public static extern bool InsertMenu(
IntPtr hmenu,
uint uPosition,
MFT uflags,
uint uIDNewItem,
[MarshalAs(UnmanagedType.LPTStr)]
string lpNewItem);
private void поискToolStripMenuItem_Click(object sender, EventArgs e)
{
if (folderBrowserDialog1.ShowDialog() == DialogResult.OK) // Если выбрали катало
{
string fileName = folderBrowserDialog1.SelectedPath; // путь к выбранному каталогу
string[] catalogs = fileName.Split(new char[] { Path.DirectorySeparatorChar }, StringSplitOptions.RemoveEmptyEntries); //Разбиваем полный путь на имена каталогов
NTFS ntfs = new NTFS(catalogs[0]); // создаем объектное представление файловой системы логического диска
int nextRecord = 5; // 5 запись -- корневой каталог, поиск начинаем с него
MFT root; // переменная для хранения текущего каталога
for (int i = 1; i < catalogs.Length; i++)
{
root = ntfs.GetMftRecord(nextRecord); // читаем следующую запись МФТ со всеми аттрибутами, включая INDEX_ROOT и INDEX_ALLOCATION
nextRecord = FoundSubdir(root, catalogs[i]); // Ищем номер записи МФТ следующего каталога
}
MFT catalog = ntfs.GetMftRecord(nextRecord); // Читаем запись найденного каталога
display = new List <DisplayMFT>();
display.Add(new DisplayMFT(catalog)); // Первым отображается запись самого каталога
foreach (var index in catalog.Indexes)
{
display.Add(new DisplayMFT(ntfs.GetMftRecord((int)index.IndexedFile))); // добавляем в отображаемые записи сведения о файле в каталоге
}
dataGridView1.DataSource = null;
dataGridView1.DataSource = display; // выводим данные в таблицу
}
}
private int FoundSubdir(MFT record, string dir) // функция поиска файла в индексных элементах каталога по имени файла
{
int result = 0;
foreach (var index in record.Indexes) // для всех индексных элементов каталога проверяем
{
if (index.FileNameString == dir) // если имя файла совпадает с введенным, то сохраняем номер записи МФТ из индексного элемента
{
result = (int)index.IndexedFile;
}
}
return(result); // возвращаем найденный номер
}
public MENUITEMINFO(string text)
{
cbSize = CbMenuItemInfo;
dwTypeData = text;
cch = text.Length;
fMask = 0;
fType = 0;
fState = 0;
wID = 0;
hSubMenu = IntPtr.Zero;
hbmpChecked = IntPtr.Zero;
hbmpUnchecked = IntPtr.Zero;
dwItemData = IntPtr.Zero;
hbmpItem = IntPtr.Zero;
}
private ShellMenuCommandBuilder GetFolderCommandBuilder()
{
if (folder == null)
{
return(new ShellMenuCommandBuilder());
}
ShellMenuCommandBuilder builder = new ShellMenuCommandBuilder();
MFT flags = MFT.BYCOMMAND;
if (!folder.IsFileSystem)
{
flags |= MFT.DISABLED;
}
builder.AddCommand(new ShellMenuCommand
{
Flags = flags,
Label = "Paste",
UID = (uint)CommonContextMenuItem.Paste
});
builder.AddSeparator();
if (folder.IsFileSystem && folder.IsFolder)
{
builder.AddShellNewMenu();
builder.AddSeparator();
}
builder.AddCommand(new ShellMenuCommand
{
Flags = flags,
Label = "Properties",
UID = (uint)CommonContextMenuItem.Properties
});
return(builder);
}
public static extern bool AppendMenu(
IntPtr hMenu,
MFT uFlags,
uint uIDNewItem,
[MarshalAs(UnmanagedType.LPTStr)]
string lpNewItem);
public MENUITEMINFO(string text)
{
cbSize = cbMenuItemInfo;
dwTypeData = text;
cch = text.Length;
fMask = 0;
fType = 0;
fState = 0;
wID = 0;
hSubMenu = IntPtr.Zero;
hbmpChecked = IntPtr.Zero;
hbmpUnchecked = IntPtr.Zero;
dwItemData = IntPtr.Zero;
hbmpItem = IntPtr.Zero;
}
public static extern bool RemoveMenu(IntPtr hMenu, uint uPosition, MFT uFlags);
public static extern bool InsertMenu(IntPtr hmenu, uint uPosition, MFT uflags, uint uIDNewItem, [MarshalAs(UnmanagedType.LPTStr)] string lpNewItem);
public static extern bool AppendMenu(IntPtr hMenu, MFT uFlags, uint uIDNewItem, [MarshalAs(UnmanagedType.LPTStr)] string lpNewItem);
private ShellMenuCommandBuilder GetFolderCommandBuilder()
{
if (_desktopManager.DesktopLocation == null)
{
return(new ShellMenuCommandBuilder());
}
ShellMenuCommandBuilder builder = new ShellMenuCommandBuilder();
MFT flags = MFT.BYCOMMAND;
if (!_desktopManager.DesktopLocation.IsFileSystem)
{
flags |= MFT.DISABLED;
}
builder.AddCommand(new ShellMenuCommand
{
Flags = MFT.BYCOMMAND, // enable this entry always
Label = Localization.DisplayString.sStacks_OpenInNewWindow,
UID = (uint)CairoContextMenuItem.OpenInNewWindow
});
if (StacksManager.Instance.StackLocations.All(i => i.Path != _desktopManager.DesktopLocation.Path))
{
builder.AddCommand(new ShellMenuCommand
{
Flags = MFT.BYCOMMAND, // enable this entry always
Label = Localization.DisplayString.sInterface_AddToStacks,
UID = (uint)CairoContextMenuItem.AddToStacks
});
}
else
{
builder.AddCommand(new ShellMenuCommand
{
Flags = MFT.BYCOMMAND, // enable this entry always
Label = Localization.DisplayString.sInterface_RemoveFromStacks,
UID = (uint)CairoContextMenuItem.RemoveFromStacks
});
}
builder.AddSeparator();
builder.AddCommand(new ShellMenuCommand
{
Flags = flags,
Label = Localization.DisplayString.sInterface_Paste,
UID = (uint)CommonContextMenuItem.Paste
});
builder.AddSeparator();
if (_desktopManager.DesktopLocation.IsFileSystem && _desktopManager.DesktopLocation.IsFolder)
{
builder.AddShellNewMenu();
builder.AddSeparator();
}
if (EnvironmentHelper.IsWindows10OrBetter || !_desktopManager.DesktopLocation.IsDesktop)
{
// On Windows < 10, this does the same thing as Personalize when on the Desktop folder.
// Show it only if this isn't the Desktop folder, or if we are on Windows 10 (or later).
builder.AddCommand(new ShellMenuCommand
{
Flags = flags,
Label = Localization.DisplayString.sInterface_Properties,
UID = (uint)CommonContextMenuItem.Properties
});
builder.AddSeparator();
}
if (!EnvironmentHelper.IsAppRunningAsShell)
{
// Don't show this if we are shell, since this launches a UWP app
builder.AddCommand(new ShellMenuCommand
{
Flags = MFT.BYCOMMAND, // enable this entry always
Label = Localization.DisplayString.sDesktop_DisplaySettings,
UID = (uint)CairoContextMenuItem.DisplaySettings
});
}
builder.AddCommand(new ShellMenuCommand
{
Flags = MFT.BYCOMMAND, // enable this entry always
Label = Localization.DisplayString.sDesktop_Personalize,
UID = (uint)CairoContextMenuItem.Personalize
});
return(builder);
}
public static extern bool AppendMenu(IntPtr hMenu, MFT uFlags, uint uIDNewItem, string lpNewItem);
public static extern bool RemoveMenu(
IntPtr hMenu,
uint uPosition,
MFT uFlags);
void ParseAttributes(byte[] entry)
{
//Program.Log("Debug");
if (entry.Length == 1024)
{
//Program.Log("Debug");
int attrFirstType;
int firstAttr;
int attrFirstLength;
Int64 residentFirstValues;
Int64 residentSecondValues;
try
{
//Program.Log("Debug");
DB_Entry dbentry = new DB_Entry();
int lengthleft = 1024;
int fileNameLength = 0;
string fullpath = "";
string filename = "";
string attrname = "";
bool hasSia = false, hasFia = false;
byte[] arrMft = new byte[0x30];
//Program.Log("Debug");
Array.Copy(entry, 0, arrMft, 0, 0x30);
//Program.Log("Debug");
MFT mft = ByteArrayToStructure <MFT>(arrMft);
//Program.Log("Debug");
firstAttr = BitConverter.ToInt16(new byte[] { entry[0x14], entry[0x15] }, 0);
if (firstAttr >= entry.Length || firstAttr < 0)
{
//return;
}
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
residentFirstValues = BitConverter.ToInt64(new byte[] { entry[firstAttr + 8],
entry[firstAttr + 9], entry[firstAttr + 10], entry[firstAttr + 11], entry[firstAttr + 12],
entry[firstAttr + 13], entry[firstAttr + 14], entry[firstAttr + 15] }, 0);
residentSecondValues = BitConverter.ToInt64(new byte[] { entry[firstAttr + 16],
entry[firstAttr + 17], entry[firstAttr + 18], entry[firstAttr + 19], entry[firstAttr + 20],
entry[firstAttr + 21], entry[firstAttr + 22], entry[firstAttr + 23] }, 0);
lengthleft -= firstAttr;
while (lengthleft > 0)
{
byte[] buffer = new byte[0x400];
try
{
if (firstAttr + 24 <= entry.Length && attrFirstLength - 24 <= entry.Length && firstAttr > 0 && attrFirstLength - 24 > 0)
{
Array.Copy(entry, firstAttr + 24, buffer, 0, attrFirstLength - 24);
}
else
{
lengthleft = 0;
break;
}
//Program.Log("Debug");
//Program.Log("Debug");
}
catch (Exception ex)
{
lengthleft = 0;
}
switch (attrFirstType)
{
//SIA
case 0x10:
//Program.Log("Debug");
ATTR_SIA sia = ByteArrayToStructure <ATTR_SIA>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
//Debug.Print(sia.ToString());
dbentry.sia = sia;
hasSia = true;
break;
//ATTR LIST
case 0x20:
//Program.Log("Debug");
ATTR_LIST list = ByteArrayToStructure <ATTR_LIST>(buffer);
byte[] arrFileName = new byte[list.attrLength];
Array.Copy(buffer, 26, arrFileName, 0, arrFileName.Length);
attrname = System.Text.UnicodeEncoding.Unicode.GetString(arrFileName);
//Debug.Print(attrname);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//FIA
case 0x30:
//Program.Log("Debug");
ATTR_FIA fia = ByteArrayToStructure <ATTR_FIA>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
fileNameLength = fia.filenameLength * 2;
byte[] arrFileName2 = new byte[fileNameLength];
Array.Copy(buffer, 0x42, arrFileName2, 0, arrFileName2.Length);
filename = System.Text.UnicodeEncoding.Unicode.GetString(arrFileName2);
//Program.Log("Debug");
long temp = (fia.fiaReferenceParentDir << 48);
temp = temp >> 48;
int mftReferenceToHashTable = (int)temp;
if ((string)paths[mftReferenceToHashTable] != null)
{
fullpath = (string)paths[mftReferenceToHashTable];
}
fullpath += "\\" + filename;
dbentry.fia = fia;
hasFia = true;
if ((fia.flags & FLAGS.Directory) == FLAGS.Directory)
{
//Program.Log("Debug");
if (!paths.Contains(mft.mftRecordNumber))
{
paths.Add(mft.mftRecordNumber, fullpath);
}
break;
}
else
{
//Program.Log("Debug");
//Debug.Print(fia.ToString());
//Debug.Print("filename: " + fullpath);
//Debug.Print(mft.ToString());
break;
}
//OBJ ID
case 0x40:
//Program.Log("Debug");
ATTR_OBJID objid = ByteArrayToStructure <ATTR_OBJID>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//SEC DESC
case 0x50:
//Program.Log("Debug");
byte[] arrSids = new byte[attrFirstLength - 16];
ATTR_SECDESC secdesc = ByteArrayToStructure <ATTR_SECDESC>(buffer);
Array.Copy(buffer, 16, arrSids, 0, arrSids.Length);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//VOL NAME
case 0x60:
//Program.Log("Debug");
System.Text.UnicodeEncoding enc = new UnicodeEncoding();
ATTR_VOLNAME volname = new ATTR_VOLNAME(enc.GetString(buffer));
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//VOL INFO
case 0x70:
//Program.Log("Debug");
ATTR_VOLINFO volinfo = ByteArrayToStructure <ATTR_VOLINFO>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//DATA
case 0x80:
//Program.Log("Debug");
ATTR_DATA data = new ATTR_DATA();
data.data = buffer;
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//INDX ROOT
case 0x90:
//Program.Log("Debug");
ATTR_INDXROOT indxroot = ByteArrayToStructure <ATTR_INDXROOT>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//INDX ALLOC
case 0xA0:
//Program.Log("Debug");
ATTR_INDXALLOC indxalloc = new ATTR_INDXALLOC();
indxalloc.entries = buffer;
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//BITMAP
case 0xB0:
//Program.Log("Debug");
ATTR_BITMAP bitmap = ByteArrayToStructure <ATTR_BITMAP>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//REPARSE
case 0xC0:
//Program.Log("Debug");
ATTR_REPARSE reparse = new ATTR_REPARSE(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//EA INFO
case 0xD0:
//Program.Log("Debug");
ATTR_EAINFO eainfo = ByteArrayToStructure <ATTR_EAINFO>(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
//EA
case 0xE0:
//Program.Log("Debug");
ATTR_EA ea = new ATTR_EA(buffer);
firstAttr += attrFirstLength;
attrFirstType = BitConverter.ToInt32(new byte[] { entry[firstAttr],
entry[firstAttr + 1], entry[firstAttr + 2], entry[firstAttr + 3] }, 0);
attrFirstLength = BitConverter.ToInt32(new byte[] { entry[firstAttr + 4],
entry[firstAttr + 5], entry[firstAttr + 6], entry[firstAttr + 7] }, 0);
break;
default:
//Program.Log("Debug");
lengthleft = 0;
break;
}
lengthleft -= firstAttr;
}
if (hasFia != false && hasSia != false)
{
//Program.Log("Debug");
//dbEntries.Add(new Tuple<string, string[]>("nav", new string[] {"NULL", fullpath, filename, DateTime.FromFileTime(dbentry.sia.siaCreate).ToString(),
//DateTime.FromFileTime(dbentry.sia.siaAccess).ToString(),DateTime.FromFileTime(dbentry.sia.siaAlter).ToString(),
//DateTime.FromFileTime(dbentry.sia.siaMod).ToString(),DateTime.FromFileTime(dbentry.fia.fiaCreate).ToString(),
//DateTime.FromFileTime(dbentry.fia.fiaMod).ToString(),DateTime.FromFileTime(dbentry.fia.fiaAccess).ToString(),
//DateTime.FromFileTime(dbentry.fia.fiaAlter).ToString(),dbentry.fia.fiaAllocSize.ToString()}));
conn.Insert("mft", new string[] { "NULL", fullpath, filename, DateTime.FromFileTime(dbentry.sia.siaCreate).ToString(),
DateTime.FromFileTime(dbentry.sia.siaAccess).ToString(), DateTime.FromFileTime(dbentry.sia.siaAlter).ToString(),
DateTime.FromFileTime(dbentry.sia.siaMod).ToString(), DateTime.FromFileTime(dbentry.fia.fiaCreate).ToString(),
DateTime.FromFileTime(dbentry.fia.fiaMod).ToString(), DateTime.FromFileTime(dbentry.fia.fiaAccess).ToString(),
DateTime.FromFileTime(dbentry.fia.fiaAlter).ToString(), dbentry.fia.fiaAllocSize.ToString() });
}
}
catch (Exception ex)
{
//Program.Log("Debug");
}
}
else
{
//Program.Log("Debug");
return;
//throw new ArgumentOutOfRangeException();
}
}
