public static void GetBytes(byte[] buffer, int offset, DateTime value, DatetimeBinaryFormat format = DatetimeBinaryFormat.WinFileTime)
{
Debug.Assert(buffer.Length - offset >= 8); // WinFileTime requires 8 bytes
Debug.Assert(offset >= 0);
switch (format)
{
case DatetimeBinaryFormat.WinFileTime:
NtfsHelper.ToWinFileTime(buffer, offset, value);
break;
default:
throw new ArgumentOutOfRangeException("format");
}
}
public static FileRecordSegmentHeader ReadFileRecord(byte[] data, int offset, ushort bytesPerSector, uint sectors)
{
uint length = bytesPerSector * sectors;
if (data.Length - offset < length || length < 50 || !(bytesPerSector % 512 == 0 && bytesPerSector > 0) || sectors < 0)
{
throw new Exception("Error in parsing the 'FILE_RECORD_SEGMENT_HEADER'!\n");
}
FileRecordSegmentHeader record = new FileRecordSegmentHeader();
// offset size
record.MSH = new MultiSectorHeader(data, offset); // 0 4+2+2=8
record.LSN = BitConverter.ToUInt64(data, offset + 8); // 8 8
record.SequenceNumber = BitConverter.ToUInt16(data, offset + 16); // 16 2
record.ReferenceLinkCount = BitConverter.ToInt16(data, offset + 18); // 18 2
record.FirstAttributeOffset = BitConverter.ToUInt16(data, offset + 20); // 20 2
record.Flags = (MFTEntryFlags)BitConverter.ToUInt16(data, offset + 22); // 22 2
record.UsedEntrySize = BitConverter.ToUInt32(data, offset + 24); // 24 4
record.TotalEntrySize = BitConverter.ToUInt32(data, offset + 32); // 28 4
record.BaseFileRecordSegment = new MFTSegmentReference(BitConverter.ToUInt64(data, offset + 32)); // 32 8
record.FirstNextFreeAttributeId = BitConverter.ToUInt16(data, offset + 40); // 40 2
// Used to align to 4-byte boundary (only since NTFS version 3.1) [offset : 0x2A] // 42 2
record.MFTNumber = BitConverter.ToUInt16(data, offset + 44); // 44 4
record.UpdateSequenceArray = new byte[2];
Array.Copy(data, offset + record.MSH.UpdateSequenceArrayOffset, record.UpdateSequenceArray, 0, 2);
record.SequenceArray = new byte[record.MSH.SequenceArraySize * 2 - 2];
Array.Copy(data, offset + record.MSH.UpdateSequenceArrayOffset + 2, record.SequenceArray, 0, record.SequenceArray.Length);
record.MftSegmentReference = new MFTSegmentReference(record.MFTNumber, record.SequenceNumber);
NtfsHelper.ApplyUpdateSequenceNumberPatch(data, offset, sectors, bytesPerSector, record.UpdateSequenceArray, record.SequenceArray);
record.attributes = new List <AttributeRecord>();
//record.externalAttributes = new List<AttributeRecord>();
record.ReadAttributes(data, record.UsedEntrySize - record.FirstAttributeOffset, offset + record.FirstAttributeOffset);
return(record);
}
