public static Load ( ulong recordNum, |
||
recordNum | ulong | |
fileSystem | ||
loadDepth | MFTLoadDepth | |
path | string | |
Результат |
public FileSystemNTFS(IFileSystemStore store) { Store = store; LoadBPB(); _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus); _MFT = new FileNTFS(MFTRecord.Load(0, this), ""); _root = new FolderNTFS(MFTRecord.Load(5, this), "", true); _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), ""); _bitmap = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength); }
private void MftScan(FileSystem.NodeVisitCallback callback) { ulong numFiles = _MFT.StreamLength / (ulong)(SectorsPerMFTRecord * BytesPerSector); for (ulong i = 0; i < numFiles; i++) { MFTRecord record = MFTRecord.Load(i, this, MFTLoadDepth.NameAttributeOnly); if (record.Valid) { if (!callback(record, i, numFiles)) { return; } } } }
private void LoadExternalAttributeList(int startOffset, MFTAttribute attrList) { int offset = 0; while (true) { //Align to 8 byte boundary if (offset % 8 != 0) { offset = (offset / 8 + 1) * 8; } // Load the header for this external attribute reference. AttributeType type = (AttributeType)BitConverter.ToUInt32(_data, offset + startOffset + 0x0); // 0xFFFFFFFF marks end of attributes. if (offset == attrList.ValueLength || type == AttributeType.End) { break; } ushort length = BitConverter.ToUInt16(_data, offset + startOffset + 0x4); byte nameLength = _data[offset + startOffset + 0x6]; ushort id = BitConverter.ToUInt16(_data, offset + startOffset + 0x18); ulong vcn = BitConverter.ToUInt64(_data, offset + startOffset + 0x8); ulong extensionRecordNumber = (BitConverter.ToUInt64(_data, offset + startOffset + 0x10) & 0x00000000FFFFFFFF); if (extensionRecordNumber != RecordNum && extensionRecordNumber != MFTRecordNumber) // TODO: Are these ever different? // Load the MFT extension record, locate the attribute we want, and copy it over. { MFTRecord extensionRecord = MFTRecord.Load(extensionRecordNumber, this.FileSystem); if (extensionRecord.Valid) { foreach (MFTAttribute externalAttribute in extensionRecord._attributes) { if (id == externalAttribute.Id) { if (externalAttribute.NonResident && externalAttribute.Type == AttributeType.Data) { // Find the corresponding data attribute on this record and merge the runlists bool merged = false; foreach (MFTAttribute attribute in _attributes) { if (attribute.Type == AttributeType.Data && externalAttribute.Name == attribute.Name) { MergeRunLists(ref attribute.Runs, externalAttribute.Runs); merged = true; break; } } if (!merged) { this._attributes.Add(externalAttribute); } } else { this._attributes.Add(externalAttribute); } } } } } offset += 0x1A + (nameLength * 2); } }