An NTFS data stream comprising multiple data runs.
Inheritance: IDataStream
Exemplo n.º 1
0
		/// <summary>
		/// The constructor for a file contained as a hidden data stream.
		/// </summary>
		public FileNTFS(MFTRecord record, MFTAttribute attr, string path) {
			_record = record;
			_stream = new NTFSFileStream(_record.PartitionStream, _record, attr);
			FileSystem = record.FileSystem;
			Deleted = _record.Deleted;
			Name = PathUtils.MakeFileNameValid(record.FileName + "_" + attr.Name);
			Path = PathUtils.Combine(path, Name);
		}
Exemplo n.º 2
0
 /// <summary>
 /// The constructor for a file contained as a hidden data stream.
 /// </summary>
 public FileNTFS(MFTRecord record, MFTAttribute attr, string path)
 {
     _record    = record;
     _stream    = new NTFSFileStream(_record.PartitionStream, _record, attr);
     FileSystem = record.FileSystem;
     Deleted    = _record.Deleted;
     Name       = PathUtils.MakeFileNameValid(record.FileName + "_" + attr.Name);
     Path       = PathUtils.Combine(path, Name);
 }
Exemplo n.º 3
0
		public FileNTFS(MFTRecord record, string path) {
			_record = record;
			if (_record.DataAttribute != null) {
				_stream = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.Data);
			}
			FileSystem = record.FileSystem;
			Deleted = _record.Deleted;
			Name = record.FileName;
			if (!string.IsNullOrEmpty(path)) {
				Path = PathUtils.Combine(path, Name);
			} else {
				// We don't know the path.
				Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name);
			}
		}
Exemplo n.º 4
0
        public FolderNTFS(MFTRecord record, string path, bool isRoot = false)
        {
            _record    = record;
            FileSystem = record.FileSystem;
            Deleted    = _record.Deleted;
            _indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot);

            MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation);

            if (attr != null)
            {
                _indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation);
            }
            if (isRoot)               // root
            {
                Root = true;
                Name = FileSystem.Store.DeviceID;
                Path = FileSystem.Store.DeviceID;
                foreach (FileSystemNode node in GetChildren("$Volume"))
                {
                    FileNTFS file = node as FileNTFS;
                    if (file != null && file.VolumeLabel != "")
                    {
                        Name = file.VolumeLabel;
                        break;
                    }
                }
            }
            else
            {
                Name = PathUtils.MakeFileNameValid(record.FileName);
                if (!string.IsNullOrEmpty(path))
                {
                    Path = PathUtils.Combine(path, Name);
                }
                else
                {
                    // We don't know the path
                    Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name);
                }
            }
        }
Exemplo n.º 5
0
 public FileNTFS(MFTRecord record, string path)
 {
     _record = record;
     if (_record.DataAttribute != null)
     {
         _stream = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.Data);
     }
     FileSystem = record.FileSystem;
     Deleted    = _record.Deleted;
     Name       = record.FileName;
     if (!string.IsNullOrEmpty(path))
     {
         Path = PathUtils.Combine(path, Name);
     }
     else
     {
         // We don't know the path.
         Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name);
     }
 }
Exemplo n.º 6
0
        private void loadChildrenIndexRoot()
        {
            NTFSFileStream stream = _indexRoot;

            _rootEntries = new List <IndexEntry>();

            //Index Root
            UInt32 attrTypes              = Util.GetUInt32(stream, 0x0);
            UInt32 indexBufferSize        = Util.GetUInt32(stream, 0x8);
            Byte   clustersPerIndexBuffer = Util.GetByte(stream, 0xC);
            UInt32 size  = Util.GetUInt32(stream, 0x14);
            UInt32 size2 = Util.GetUInt32(stream, 0x18);
            UInt32 flags = Util.GetUInt32(stream, 0x1C);

            ulong      offset = 0x20;
            IndexEntry entry;

            do
            {
                entry = new IndexEntry(stream, offset, this);
                _rootEntries.Add(entry);
                offset += entry.EntryLength;
            } while (!entry.LastEntry);
        }
		public FolderNTFS(MFTRecord record, string path, bool isRoot = false) {
			_record = record;
			FileSystem = record.FileSystem;
			Deleted = _record.Deleted;
			_indexRoot = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexRoot);

			MFTAttribute attr = _record.GetAttribute(AttributeType.IndexAllocation);
			if (attr != null) {
				_indexAllocation = new NTFSFileStream(_record.PartitionStream, _record, AttributeType.IndexAllocation);
			}
			if (isRoot) { // root
				Root = true;
				Name = FileSystem.Store.DeviceID;
				Path = FileSystem.Store.DeviceID;
				foreach (FileSystemNode node in GetChildren("$Volume")) {
					FileNTFS file = node as FileNTFS;
					if (file != null && file.VolumeLabel != "") {
						Name = file.VolumeLabel;
						break;
					}
				}
			} else {
				Name = record.FileName;
				if (!string.IsNullOrEmpty(path)) {
					Path = PathUtils.Combine(path, Name);
				} else {
					// We don't know the path
					Path = PathUtils.Combine(FileSystem.Store.DeviceID, "?", Name);
				}
			}
		}