private void PreVerifyMft(File file)
{
int recordLength = _context.BiosParameterBlock.MftRecordSize;
int bytesPerSector = _context.BiosParameterBlock.BytesPerSector;
// Check out the MFT's clusters
foreach (var range in file.GetAttribute(AttributeType.Data, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT data attribute {0}", range.ToString());
Abort();
}
}
foreach (var range in file.GetAttribute(AttributeType.Bitmap, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT bitmap attribute {0}", range.ToString());
Abort();
}
}
using (Stream mftStream = file.OpenStream(AttributeType.Data, null, FileAccess.Read))
using (Stream bitmapStream = file.OpenStream(AttributeType.Bitmap, null, FileAccess.Read))
{
Bitmap bitmap = new Bitmap(bitmapStream, long.MaxValue);
long index = 0;
while (mftStream.Position < mftStream.Length)
{
byte[] recordData = Utilities.ReadFully(mftStream, recordLength);
string magic = Utilities.BytesToString(recordData, 0, 4);
if (magic != "FILE")
{
if (bitmap.IsPresent(index))
{
ReportError("Invalid MFT record magic at index {0} - was ({2},{3},{4},{5}) \"{1}\"", index, magic.Trim('\0'), (int)magic[0], (int)magic[1], (int)magic[2], (int)magic[3]);
}
}
else
{
if (!VerifyMftRecord(recordData, bitmap.IsPresent(index), bytesPerSector))
{
ReportError("Invalid MFT record at index {0}", index);
StringBuilder bldr = new StringBuilder();
for (int i = 0; i < recordData.Length; ++i)
{
bldr.Append(string.Format(CultureInfo.InvariantCulture, " {0:X2}", recordData[i]));
}
ReportInfo("MFT record binary data for index {0}:{1}", index, bldr.ToString());
}
}
index++;
}
}
}
public long MapPosition(long pos)
{
if (_attribute.IsNonResident)
{
return(((IMappedBuffer)_attribute.RawBuffer).MapPosition(pos));
}
else
{
AttributeReference attrRef = new AttributeReference(_file.MftReference, _attribute.PrimaryRecord.AttributeId);
ResidentAttributeRecord attrRecord = (ResidentAttributeRecord)_file.GetAttribute(attrRef).PrimaryRecord;
long attrStart = _file.GetAttributeOffset(attrRef);
long mftPos = attrStart + attrRecord.DataOffset + pos;
return(_file.Context.GetFileByIndex(MasterFileTable.MftIndex).GetAttribute(AttributeType.Data, null).OffsetToAbsolutePos(mftPos));
}
}
private void PreVerifyMft(File file)
{
int recordLength = _context.BiosParameterBlock.MftRecordSize;
int bytesPerSector = _context.BiosParameterBlock.BytesPerSector;
// Check out the MFT's clusters
foreach (var range in file.GetAttribute(AttributeType.Data, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT data attribute {0}", range.ToString());
Abort();
}
}
foreach (var range in file.GetAttribute(AttributeType.Bitmap, null).GetClusters())
{
if (!VerifyClusterRange(range))
{
ReportError("Corrupt cluster range in MFT bitmap attribute {0}", range.ToString());
Abort();
}
}
using (Stream mftStream = file.OpenStream(AttributeType.Data, null, FileAccess.Read))
using (Stream bitmapStream = file.OpenStream(AttributeType.Bitmap, null, FileAccess.Read))
{
Bitmap bitmap = new Bitmap(bitmapStream, long.MaxValue);
long index = 0;
while (mftStream.Position < mftStream.Length)
{
byte[] recordData = Utilities.ReadFully(mftStream, recordLength);
string magic = Utilities.BytesToString(recordData, 0, 4);
if (magic != "FILE")
{
if (bitmap.IsPresent(index))
{
ReportError("Invalid MFT record magic at index {0} - was ({2},{3},{4},{5}) \"{1}\"", index, magic.Trim('\0'), (int)magic[0], (int)magic[1], (int)magic[2], (int)magic[3]);
}
}
else
{
if (!VerifyMftRecord(recordData, bitmap.IsPresent(index), bytesPerSector))
{
ReportError("Invalid MFT record at index {0}", index);
StringBuilder bldr = new StringBuilder();
for (int i = 0; i < recordData.Length; ++i)
{
bldr.Append(string.Format(CultureInfo.InvariantCulture, " {0:X2}", recordData[i]));
}
ReportInfo("MFT record binary data for index {0}:{1}", index, bldr.ToString());
}
}
index++;
}
}
}
