示例#1
0
        private void CreateAttributeList()
        {
            ushort id = _records[0].CreateAttribute(AttributeType.AttributeList, null, false, AttributeFlags.None);

            StructuredNtfsAttribute <AttributeList> newAttr = (StructuredNtfsAttribute <AttributeList>)NtfsAttribute.FromRecord(this, MftReference, _records[0].GetAttribute(id));

            _attributes.Add(newAttr);
            UpdateAttributeList();
        }
示例#2
0
        internal void Delete()
        {
            if (_records[0].HardLinkCount != 0)
            {
                throw new InvalidOperationException("Attempt to delete in-use file: " + ToString());
            }

            NtfsStream objIdStream = GetStream(AttributeType.ObjectId, null);

            if (objIdStream != null)
            {
                ObjectId objId = objIdStream.GetContent <ObjectId>();
                Context.ObjectIds.Remove(objId.Id);
            }

            foreach (var attr in _attributes)
            {
                attr.GetDataBuffer().SetCapacity(0);
            }

            AttributeRecord attrListRec = _records[0].GetAttribute(AttributeType.AttributeList);

            if (attrListRec != null)
            {
                StructuredNtfsAttribute <AttributeList> attrList = (StructuredNtfsAttribute <AttributeList>)GetAttribute(new AttributeReference(MftReference, attrListRec.AttributeId));
                foreach (var record in attrList.Content)
                {
                    FileRecord attrFileRecord = _records[0];
                    if (record.BaseFileReference.MftIndex != _records[0].MasterFileTableIndex)
                    {
                        attrFileRecord = _context.Mft.GetRecord(record.BaseFileReference);
                    }

                    if (attrFileRecord != null)
                    {
                        attrFileRecord.RemoveAttribute(record.AttributeId);
                        if (attrFileRecord.Attributes.Count == 0)
                        {
                            _context.Mft.RemoveRecord(record.BaseFileReference);
                        }
                    }
                }
            }

            List <AttributeRecord> records = new List <AttributeRecord>(_records[0].Attributes);

            foreach (var record in records)
            {
                _records[0].RemoveAttribute(record.AttributeId);
            }

            _attributes.Clear();

            _context.Mft.RemoveRecord(MftReference);
            _context.ForgetFile(this);
        }
示例#3
0
        public override string ToString()
        {
            foreach (AttributeRecord attr in _attributes)
            {
                if (attr.AttributeType == AttributeType.FileName)
                {
                    StructuredNtfsAttribute <FileNameRecord> fnAttr = (StructuredNtfsAttribute <FileNameRecord>)NtfsAttribute.FromRecord(null, new FileRecordReference(0), attr);
                    return(fnAttr.Content.FileName);
                }
            }

            return("No Name");
        }
示例#4
0
        public FileNameRecord GetFileNameRecord(string name, bool freshened)
        {
            NtfsAttribute[] attrs = GetAttributes(AttributeType.FileName);
            StructuredNtfsAttribute <FileNameRecord> attr = null;

            if (string.IsNullOrEmpty(name))
            {
                if (attrs.Length != 0)
                {
                    attr = (StructuredNtfsAttribute <FileNameRecord>)attrs[0];
                }
            }
            else
            {
                foreach (StructuredNtfsAttribute <FileNameRecord> a in attrs)
                {
                    if (_context.UpperCase.Compare(a.Content.FileName, name) == 0)
                    {
                        attr = a;
                    }
                }

                if (attr == null)
                {
                    throw new FileNotFoundException("File name not found on file", name);
                }
            }

            FileNameRecord fnr = attr == null ? new FileNameRecord() : new FileNameRecord(attr.Content);

            if (freshened)
            {
                FreshenFileName(fnr, false);
            }

            return(fnr);
        }
示例#5
0
        private void LoadAttributes()
        {
            Dictionary <long, FileRecord> extraFileRecords = new Dictionary <long, FileRecord>();

            AttributeRecord attrListRec = _records[0].GetAttribute(AttributeType.AttributeList);

            if (attrListRec != null)
            {
                NtfsAttribute lastAttr = null;

                StructuredNtfsAttribute <AttributeList> attrListAttr =
                    (StructuredNtfsAttribute <AttributeList>)NtfsAttribute.FromRecord(this, MftReference, attrListRec);
                AttributeList attrList = attrListAttr.Content;
                _attributes.Add(attrListAttr);

                foreach (AttributeListRecord record in attrList)
                {
                    FileRecord attrFileRecord = _records[0];
                    if (record.BaseFileReference.MftIndex != _records[0].MasterFileTableIndex)
                    {
                        if (!extraFileRecords.TryGetValue(record.BaseFileReference.MftIndex, out attrFileRecord))
                        {
                            attrFileRecord = _context.Mft.GetRecord(record.BaseFileReference);
                            if (attrFileRecord != null)
                            {
                                extraFileRecords[attrFileRecord.MasterFileTableIndex] = attrFileRecord;
                            }
                        }
                    }

                    if (attrFileRecord != null)
                    {
                        AttributeRecord attrRec = attrFileRecord.GetAttribute(record.AttributeId);

                        if (attrRec != null)
                        {
                            if (record.StartVcn == 0)
                            {
                                lastAttr = NtfsAttribute.FromRecord(this, record.BaseFileReference, attrRec);
                                _attributes.Add(lastAttr);
                            }
                            else
                            {
                                lastAttr.AddExtent(record.BaseFileReference, attrRec);
                            }
                        }
                    }
                }

                foreach (KeyValuePair <long, FileRecord> extraFileRecord in extraFileRecords)
                {
                    _records.Add(extraFileRecord.Value);
                }
            }
            else
            {
                foreach (AttributeRecord record in _records[0].Attributes)
                {
                    _attributes.Add(NtfsAttribute.FromRecord(this, MftReference, record));
                }
            }
        }