internal static List<IndexEntry> Get(FileStream streamToRead, byte[] MFT, int index)
{
MFTRecord fileRecord = MFTRecord.Get(MFT, index, null, null);
NonResident INDX = null;
Console.WriteLine("Count: {0}", fileRecord.Attribute.Length);
foreach (Attr attr in fileRecord.Attribute)
{
if (attr.Name == "INDEX_ALLOCATION")
{
if (attr.NonResident)
{
INDX = (NonResident)attr;
}
}
}
byte[] nonResBytes = NonResident.GetContent(streamToRead, INDX);
List<IndexEntry> indxEntryList = new List<IndexEntry>();
for (int offset = 0; offset < nonResBytes.Length; offset += 4096)
{
byte[] indxBytes = nonResBytes.Skip(offset).Take(4096).ToArray();
INDEX_BLOCK indxBlock = new INDEX_BLOCK(indxBytes.Take(40).ToArray());
byte[] IndexAllocEntryBytes = indxBytes.Skip(64).ToArray();
int offsetIndx = 0;
int offsetIndxPrev = 1;
while ((offsetIndx < IndexAllocEntryBytes.Length) && (offsetIndx != offsetIndxPrev))
{
INDEX_ENTRY indxEntryStruct = new INDEX_ENTRY(IndexAllocEntryBytes.Skip(offsetIndx).ToArray());
offsetIndxPrev = offsetIndx;
offsetIndx += indxEntryStruct.Size;
if (indxEntryStruct.Stream.Length > 66)
{
FileName.ATTR_FILE_NAME fileNameStruct = new FileName.ATTR_FILE_NAME(indxEntryStruct.Stream);
#region indxFlags
StringBuilder indxFlags = new StringBuilder();
if (indxEntryStruct.Flags != 0)
{
if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.SUBNODE) == (int)INDEX_ENTRY_FLAG.SUBNODE)
{
indxFlags.Append("Subnode, ");
}
if ((indxEntryStruct.Flags & (int)INDEX_ENTRY_FLAG.LAST) == (int)INDEX_ENTRY_FLAG.LAST)
{
indxFlags.Append("Last Entry, ");
}
indxFlags.Length -= 2;
}
#endregion indxFlags
string Name = System.Text.Encoding.Unicode.GetString(fileNameStruct.Name);
IndexEntry indxEntry = new IndexEntry(indxEntryStruct, indxFlags.ToString(), Name);
indxEntryList.Add(indxEntry);
}
}
}
return indxEntryList;
}
internal IndexEntry(INDEX_ENTRY indxEntry, string flag, string name)
{
FileIndex = (indxEntry.FileReference & 0x0000FFFFFFFFFFFF);
Flags = flag;
Name = name;
}
