;
}
// Debug.Assert(pointer == contentSize);
Items = results;
}
internal NtfsDirectory(Ntfs ntfs, FileRecord record, AttributeFileName fileName)
: base(ntfs, record, fileName)
{
}
internal virtual void ParseAttributeNonResidentBody(Ntfs ntfsInfo)
{
// Debug.Assert(NonResidentFlag == ResidentFlag.NonResident);
// Debug.Assert((AllowedResidentStates & AttributeResidentAllow.NonResident) != 0);
// Debug.Assert(ntfsInfo != null);
}
internal unsafe void ApplyFixups()
{
Ntfs.ApplyFixups();
}
private void Initialize()
{
Console.WriteLine("[NTFSDRV2] Initializing NTFS file system on drive " + rootPath);
ntfs = Ntfs.Create(new BlockDeviceStream(device, size));
}
