public void FragmentsRun9()
{
byte[] data = new byte[] { 0x21, 0x02, 0xEF, 0x07, 0x01, 0x0E, 0x00 };
List <DataFragment> fragments = DataFragment.ParseFragments(data, data.Length, 0, 0, 15).ToList();
// These fragments have compression
DataFragment.CompactCompressedFragments(fragments);
Assert.AreEqual(1, fragments.Count);
DataFragmentHelpers.CheckFragment(fragments[0], 2, 14, 0, 0x21, 2031, false, true);
// Save to bytes
byte[] newData = DataFragmentHelpers.SaveFragments(fragments.ToArray());
Assert.IsTrue(newData.SequanceEqualIn(data));
}
public void FragmentsRun5()
{
byte[] data = new byte[] { 0x11, 0x08, 0x40, 0x01, 0x08, 0x11, 0x10, 0x08, 0x11, 0x0C, 0x10, 0x01, 0x04, 0x00 };
List <DataFragment> fragments = DataFragment.ParseFragments(data, data.Length, 0, 0, 47).ToList();
// These fragments have compression
DataFragment.CompactCompressedFragments(fragments);
Assert.AreEqual(3, fragments.Count);
DataFragmentHelpers.CheckFragment(fragments[0], 8, 8, 0, 0x11, 64, false, true);
DataFragmentHelpers.CheckFragment(fragments[1], 16, 0, 16, 0x11, 72, false, false);
DataFragmentHelpers.CheckFragment(fragments[2], 12, 4, 32, 0x11, 88, false, true);
// Save to bytes
byte[] newData = DataFragmentHelpers.SaveFragments(fragments.ToArray());
Assert.IsTrue(newData.SequanceEqualIn(data));
}
public void ActualFragmentRun5()
{
// Mikes Disk C: MFT# -- Data Non-Resident (Sparse & Compressed)
byte[] data = new byte[] { 0x01, 0x60, 0x41, 0x02, 0x6C, 0xB3, 0xAA, 0x00, 0x01, 0x0E, 0x11, 0x01, 0x10, 0x01, 0x0F, 0x00 };
List <DataFragment> fragments = DataFragment.ParseFragments(data, data.Length, 0, 0, 127).ToList();
DataFragment.CompactCompressedFragments(fragments);
Assert.AreEqual(3, fragments.Count);
DataFragmentHelpers.CheckFragment(fragments[0], 96, 0, 0, 0x01, 0, true, false);
DataFragmentHelpers.CheckFragment(fragments[1], 2, 14, 96, 0x41, 11187052, false, true);
DataFragmentHelpers.CheckFragment(fragments[2], 1, 15, 112, 0x11, 11187068, false, true);
// Save to bytes
byte[] newData = DataFragmentHelpers.SaveFragments(fragments.ToArray());
Assert.IsTrue(newData.SequanceEqualIn(data));
}
public static Attribute ParseSingleAttribute(byte[] data, int maxLength, int offset = 0)
{
// Debug.Assert(data.Length - offset >= maxLength);
// Debug.Assert(0 <= offset && offset <= data.Length);
AttributeType type = GetType(data, offset);
if (type == AttributeType.EndOfAttributes)
{
Attribute tmpRes = new AttributeGeneric();
tmpRes.ParseHeader(data, offset);
return(tmpRes);
}
Attribute res;
switch (type)
{
case AttributeType.Unknown:
res = new AttributeGeneric();
break;
case AttributeType.STANDARD_INFORMATION:
res = new AttributeStandardInformation();
break;
case AttributeType.ATTRIBUTE_LIST:
res = new AttributeList();
break;
case AttributeType.FILE_NAME:
res = new AttributeFileName();
break;
case AttributeType.OBJECT_ID:
// Also OBJECT_ID
// TODO: Handle either case
res = new AttributeObjectId();
break;
case AttributeType.SECURITY_DESCRIPTOR:
res = new AttributeSecurityDescriptor();
break;
case AttributeType.VOLUME_NAME:
res = new AttributeVolumeName();
break;
case AttributeType.VOLUME_INFORMATION:
res = new AttributeVolumeInformation();
break;
case AttributeType.DATA:
res = new AttributeData();
break;
case AttributeType.INDEX_ROOT:
res = new AttributeIndexRoot();
break;
case AttributeType.INDEX_ALLOCATION:
res = new AttributeIndexAllocation();
break;
case AttributeType.BITMAP:
res = new AttributeBitmap();
break;
case AttributeType.REPARSE_POINT:
// TODO
res = new AttributeGeneric();
break;
case AttributeType.EA_INFORMATION:
res = new AttributeExtendedAttributeInformation();
break;
case AttributeType.EA:
res = new AttributeExtendedAttributes();
break;
// Property set seems to be obsolete
//case AttributeType.PROPERTY_SET:
// res = new MFTAttributeGeneric();
// break;
case AttributeType.LOGGED_UTILITY_STREAM:
res = new AttributeLoggedUtilityStream();
break;
default:
// TODO
res = new AttributeGeneric();
break;
}
res.ParseHeader(data, offset);
if (res.NonResidentFlag == ResidentFlag.Resident)
{
// Debug.Assert((res.AllowedResidentStates & AttributeResidentAllow.Resident) != 0);
res.ResidentHeader = AttributeResidentHeader.ParseHeader(data, offset + 16);
int bodyOffset = offset + res.ResidentHeader.ContentOffset;
int length = offset + res.TotalLength - bodyOffset;
// Debug.Assert(length >= res.ResidentHeader.ContentLength);
// Debug.Assert(offset + maxLength >= bodyOffset + length);
res.ParseAttributeResidentBody(data, length, bodyOffset);
}
else if (res.NonResidentFlag == ResidentFlag.NonResident)
{
// Debug.Assert((res.AllowedResidentStates & AttributeResidentAllow.NonResident) != 0);
res.NonResidentHeader = AttributeNonResidentHeader.ParseHeader(data, offset + 16);
int bodyOffset = offset + res.NonResidentHeader.ListOffset;
int length = res.TotalLength - res.NonResidentHeader.ListOffset;
// Debug.Assert(offset + maxLength >= bodyOffset + length);
res.NonResidentHeader.Fragments = DataFragment.ParseFragments(data, length, bodyOffset, res.NonResidentHeader.StartingVCN, res.NonResidentHeader.EndingVCN);
// Compact compressed fragments
if (res.NonResidentHeader.CompressionUnitSize != 0)
{
List <DataFragment> fragments = res.NonResidentHeader.Fragments;
DataFragment.CompactCompressedFragments(fragments);
res.NonResidentHeader.Fragments = fragments;
}
}
else
{
throw new NotImplementedException("Couldn't process residentflag");
}
return(res);
}
