Load() публичный статический Метод

public static Load ( ulong recordNum, FileSystemNTFS fileSystem, MFTLoadDepth loadDepth = MFTLoadDepth.Full, string path = "" ) : MFTRecord
recordNum ulong
fileSystem FileSystemNTFS
loadDepth MFTLoadDepth
path string
Результат MFTRecord
Пример #1
0
        public FileSystemNTFS(IFileSystemStore store)
        {
            Store = store;

            LoadBPB();

            _mftSector = (BPB_MFTStartCluster64 * BPB_SecPerClus);
            _MFT       = new FileNTFS(MFTRecord.Load(0, this), "");
            _root      = new FolderNTFS(MFTRecord.Load(5, this), "", true);

            _bitmapFile = new FileNTFS(MFTRecord.Load(6, this), "");
            _bitmap     = _bitmapFile.GetBytes(0, _bitmapFile.StreamLength);
        }
Пример #2
0
        private void MftScan(FileSystem.NodeVisitCallback callback)
        {
            ulong numFiles = _MFT.StreamLength / (ulong)(SectorsPerMFTRecord * BytesPerSector);

            for (ulong i = 0; i < numFiles; i++)
            {
                MFTRecord record = MFTRecord.Load(i, this, MFTLoadDepth.NameAttributeOnly);

                if (record.Valid)
                {
                    if (!callback(record, i, numFiles))
                    {
                        return;
                    }
                }
            }
        }
Пример #3
0
        private void LoadExternalAttributeList(int startOffset, MFTAttribute attrList)
        {
            int offset = 0;

            while (true)
            {
                //Align to 8 byte boundary
                if (offset % 8 != 0)
                {
                    offset = (offset / 8 + 1) * 8;
                }

                // Load the header for this external attribute reference.
                AttributeType type = (AttributeType)BitConverter.ToUInt32(_data, offset + startOffset + 0x0);
                // 0xFFFFFFFF marks end of attributes.
                if (offset == attrList.ValueLength || type == AttributeType.End)
                {
                    break;
                }
                ushort length                = BitConverter.ToUInt16(_data, offset + startOffset + 0x4);
                byte   nameLength            = _data[offset + startOffset + 0x6];
                ushort id                    = BitConverter.ToUInt16(_data, offset + startOffset + 0x18);
                ulong  vcn                   = BitConverter.ToUInt64(_data, offset + startOffset + 0x8);
                ulong  extensionRecordNumber = (BitConverter.ToUInt64(_data, offset + startOffset + 0x10) & 0x00000000FFFFFFFF);

                if (extensionRecordNumber != RecordNum && extensionRecordNumber != MFTRecordNumber)                   // TODO: Are these ever different?
                // Load the MFT extension record, locate the attribute we want, and copy it over.
                {
                    MFTRecord extensionRecord = MFTRecord.Load(extensionRecordNumber, this.FileSystem);
                    if (extensionRecord.Valid)
                    {
                        foreach (MFTAttribute externalAttribute in extensionRecord._attributes)
                        {
                            if (id == externalAttribute.Id)
                            {
                                if (externalAttribute.NonResident && externalAttribute.Type == AttributeType.Data)
                                {
                                    // Find the corresponding data attribute on this record and merge the runlists
                                    bool merged = false;
                                    foreach (MFTAttribute attribute in _attributes)
                                    {
                                        if (attribute.Type == AttributeType.Data && externalAttribute.Name == attribute.Name)
                                        {
                                            MergeRunLists(ref attribute.Runs, externalAttribute.Runs);
                                            merged = true;
                                            break;
                                        }
                                    }
                                    if (!merged)
                                    {
                                        this._attributes.Add(externalAttribute);
                                    }
                                }
                                else
                                {
                                    this._attributes.Add(externalAttribute);
                                }
                            }
                        }
                    }
                }

                offset += 0x1A + (nameLength * 2);
            }
        }