public static FileRecord[] GetInstances(string volume)
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
byte[] mftBytes = record.GetBytes();
return(GetInstances(mftBytes, volume));
}
internal byte[] GetBytes(VolumeBootRecord VBR)
{
foreach (Attr attr in this.Attribute)
{
if (attr.Name == Attr.ATTR_TYPE.DATA)
{
if (attr.NonResident)
{
return((attr as NonResident).GetBytes(this.VolumePath, VBR));
}
else
{
return((attr as Data).RawData);
}
}
else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
{
AttributeList attrlist = attr as AttributeList;
foreach (AttrRef ar in attrlist.AttributeReference)
{
if (ar.Name == "DATA")
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
return(record.GetBytes());
}
}
}
}
throw new Exception("Could not locate file contents");
}
public static FileRecord[] GetInstancesByPath(string path)
{
string volume = NativeMethods.GetVolumeFromPath(path);
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
byte[] mftBytes = record.GetBytes();
return(GetInstances(mftBytes, volume));
}
public static AttrDef[] GetInstancesByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
return(AttrDef.GetInstances(record.GetBytes()));
}
public static AttrDef[] GetInstances(string volume)
{
FileRecord record = FileRecord.Get(volume, ATTRDEF_INDEX, true);
return(AttrDef.GetInstances(record.GetBytes()));
}
public static byte[] GetBytesByPath(string path)
{
FileRecord record = FileRecord.Get(path, true);
return(record.GetBytes());
}
internal byte[] GetBytes(VolumeBootRecord VBR)
{
foreach (Attr attr in this.Attribute)
{
if (attr.Name == Attr.ATTR_TYPE.DATA)
{
if (attr.NonResident)
{
return (attr as NonResident).GetBytes(this.VolumePath, VBR);
}
else
{
return (attr as Data).RawData;
}
}
else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
{
AttributeList attrlist = attr as AttributeList;
foreach (AttrRef ar in attrlist.AttributeReference)
{
if (ar.Name == "DATA")
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
return record.GetBytes();
}
}
}
}
throw new Exception("Could not locate file contents");
}
public static FileRecord[] GetInstancesByPath(string path)
{
string volume = NativeMethods.GetVolumeFromPath(path);
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
byte[] mftBytes = record.GetBytes();
return GetInstances(mftBytes, volume);
}
public static FileRecord[] GetInstances(string volume)
{
FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
byte[] mftBytes = record.GetBytes();
return GetInstances(mftBytes, volume);
}
