private UsnJrnl(byte[] bytes, string volume, ref int offset)
{
uint RecordLength = RecordLength = BitConverter.ToUInt32(bytes, (0x00 + offset));
VolumePath = volume;
Version = new System.Version(BitConverter.ToUInt16(bytes, (0x04 + offset)), BitConverter.ToUInt16(bytes, (0x06 + offset)));
RecordNumber = (BitConverter.ToUInt64(bytes, (0x08 + offset)) & 0x0000FFFFFFFFFFFF);
FileSequenceNumber = ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x0E + offset));
ParentFileRecordNumber = (BitConverter.ToUInt64(bytes, (0x10 + offset)) & 0x0000FFFFFFFFFFFF);
ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x16 + offset));
Usn = BitConverter.ToUInt64(bytes, (0x18 + offset));
TimeStamp = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, (0x20 + offset)));
Reason = ((USN_REASON)BitConverter.ToUInt32(bytes, (0x28 + offset)));
SourceInfo = ((USN_SOURCE)BitConverter.ToUInt32(bytes, (0x2C + offset)));
SecurityId = BitConverter.ToUInt32(bytes, (0x30 + offset));
FileAttributes = ((StandardInformation.ATTR_STDINFO_PERMISSION)BitConverter.ToUInt32(bytes, (0x34 + offset)));
ushort fileNameLength = BitConverter.ToUInt16(bytes, (0x38 + offset));
ushort fileNameOffset = BitConverter.ToUInt16(bytes, (0x3A + offset));
FileName = Encoding.Unicode.GetString(bytes, 0x3C + offset, fileNameLength);
offset += (int)RecordLength;
}
private UsnJrnl(byte[] bytes, string volume, ref int offset)
{
uint RecordLength = RecordLength = BitConverter.ToUInt32(bytes, (0x00 + offset));
VolumePath = volume;
Version = new System.Version(BitConverter.ToUInt16(bytes, (0x04 + offset)), BitConverter.ToUInt16(bytes, (0x06 + offset)));
RecordNumber = (BitConverter.ToUInt64(bytes, (0x08 + offset)) & 0x0000FFFFFFFFFFFF);
FileSequenceNumber = ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x0E + offset));
ParentFileRecordNumber = (BitConverter.ToUInt64(bytes, (0x10 + offset)) & 0x0000FFFFFFFFFFFF);
ParentFileSequenceNumber = BitConverter.ToUInt16(bytes, (0x16 + offset));
Usn = BitConverter.ToUInt64(bytes, (0x18 + offset));
TimeStamp = DateTime.FromFileTimeUtc(BitConverter.ToInt64(bytes, (0x20 + offset)));
Reason = ((USN_REASON)BitConverter.ToUInt32(bytes, (0x28 + offset)));
SourceInfo = ((USN_SOURCE)BitConverter.ToUInt32(bytes, (0x2C + offset)));
SecurityId = BitConverter.ToUInt32(bytes, (0x30 + offset));
FileAttributes = ((StandardInformation.ATTR_STDINFO_PERMISSION)BitConverter.ToUInt32(bytes, (0x34 + offset)));
ushort fileNameLength = BitConverter.ToUInt16(bytes, (0x38 + offset));
ushort fileNameOffset = BitConverter.ToUInt16(bytes, (0x3A + offset));
FileName = Encoding.Unicode.GetString(bytes, 0x3C + offset, fileNameLength);
offset += (int)RecordLength;
}
