示例#1
0
        internal override void ReadAttributeResident(byte[] data, int maxLength, int offset)
        {
            base.ReadAttributeResident(data, maxLength, offset);

            if (maxLength < 48)
            {
                throw new Exception("STANDARD_INFORMATION : max length of data stream is < 48!\n");
            }

            //                                                                                      position
            CreationTime   = NtfsHelper.FromWinFileTime(data, offset);                          //     80
            ModifiedTime   = NtfsHelper.FromWinFileTime(data, offset + 8);                      //     88
            MFTChangeTime  = NtfsHelper.FromWinFileTime(data, offset + 16);                     //     96
            AccessTime     = NtfsHelper.FromWinFileTime(data, offset + 24);                     //    104
            DosPermissions = (FileAttributes)BitConverter.ToInt32(data, offset + 32);           //    112

            MaxNumberVersions = BitConverter.ToUInt32(data, offset + 36);                       //    116
            VersionNumber     = BitConverter.ToUInt32(data, offset + 40);                       //    120
            ClassId           = BitConverter.ToUInt32(data, offset + 44);                       //    124

            // for NTFS 3.0+ version
            if (FormCode == ResidentFileFlag.Resident && ResidentHeader.ValueLength >= 72)
            {
                if (maxLength < 72)
                {
                    throw new Exception("Max length of a byte stream is less than 72!\n");
                }

                OwnerId     = BitConverter.ToUInt32(data, offset + 48);                         //    128
                SecurityId  = BitConverter.ToUInt32(data, offset + 52);                         //    132
                QuotaCharge = BitConverter.ToUInt64(data, offset + 56);                         //    136
                USN         = BitConverter.ToUInt64(data, offset + 64);                         //    144
            }
        }
示例#2
0
        internal override void ReadAttributeResident(byte[] data, int maxLength, int offset)
        {
            base.ReadAttributeResident(data, maxLength, offset);

            //                                                                                      position
            ParentDirectory   = new MFTSegmentReference(BitConverter.ToUInt64(data, offset));   //    176
            CreationTime      = NtfsHelper.FromWinFileTime(data, offset + 8);                   //    184
            ModifiedTime      = NtfsHelper.FromWinFileTime(data, offset + 16);                  //    192
            MFTChangeTime     = NtfsHelper.FromWinFileTime(data, offset + 24);                  //    200
            AccessTime        = NtfsHelper.FromWinFileTime(data, offset + 32);                  //    208
            AllocatedSize     = BitConverter.ToUInt64(data, offset + 40);                       //    216
            RealSize          = BitConverter.ToUInt64(data, offset + 48);                       //    224
            FileFlags         = (FileAttributes)BitConverter.ToInt32(data, offset + 56);        //    232
            EASandReaparse    = BitConverter.ToUInt32(data, offset + 60);                       //    236
            FilenameLength    = data[offset + 64];                                              //    240
            FilenameNamespace = (FileNamespace)data[offset + 65];                               //    241

            if (maxLength < 66 + FilenameLength * 2)
            {
                throw new Exception("Error!\n");
            }

            Filename = Encoding.Unicode.GetString(data, offset + 66, FilenameLength * 2);       //    242
        }