private bool VerifyMftRecord(byte[] recordData, bool presentInBitmap, int bytesPerSector)
{
bool ok = true;
//
// Verify the attributes seem OK...
//
byte[] tempBuffer = new byte[recordData.Length];
Array.Copy(recordData, tempBuffer, tempBuffer.Length);
GenericFixupRecord genericRecord = new GenericFixupRecord(bytesPerSector);
genericRecord.FromBytes(tempBuffer, 0);
int pos = Utilities.ToUInt16LittleEndian(genericRecord.Content, 0x14);
while (Utilities.ToUInt32LittleEndian(genericRecord.Content, pos) != 0xFFFFFFFF)
{
int attrLen;
try
{
AttributeRecord ar = AttributeRecord.FromBytes(genericRecord.Content, pos, out attrLen);
if (attrLen != ar.Size)
{
ReportError("Attribute size is different to calculated size. AttrId={0}", ar.AttributeId);
ok = false;
}
if (ar.IsNonResident)
{
NonResidentAttributeRecord nrr = (NonResidentAttributeRecord)ar;
if (nrr.DataRuns.Count > 0)
{
long totalVcn = 0;
foreach (var run in nrr.DataRuns)
{
totalVcn += run.RunLength;
}
if (totalVcn != nrr.LastVcn - nrr.StartVcn + 1)
{
ReportError("Declared VCNs doesn't match data runs. AttrId={0}", ar.AttributeId);
ok = false;
}
}
}
}
catch
{
ReportError("Failure parsing attribute at pos={0}", pos);
return(false);
}
pos += attrLen;
}
//
// Now consider record as a whole
//
FileRecord record = new FileRecord(bytesPerSector);
record.FromBytes(recordData, 0);
bool inUse = (record.Flags & FileRecordFlags.InUse) != 0;
if (inUse != presentInBitmap)
{
ReportError("MFT bitmap and record in-use flag don't agree. Mft={0}, Record={1}", presentInBitmap ? "InUse" : "Free", inUse ? "InUse" : "Free");
ok = false;
}
if (record.Size != record.RealSize)
{
ReportError("MFT record real size is different to calculated size. Stored in MFT={0}, Calculated={1}", record.RealSize, record.Size);
ok = false;
}
if (Utilities.ToUInt32LittleEndian(recordData, (int)record.RealSize - 8) != uint.MaxValue)
{
ReportError("MFT record is not correctly terminated with 0xFFFFFFFF");
ok = false;
}
return(ok);
}
private void LoadAttributes()
{
Dictionary <long, FileRecord> extraFileRecords = new Dictionary <long, FileRecord>();
AttributeRecord attrListRec = _records[0].GetAttribute(AttributeType.AttributeList);
if (attrListRec != null)
{
NtfsAttribute lastAttr = null;
StructuredNtfsAttribute <AttributeList> attrListAttr = (StructuredNtfsAttribute <AttributeList>)NtfsAttribute.FromRecord(this, MftReference, attrListRec);
var attrList = attrListAttr.Content;
_attributes.Add(attrListAttr);
foreach (var record in attrList)
{
FileRecord attrFileRecord = _records[0];
if (record.BaseFileReference.MftIndex != _records[0].MasterFileTableIndex)
{
if (!extraFileRecords.TryGetValue(record.BaseFileReference.MftIndex, out attrFileRecord))
{
attrFileRecord = _context.Mft.GetRecord(record.BaseFileReference);
if (attrFileRecord != null)
{
extraFileRecords[attrFileRecord.MasterFileTableIndex] = attrFileRecord;
}
}
}
if (attrFileRecord != null)
{
AttributeRecord attrRec = attrFileRecord.GetAttribute(record.AttributeId);
if (attrRec != null)
{
if (record.StartVcn == 0)
{
lastAttr = NtfsAttribute.FromRecord(this, record.BaseFileReference, attrRec);
_attributes.Add(lastAttr);
}
else
{
lastAttr.AddExtent(record.BaseFileReference, attrRec);
}
}
}
}
foreach (var extraFileRecord in extraFileRecords)
{
_records.Add(extraFileRecord.Value);
}
}
else
{
foreach (var record in _records[0].Attributes)
{
_attributes.Add(NtfsAttribute.FromRecord(this, MftReference, record));
}
}
}
private bool SplitAttribute(FileRecord record, NonResidentAttributeRecord targetAttr, bool atStart)
{
if (targetAttr.DataRuns.Count <= 1)
{
return(false);
}
int splitIndex = 1;
if (!atStart)
{
// Approximation only - assumes each run is at least one byte saved. Could calculate the
// actual index here.
splitIndex = (int)(targetAttr.DataRuns.Count - (record.Size - record.AllocatedSize));
}
AttributeRecord newAttr = targetAttr.Split(splitIndex);
// Find a home for the new attribute record
FileRecord newAttrHome = null;
foreach (var targetRecord in _records)
{
if (!targetRecord.IsMftRecord && _mft.RecordSize - targetRecord.Size >= newAttr.Size)
{
targetRecord.AddAttribute(newAttr);
newAttrHome = targetRecord;
}
}
if (newAttrHome == null)
{
newAttrHome = _mft.AllocateRecord(_records[0].Flags & (~FileRecordFlags.InUse), record.IsMftRecord);
newAttrHome.BaseFile = record.BaseFile.IsNull ? record.Reference : record.BaseFile;
_records.Add(newAttrHome);
newAttrHome.AddAttribute(newAttr);
}
// Add the new attribute record as an extent on the attribute it split from
bool added = false;
foreach (var attr in _attributes)
{
foreach (var existingRecord in attr.Extents)
{
if (existingRecord.Key.File == record.Reference && existingRecord.Key.AttributeId == targetAttr.AttributeId)
{
attr.AddExtent(newAttrHome.Reference, newAttr);
added = true;
break;
}
}
if (added)
{
break;
}
}
UpdateAttributeList();
return(true);
}
public Directory(INtfsContext context, FileRecord baseRecord)
: base(context, baseRecord)
{
}
