Пример #1
0
 private void treeViewDirectory_NodeMouseDoubleClick(object sender, TreeNodeMouseClickEventArgs e)
 {
     if (e.Node.Tag is DirectoryEntry)
     {
         DirectoryEntry entry = e.Node.Tag as DirectoryEntry;
         if (entry.IsDirectory || entry.IsVolumeID)
         {
             return;
         }
         Partition partition = (comboBoxPartitions.SelectedItem as ComboBoxItem).Value as Partition;
         BufferedDiskReader disk = new BufferedDiskReader(partition.Hdd.DeviceId);
         byte[] fileBytes = partition.OpenFile(disk, entry);
         disk.Close();
         string output = Encoding.UTF8.GetString(fileBytes);
         Editor editor = new Editor(output);
         editor.Show();
     }
 }
Пример #2
0
        public void enumerateFATDevices()
        {
            disks = new List<HardDrive>();

            ManagementObjectSearcher search = new ManagementObjectSearcher("SELECT * FROM Win32_DiskDrive");

            //Iterate over each search result - list of HD's from WMI
            foreach (ManagementObject wmi_HD in search.Get())
            {
                HardDrive hdd = new HardDrive();
                hdd.Model = wmi_HD["Model"].ToString();
                hdd.Type = wmi_HD["InterfaceType"] == null ? "" : wmi_HD["InterfaceType"].ToString();
                hdd.DeviceId = wmi_HD["DeviceId"].ToString();

                BufferedDiskReader disk = new BufferedDiskReader(hdd.DeviceId);

                //Occurs when in use or insufficient privileges
                if (disk.IsInvalid)
                {
                    int error = Marshal.GetLastWin32Error();
                    MessageBox.Show(this, "Please verify you have Administrator Privileges and disks are not in use.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Stop);
                    continue;
                }

                //HDD is valid, add to our list
                disks.Add(hdd);

                //Sector buffer
                byte[] data = new byte[512];

                //Fill Buffer
                disk.Read(data, 0, 512);

                //Deserialize data into MasterBootRecord
                hdd.MBR = new MasterBootRecord(data);

                //Iterate over partitions in MBR
                foreach (PartitionTableEntry entry in hdd.MBR.PartitionTable.Partitions)
                {
                    //Clear data buffer
                    data = new byte[512];

                    //Seek to Partition start (FAT32 boot sector, location given in Partition table entry in Sectors)
                    disk.SeekAbsolute((ulong)entry.LBA_Begin1 * BYTES_PER_SECTOR);

                    //Read FAT32 BootSector - Volume Info
                    disk.Read(data, 0, data.Length);

                    //Deserialize data into Partition object
                    hdd.Partitions.Add(new Partition(data, hdd, entry));
                }

                //Got to remember to close the disk
                disk.Close();
            }
        }
Пример #3
0
        /*
         * parseDirectoryTree - Start directory tree parsing from physical disk
         * Return - Enumerates partition's rootDirectory structure
         */
        private void parseDirectoryTree(Partition partition)
        {
            //Create handle
            //SafeFileHandle handle = Exports.CreateFile(partition.Hdd.DeviceId,
            //                (uint)FileAccess.Read,
            //                (uint)FileShare.None,
            //                IntPtr.Zero,
            //                (uint)FileMode.Open,
            //                Exports.FILE_FLAG_NO_BUFFERING,
            //                IntPtr.Zero);

            BufferedDiskReader disk = new BufferedDiskReader(partition.Hdd.DeviceId);

            if (disk.IsInvalid)
            {
                MessageBox.Show(String.Format("Error Opening Partition "));
                return;
            }
            //Wrap handle in extended FileStream
            //PreciseFileStream disk = new PreciseFileStream(handle, FileAccess.Read);

            //Hand off FileStream to workhorse
            partition.ParseDirectoryEntries(disk);

            //Don't forget to close
            disk.Close();
        }
Пример #4
0
 public byte[] OpenFile(BufferedDiskReader disk, DirectoryEntry file)
 {
     if (file.IsDirectory)
     {
         return null;
     }
     if (FAT == null)
     {
         ReadFAT(disk);
     }
     byte[] data = ReadCluster(disk, file.FirstCluster);
     uint nextCluster = ReadNextFAT(file.FirstCluster);
     uint clusterCount = 1;
     while (nextCluster < 0x0FFFFFF8)
     {
         clusterCount++;
         byte[] temp = ReadCluster(disk, nextCluster);
         byte[] tempData = data;
         data = new byte[clusterCount * temp.Length];
         Array.Copy(tempData, 0, data, 0, tempData.Length);
         Array.Copy(temp, 0, data, tempData.Length, temp.Length);
         nextCluster = ReadNextFAT(nextCluster);
     }
     return data;
 }
Пример #5
0
        private byte[] ReadCluster(BufferedDiskReader disk, uint cluster)
        {
            byte[] clusterBytes = new byte[(ulong)bootSector.BPB.BytesPerSector * (ulong)bootSector.BPB.SectorsPerCluster];

            //Calculate LBA for first cluster
            uint clusterLBA = (uint)(ClusterBeginLBA + (cluster - 2) * BootSector.BPB.SectorsPerCluster);

            ulong clusterStartByte = (ulong)bootSector.BPB.BytesPerSector * (ulong)clusterLBA;

            disk.SeekAbsolute(clusterStartByte);

            //for (int i = 0; i < bootSector.BPB.SectorsPerCluster; i++)
            //{
            //    byte[] data = new byte[bootSector.BPB.BytesPerSector];
            //    disk.Read(data, 0, data.Length);
            //    Array.Copy(data, 0, clusterBytes, i * bootSector.BPB.BytesPerSector, bootSector.BPB.BytesPerSector);
            //}
            disk.Read(clusterBytes, 0, clusterBytes.Length);
            return clusterBytes;
        }
Пример #6
0
        /*
         * ReadFAT - Read FAT table 1 into memory
         */
        public void ReadFAT(BufferedDiskReader disk)
        {
            byte[] fatBytes = new byte[(bootSector.BPB.SectorsPerFAT32 * bootSector.BPB.BytesPerSector)];
            FAT = new uint[fatBytes.Length / 4];

            disk.SeekAbsolute((ulong)(bootSector.BPB.BytesPerSector * fatBeginLBA));
            disk.Read(fatBytes, 0, fatBytes.Length);

            for (int i = 0; i < FAT.Length; i++)
            {
                FAT[i] = (uint)(fatBytes[i * 4 + 3] << 24 | fatBytes[i * 4 + 2] << 16 | fatBytes[i * 4 + 1] << 8 | fatBytes[i * 4 + 0]);
            }
        }
Пример #7
0
        /*
         * ParseDirectoryEntries - Seeks disk to Directory Table start then begins recursive creation         *
         */
        public void ParseDirectoryEntries(BufferedDiskReader disk)
        {
            disk.SeekAbsolute((ulong)this.clusterBeginLBA * BootSector.BPB.BytesPerSector);

            int error = Marshal.GetLastWin32Error();

            byte[] data = new byte[32];
            disk.Read(data, 0, data.Length);

            rootDirectory = new DirectoryEntry(data, disk, this);
            if (!rootDirectory.IsVolumeID)
            {
                DirectoryEntry entry = rootDirectory;
                rootDirectory = new DirectoryEntry();
                rootDirectory.Children.Add(entry);
                disk.Read(data, 0, data.Length);
                entry = new DirectoryEntry(data, disk, this);
                while (entry.Type != DirectoryEntryType.EndOfDirectory)
                {
                    if (entry.Type != DirectoryEntryType.Unused)
                    {
                        rootDirectory.Children.Add(entry);
                    }
                    disk.Read(data, 0, data.Length);
                    entry = new DirectoryEntry(data, disk, this);
                }
            }
        }