Пример #1
0
 internal byte[] GetContent(NtfsVolumeBootRecord VBR)
 {
     foreach (FileRecordAttribute attr in this.Attribute)
     {
         if (attr.Name == FileRecordAttribute.ATTR_TYPE.DATA)
         {
             if (attr.NonResident)
             {
                 return((attr as NonResident).GetBytes(VBR));
             }
             else
             {
                 return((attr as Data).RawData);
             }
         }
         else if (attr.Name == FileRecordAttribute.ATTR_TYPE.ATTRIBUTE_LIST)
         {
             AttributeList attrlist = attr as AttributeList;
             foreach (AttrRef ar in attrlist.AttributeReference)
             {
                 if (ar.Name == "DATA")
                 {
                     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, (int)VBR.BytesPerFileRecord, true);
                     return(record.GetContent());
                 }
             }
         }
     }
     throw new Exception("Could not locate file contents");
 }
Пример #2
0
        public static byte[] GetSlackByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            byte[] bytes = record.GetContent();
            return(GetSlack(bytes));
        }
Пример #3
0
        internal static FileRecord[] GetInstances(string volume, bool fast)
        {
            FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true);

            byte[] mftBytes = record.GetContent();
            return(GetInstances(mftBytes, volume, fast));
        }
Пример #4
0
        public static FileRecord[] GetInstancesTest(string volume)
        {
            FileRecord record = FileRecord.Get(volume, MftIndex.MFT_INDEX, true);

            byte[] mftBytes = record.GetContent();
            return(GetInstancesTest(mftBytes, volume));
        }
Пример #5
0
        public static FileRecord[] GetInstances(string volume)
        {
            FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);

            byte[] mftBytes = record.GetContent();
            return(GetInstances(mftBytes, volume));
        }
Пример #6
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="path"></param>
        /// <returns></returns>
        public static FileRecord[] GetInstancesByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            byte[] mftBytes = record.GetContent();
            return(GetInstances(mftBytes, Helper.GetVolumeFromPath(path), false));
        }
Пример #7
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="volume"></param>
        /// <returns></returns>
        public static AttrDef[] GetInstances(string volume)
        {
            Helper.getVolumeName(ref volume);
            FileRecord record = FileRecord.Get(volume, MftIndex.ATTRDEF_INDEX, true);

            return(AttrDef.GetInstances(record.GetContent()));
        }
Пример #8
0
        public static FileRecord[] GetInstancesByPath(string path)
        {
            string     volume = Util.GetVolumeFromPath(path);
            FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);

            byte[] mftBytes = record.GetContent();
            return(GetInstances(mftBytes, volume));
        }
Пример #9
0
 internal byte[] GetContent(VolumeBootRecord VBR)
 {
     foreach (Attr attr in this.Attribute)
     {
         if (attr.Name == Attr.ATTR_TYPE.DATA)
         {
             if (attr.NonResident)
             {
                 return (attr as NonResident).GetBytes(this.VolumePath, VBR);
             }
             else
             {
                 return (attr as Data).RawData;
             }
         }
         else if (attr.Name == Attr.ATTR_TYPE.ATTRIBUTE_LIST)
         {
             AttributeList attrlist = attr as AttributeList;
             foreach (AttrRef ar in attrlist.AttributeReference)
             {
                 if (ar.Name == "DATA")
                 {
                     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(this.VolumePath, (int)ar.RecordNumber), this.VolumePath, true);
                     return record.GetContent();
                 }
             }
         }
     }
     throw new Exception("Could not locate file contents");
 }
Пример #10
0
 public static FileRecord[] GetInstancesByPath(string path)
 {
     string volume = Util.GetVolumeFromPath(path);
     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(path), volume, true);
     byte[] mftBytes = record.GetContent();
     return GetInstances(mftBytes, volume);
 }
Пример #11
0
 public static FileRecord[] GetInstances(string volume)
 {
     FileRecord record = new FileRecord(FileRecord.GetRecordBytes(volume, 0), volume, true);
     byte[] mftBytes = record.GetContent();
     return GetInstances(mftBytes, volume);
 }
Пример #12
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="streamToRead"></param>
        /// <param name="volume"></param>
        /// <returns></returns>
        internal static byte[] GetBytes(FileStream streamToRead, string volume)
        {
            FileRecord mftRecord = GetRecord(streamToRead, volume);

            return(mftRecord.GetContent());
        }
Пример #13
0
        public static byte[] GetBytesByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            return(record.GetContent());
        }
Пример #14
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="path"></param>
        /// <returns></returns>
        public static UsnJrnlInformation GetByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            return(new UsnJrnlInformation(record.GetContent(@"$Max")));
        }
Пример #15
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="path"></param>
        /// <param name="streamName"></param>
        /// <returns></returns>
        public static byte[] GetContentBytes(string path, string streamName)
        {
            FileRecord record = Get(path, true);

            return(record.GetContent(streamName));
        }
Пример #16
0
        /// <summary>
        ///
        /// </summary>
        /// <param name="path"></param>
        /// <returns></returns>
        public static AttrDef[] GetInstancesByPath(string path)
        {
            FileRecord record = FileRecord.Get(path, true);

            return(AttrDef.GetInstances(record.GetContent()));
        }
Пример #17
0
        public static AttrDef[] GetInstances(string volume)
        {
            FileRecord record = FileRecord.Get(volume, ATTRDEF_INDEX, true);

            return(AttrDef.GetInstances(record.GetContent()));
        }