private void treeViewDirectory_NodeMouseDoubleClick(object sender, TreeNodeMouseClickEventArgs e)
{
if (e.Node.Tag is DirectoryEntry)
{
DirectoryEntry entry = e.Node.Tag as DirectoryEntry;
if (entry.IsDirectory || entry.IsVolumeID)
{
return;
}
Partition partition = (comboBoxPartitions.SelectedItem as ComboBoxItem).Value as Partition;
BufferedDiskReader disk = new BufferedDiskReader(partition.Hdd.DeviceId);
byte[] fileBytes = partition.OpenFile(disk, entry);
disk.Close();
string output = Encoding.UTF8.GetString(fileBytes);
Editor editor = new Editor(output);
editor.Show();
}
}
public void enumerateFATDevices()
{
disks = new List<HardDrive>();
ManagementObjectSearcher search = new ManagementObjectSearcher("SELECT * FROM Win32_DiskDrive");
//Iterate over each search result - list of HD's from WMI
foreach (ManagementObject wmi_HD in search.Get())
{
HardDrive hdd = new HardDrive();
hdd.Model = wmi_HD["Model"].ToString();
hdd.Type = wmi_HD["InterfaceType"] == null ? "" : wmi_HD["InterfaceType"].ToString();
hdd.DeviceId = wmi_HD["DeviceId"].ToString();
BufferedDiskReader disk = new BufferedDiskReader(hdd.DeviceId);
//Occurs when in use or insufficient privileges
if (disk.IsInvalid)
{
int error = Marshal.GetLastWin32Error();
MessageBox.Show(this, "Please verify you have Administrator Privileges and disks are not in use.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Stop);
continue;
}
//HDD is valid, add to our list
disks.Add(hdd);
//Sector buffer
byte[] data = new byte[512];
//Fill Buffer
disk.Read(data, 0, 512);
//Deserialize data into MasterBootRecord
hdd.MBR = new MasterBootRecord(data);
//Iterate over partitions in MBR
foreach (PartitionTableEntry entry in hdd.MBR.PartitionTable.Partitions)
{
//Clear data buffer
data = new byte[512];
//Seek to Partition start (FAT32 boot sector, location given in Partition table entry in Sectors)
disk.SeekAbsolute((ulong)entry.LBA_Begin1 * BYTES_PER_SECTOR);
//Read FAT32 BootSector - Volume Info
disk.Read(data, 0, data.Length);
//Deserialize data into Partition object
hdd.Partitions.Add(new Partition(data, hdd, entry));
}
//Got to remember to close the disk
disk.Close();
}
}
/*
* parseDirectoryTree - Start directory tree parsing from physical disk
* Return - Enumerates partition's rootDirectory structure
*/
private void parseDirectoryTree(Partition partition)
{
//Create handle
//SafeFileHandle handle = Exports.CreateFile(partition.Hdd.DeviceId,
// (uint)FileAccess.Read,
// (uint)FileShare.None,
// IntPtr.Zero,
// (uint)FileMode.Open,
// Exports.FILE_FLAG_NO_BUFFERING,
// IntPtr.Zero);
BufferedDiskReader disk = new BufferedDiskReader(partition.Hdd.DeviceId);
if (disk.IsInvalid)
{
MessageBox.Show(String.Format("Error Opening Partition "));
return;
}
//Wrap handle in extended FileStream
//PreciseFileStream disk = new PreciseFileStream(handle, FileAccess.Read);
//Hand off FileStream to workhorse
partition.ParseDirectoryEntries(disk);
//Don't forget to close
disk.Close();
}
public byte[] OpenFile(BufferedDiskReader disk, DirectoryEntry file)
{
if (file.IsDirectory)
{
return null;
}
if (FAT == null)
{
ReadFAT(disk);
}
byte[] data = ReadCluster(disk, file.FirstCluster);
uint nextCluster = ReadNextFAT(file.FirstCluster);
uint clusterCount = 1;
while (nextCluster < 0x0FFFFFF8)
{
clusterCount++;
byte[] temp = ReadCluster(disk, nextCluster);
byte[] tempData = data;
data = new byte[clusterCount * temp.Length];
Array.Copy(tempData, 0, data, 0, tempData.Length);
Array.Copy(temp, 0, data, tempData.Length, temp.Length);
nextCluster = ReadNextFAT(nextCluster);
}
return data;
}
private byte[] ReadCluster(BufferedDiskReader disk, uint cluster)
{
byte[] clusterBytes = new byte[(ulong)bootSector.BPB.BytesPerSector * (ulong)bootSector.BPB.SectorsPerCluster];
//Calculate LBA for first cluster
uint clusterLBA = (uint)(ClusterBeginLBA + (cluster - 2) * BootSector.BPB.SectorsPerCluster);
ulong clusterStartByte = (ulong)bootSector.BPB.BytesPerSector * (ulong)clusterLBA;
disk.SeekAbsolute(clusterStartByte);
//for (int i = 0; i < bootSector.BPB.SectorsPerCluster; i++)
//{
// byte[] data = new byte[bootSector.BPB.BytesPerSector];
// disk.Read(data, 0, data.Length);
// Array.Copy(data, 0, clusterBytes, i * bootSector.BPB.BytesPerSector, bootSector.BPB.BytesPerSector);
//}
disk.Read(clusterBytes, 0, clusterBytes.Length);
return clusterBytes;
}
/*
* ReadFAT - Read FAT table 1 into memory
*/
public void ReadFAT(BufferedDiskReader disk)
{
byte[] fatBytes = new byte[(bootSector.BPB.SectorsPerFAT32 * bootSector.BPB.BytesPerSector)];
FAT = new uint[fatBytes.Length / 4];
disk.SeekAbsolute((ulong)(bootSector.BPB.BytesPerSector * fatBeginLBA));
disk.Read(fatBytes, 0, fatBytes.Length);
for (int i = 0; i < FAT.Length; i++)
{
FAT[i] = (uint)(fatBytes[i * 4 + 3] << 24 | fatBytes[i * 4 + 2] << 16 | fatBytes[i * 4 + 1] << 8 | fatBytes[i * 4 + 0]);
}
}
/*
* ParseDirectoryEntries - Seeks disk to Directory Table start then begins recursive creation *
*/
public void ParseDirectoryEntries(BufferedDiskReader disk)
{
disk.SeekAbsolute((ulong)this.clusterBeginLBA * BootSector.BPB.BytesPerSector);
int error = Marshal.GetLastWin32Error();
byte[] data = new byte[32];
disk.Read(data, 0, data.Length);
rootDirectory = new DirectoryEntry(data, disk, this);
if (!rootDirectory.IsVolumeID)
{
DirectoryEntry entry = rootDirectory;
rootDirectory = new DirectoryEntry();
rootDirectory.Children.Add(entry);
disk.Read(data, 0, data.Length);
entry = new DirectoryEntry(data, disk, this);
while (entry.Type != DirectoryEntryType.EndOfDirectory)
{
if (entry.Type != DirectoryEntryType.Unused)
{
rootDirectory.Children.Add(entry);
}
disk.Read(data, 0, data.Length);
entry = new DirectoryEntry(data, disk, this);
}
}
}