internal ResidentHeader(byte[] bytes, CommonHeader common) { commonHeader = common; AttrSize = BitConverter.ToUInt32(bytes, 0); AttrOffset = BitConverter.ToUInt16(bytes, 4); IndexedFlag = bytes[6]; }
internal ulong StartVCN; // Starting VCN #endregion Fields #region Constructors internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List<DataRun> dataRunList = new List<DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List <DataRun> dataRunList = new List <DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
internal readonly ulong InitializedSize; // Initialized data size of the stream #endregion Properties #region Constructors internal NonResidentHeader(byte[] bytes, CommonHeader common) { commonHeader = common; StartVCN = BitConverter.ToUInt64(bytes, 0x00); LastVCN = BitConverter.ToUInt64(bytes, 0x08); DataRunOffset = BitConverter.ToUInt16(bytes, 0x10); CompUnitSize = BitConverter.ToUInt16(bytes, 0x12); AllocatedSize = BitConverter.ToUInt64(bytes, 0x18); RealSize = BitConverter.ToUInt64(bytes, 0x20); InitializedSize = BitConverter.ToUInt64(bytes, 0x28); }
internal static Attr Get(byte[] bytes, string volume) { #region CommonHeader if (bytes.Length == 0) { return(null); } // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes); #endregion CommonHeader uint NameLength = (uint)commonHeader.NameLength * 2; // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength); // Determine if Attribute is Resident or NonResident bool resident = (bytes[8] == 0x00); #region ResidentAttribute // If Attribute is Resident if (resident) { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(NativeMethods.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader #region AttributeBytes // Create a byte[] representing the attribute itself int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength; byte[] attributeBytes = NativeMethods.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize); #endregion AttributeBytes #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)Attr.ATTR_TYPE.STANDARD_INFORMATION: return(new StandardInformation(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.ATTRIBUTE_LIST: return(new AttributeList(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.FILE_NAME: return(new FileName(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.OBJECT_ID: return(new ObjectId(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.VOLUME_NAME: return(new VolumeName(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.VOLUME_INFORMATION: return(new VolumeInformation(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.DATA: return(new Data(residentHeader, attributeBytes, attributeName)); case (Int32)Attr.ATTR_TYPE.INDEX_ROOT: return(new IndexRoot(residentHeader, attributeBytes, attributeName)); default: return(null); } #endregion ATTRSwitch } #endregion ResidentAttribute #region NonResidentAttribute // Else Attribute is Non-Resident else { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(NativeMethods.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader); #endregion NonResidentHeader #region DataRun int headerSize = 0; if (commonHeader.NameOffset != 0) { headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } return(new NonResident(nonresidentHeader, NativeMethods.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize), attributeName)); #endregion DataRun } #endregion NonResidentAttribute }
internal ResidentHeader(byte[] bytes, CommonHeader common) { commonHeader = common; AttrSize = BitConverter.ToUInt32(bytes, 0); AttrOffset = BitConverter.ToUInt16(bytes, 4); IndexedFlag = bytes[6]; }
internal static Attr Get(byte[] bytes, string volume) { #region CommonHeader if (bytes.Length == 0) { return null; } // Instantiate a Common Header Object CommonHeader commonHeader = new CommonHeader(bytes); #endregion CommonHeader uint NameLength = (uint)commonHeader.NameLength * 2; // Decode Name byte[] into Unicode String string attributeName = Encoding.Unicode.GetString(bytes, (int)commonHeader.NameOffset, (int)NameLength); // Determine if Attribute is Resident or NonResident bool resident = (bytes[8] == 0x00); #region ResidentAttribute // If Attribute is Resident if (resident) { #region ResidentHeader // Instantiate a Resident Header Object ResidentHeader residentHeader = new ResidentHeader(NativeMethods.GetSubArray(bytes, COMMONHEADERSIZE, RESIDENTHEADERSIZE), commonHeader); #endregion ResidentHeader #region AttributeBytes // Create a byte[] representing the attribute itself int headerSize = COMMONHEADERSIZE + RESIDENTHEADERSIZE + (int)NameLength; byte[] attributeBytes = NativeMethods.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize); #endregion AttributeBytes #region ATTRSwitch switch (residentHeader.commonHeader.ATTRType) { case (Int32)Attr.ATTR_TYPE.STANDARD_INFORMATION: return new StandardInformation(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.ATTRIBUTE_LIST: return new AttributeList(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.FILE_NAME: return new FileName(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.OBJECT_ID: return new ObjectId(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.VOLUME_NAME: return new VolumeName(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.VOLUME_INFORMATION: return new VolumeInformation(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.DATA: return new Data(residentHeader, attributeBytes, attributeName); case (Int32)Attr.ATTR_TYPE.INDEX_ROOT: return new IndexRoot(residentHeader, attributeBytes, attributeName); default: return null; } #endregion ATTRSwitch } #endregion ResidentAttribute #region NonResidentAttribute // Else Attribute is Non-Resident else { #region NonResidentHeader // Instantiate a Resident Header Object NonResidentHeader nonresidentHeader = new NonResidentHeader(NativeMethods.GetSubArray(bytes, COMMONHEADERSIZE, NONRESIDENTHEADERSIZE), commonHeader); #endregion NonResidentHeader #region DataRun int headerSize = 0; if (commonHeader.NameOffset != 0) { headerSize = commonHeader.NameOffset + (int)NameLength + ((int)NameLength % 8); } else { headerSize = COMMONHEADERSIZE + NONRESIDENTHEADERSIZE; } return new NonResident(nonresidentHeader, NativeMethods.GetSubArray(bytes, (uint)headerSize, commonHeader.TotalSize - (uint)headerSize), attributeName); #endregion DataRun } #endregion NonResidentAttribute }
internal ulong StartVCN; // Starting VCN #endregion Fields #region Constructors internal NonResidentHeader(byte[] bytes, CommonHeader common) { commonHeader = common; StartVCN = BitConverter.ToUInt64(bytes, 0x00); LastVCN = BitConverter.ToUInt64(bytes, 0x08); DataRunOffset = BitConverter.ToUInt16(bytes, 0x10); CompUnitSize = BitConverter.ToUInt16(bytes, 0x12); AllocatedSize = BitConverter.ToUInt64(bytes, 0x18); RealSize = BitConverter.ToUInt64(bytes, 0x20); InitializedSize = BitConverter.ToUInt64(bytes, 0x28); }