internal unsafe ListEntryHandler(NtfsAttributeType searchedAttributeType,
AttributeNameFilterDelegate nameFilter, RecordAttributeEnumeratorCallbackDelegate callback)
{
_callback = callback ?? throw new ArgumentNullException();
_dataRetrievalCallback = HandleData;
_searchedAttributeType = searchedAttributeType;
_nameFilter = nameFilter;
}
internal unsafe void EnumerateRecordAttributes(NtfsPartition owner, ulong recordLBA,
ref byte *buffer, RecordAttributeEnumeratorCallbackDelegate callback,
NtfsAttributeType searchedType = NtfsAttributeType.Any,
AttributeNameFilterDelegate nameFilter = null)
{
using (IPartitionClusterData data = owner.ReadSectors(recordLBA)) {
buffer = data.Data;
NtfsFileRecord *header = (NtfsFileRecord *)buffer;
header->AssertRecordType();
if (1024 < header->BytesAllocated)
{
throw new NotImplementedException();
}
EnumerateRecordAttributes(header, callback, searchedType, nameFilter);
}
}
/// <summary>Retrieve the Nth attribute of a given kind from a file record.</summary>
/// <param name="kind">Searched attribute type.</param>
/// <param name="dataStream">On return this parameter value is a null reference most of
/// the time. Otherwise for attributes that are retrieved from an
/// <see cref="NtfsAttributeListAttribute"/> instance, this is a stream that support
/// attribute data content reading.</param>
/// <param name="order">Attribute rank. Default is first. This is usefull for some kind of
/// attributes such as Data one that can appear several times in a record.</param>
/// <param name="nameFilter">An optional name filter delegate that will sort out those
/// attributes we want to retrieve based on their name.</param>
/// <returns>The retrieved attribute or a null reference if not found.</returns>
internal unsafe NtfsAttribute *GetAttribute(NtfsAttributeType kind, out Stream dataStream,
uint order = 1, AttributeNameFilterDelegate nameFilter = null)
{
NtfsAttribute *result = null;
Stream retrievedDataStream = null;
EnumerateRecordAttributes(delegate(NtfsAttribute * found, Stream attributeDataStream) {
if (kind == found->AttributeType)
{
if (0 == --order)
{
result = found;
retrievedDataStream = attributeDataStream;
return(false);
}
}
return(true);
},
kind, nameFilter);
dataStream = retrievedDataStream;
return(result);
}
/// <summary>Enumerate attributes bound to this <see cref="NtfsFileRecord"/>, optionally filtering
/// on attribute name.</summary>
/// <param name="header">The file record.</param>
/// <param name="callback"></param>
/// <param name="searchedAttributeType"></param>
/// <param name="nameFilter">An optional name filter that will be provided with the basic attribute
/// properties (including name) in order to decide if data should be retrieved. This is especially
/// usefull for <see cref="NtfsAttributeListAttribute"/> attributes that may reference lengthy
/// attributes data which are expensive to retrieve.</param>
internal static unsafe void EnumerateRecordAttributes(NtfsFileRecord *header,
RecordAttributeEnumeratorCallbackDelegate callback, NtfsAttributeType searchedAttributeType,
AttributeNameFilterDelegate nameFilter)
{
// Walk attributes, seeking for the searched one.
NtfsAttribute *currentAttribute = (NtfsAttribute *)((byte *)header + header->AttributesOffset);
NtfsAttributeListAttribute *pendingAttributeList = null;
NtfsAttribute *[] candidates = new NtfsAttribute *[MaxAttributeCount];
int candidatesCount = 0;
for (int attributeIndex = 0; attributeIndex < header->NextAttributeNumber; attributeIndex++)
{
if (currentAttribute->IsLast)
{
break;
}
if (header->BytesInUse < ((byte *)currentAttribute - (byte *)header))
{
break;
}
if (NtfsAttributeType.EndOfListMarker == currentAttribute->AttributeType)
{
break;
}
// If we found an AttributeListAttribute, we must go one level deeper to
// complete the enumeration.
if (NtfsAttributeType.AttributeAttributeList == currentAttribute->AttributeType)
{
if (null != pendingAttributeList)
{
// No more than one attribute of this kind per file record.
throw new ApplicationException();
}
if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType)
{
if (!callback(currentAttribute, null))
{
return;
}
}
// Defer handling
pendingAttributeList = (NtfsAttributeListAttribute *)currentAttribute;
break;
}
if (candidatesCount >= MaxAttributeCount)
{
throw new ApplicationException();
}
if ((NtfsAttributeType.Any == searchedAttributeType) ||
(currentAttribute->AttributeType == searchedAttributeType))
{
candidates[candidatesCount++] = currentAttribute;
}
currentAttribute = (NtfsAttribute *)((byte *)currentAttribute + currentAttribute->Length);
}
if (NtfsAttributeType.AttributeAttributeList == searchedAttributeType)
{
// Either we already found one such attribute and invoked the callback or found none and
// we can return immediately. Should we have found several such attributes we would have
// risen an exception.
return;
}
if (null == pendingAttributeList)
{
// We already walked every attributes and captured those that matched the type filter if
// any. Invoke callbak on each such attribute.
for (int candidateIndex = 0; candidateIndex < candidatesCount; candidateIndex++)
{
if (!callback(candidates[candidateIndex], null))
{
return;
}
}
// We are done.
return;
}
NtfsAttributeListAttribute.Dump(pendingAttributeList);
// HandleAttributeListAttributeEntry
// We have an attribute list attribute. Delegate him the enumeration.
NtfsPartition currentPartition = NtfsPartition.Current;
NtfsAttributeListAttribute.EnumerateEntries((NtfsAttribute *)pendingAttributeList, searchedAttributeType,
new ListEntryHandler(searchedAttributeType, nameFilter, callback).HandleListEntry);
return;
}
internal unsafe void EnumerateRecordAttributes(RecordAttributeEnumeratorCallbackDelegate callback,
NtfsAttributeType searchedType = NtfsAttributeType.Any, AttributeNameFilterDelegate nameFilter = null)
{
fixed(NtfsFileRecord *header = &this)
{
EnumerateRecordAttributes(header, callback, searchedType, nameFilter);
}
}
