protected override void DoRun()
{
VolumeManager volMgr = new VolumeManager();
foreach (string disk in _diskFiles.Values)
{
volMgr.AddDisk(VirtualDisk.OpenDisk(disk, FileAccess.Read, UserName, Password));
}
Stream partitionStream = null;
if (!string.IsNullOrEmpty(VolumeId))
{
partitionStream = volMgr.GetVolume(VolumeId).Open();
}
else if (Partition >= 0)
{
partitionStream = volMgr.GetPhysicalVolumes()[Partition].Open();
}
else
{
partitionStream = volMgr.GetLogicalVolumes()[0].Open();
}
SparseStream cacheStream = SparseStream.FromStream(partitionStream, Ownership.None);
cacheStream = new BlockCacheStream(cacheStream, Ownership.None);
NtfsFileSystem fs = new NtfsFileSystem(cacheStream);
fs.NtfsOptions.HideHiddenFiles = !_showHidden.IsPresent;
fs.NtfsOptions.HideSystemFiles = !_showSystem.IsPresent;
fs.NtfsOptions.HideMetafiles = !_showMeta.IsPresent;
fs.Dump(Console.Out, "");
}
protected override void DoRun()
{
VolumeManager volMgr = new VolumeManager();
foreach (string disk in _diskFiles.Values)
{
volMgr.AddDisk(VirtualDisk.OpenDisk(disk, _diskType.IsPresent ? _diskType.Value : null, FileAccess.Read, UserName, Password));
}
VolumeInfo volInfo = null;
if (!string.IsNullOrEmpty(VolumeId))
{
volInfo = volMgr.GetVolume(VolumeId);
}
else if (Partition >= 0)
{
volInfo = volMgr.GetPhysicalVolumes()[Partition];
}
else
{
volInfo = volMgr.GetLogicalVolumes()[0];
}
DiscUtils.FileSystemInfo fsInfo = FileSystemManager.DetectDefaultFileSystems(volInfo)[0];
using (DiscFileSystem fs = fsInfo.Open(volInfo, FileSystemParameters))
{
using (Stream source = fs.OpenFile(_inFilePath.Value, FileMode.Open, FileAccess.Read))
{
using (FileStream outFile = new FileStream(_outFilePath.Value, FileMode.Create, FileAccess.ReadWrite))
{
PumpStreams(source, outFile);
}
if (_hexDump.IsPresent)
{
source.Position = 0;
HexDump.Generate(source, Console.Out);
}
}
}
}
protected override void DoRun()
{
VolumeManager volMgr = new VolumeManager();
foreach (string disk in _diskFiles.Values)
{
volMgr.AddDisk(VirtualDisk.OpenDisk(disk, FileAccess.Read, UserName, Password));
}
VolumeInfo volInfo = null;
if (!string.IsNullOrEmpty(VolumeId))
{
volInfo = volMgr.GetVolume(VolumeId);
}
else if (Partition >= 0)
{
volInfo = volMgr.GetPhysicalVolumes()[Partition];
}
else
{
volInfo = volMgr.GetLogicalVolumes()[0];
}
using (NtfsFileSystem fs = new NtfsFileSystem(volInfo.Open()))
{
MasterFileTable mft = fs.GetMasterFileTable();
if (_recoverFile.IsPresent)
{
MasterFileTableEntry entry = mft[long.Parse(_recoverFile.Value)];
IBuffer content = GetContent(entry);
if (content == null)
{
Console.WriteLine("Sorry, unable to recover content");
Environment.Exit(1);
}
string outFile = _recoverFile.Value + "__recovered.bin";
if (File.Exists(outFile))
{
Console.WriteLine("Sorry, the file already exists: " + outFile);
Environment.Exit(1);
}
using (FileStream outFileStream = new FileStream(outFile, FileMode.CreateNew, FileAccess.Write))
{
Pump(content, outFileStream);
}
Console.WriteLine("Possible file contents saved as: " + outFile);
Console.WriteLine();
Console.WriteLine("Caution! It is rare for the file contents of deleted files to be intact - most");
Console.WriteLine("likely the contents recovered are corrupt as the space has been reused.");
}
else
{
foreach (var entry in mft.GetEntries(EntryStates.NotInUse))
{
// Skip entries with no attributes, they've probably never been used. We're certainly
// not going to manage to recover any useful data from them.
if (entry.Attributes.Count == 0)
continue;
// Skip directories - any useful files inside will be found separately
if ((entry.Flags & MasterFileTableEntryFlags.IsDirectory) != 0)
continue;
long size = GetSize(entry);
string path = GetPath(mft, entry);
if (!_showMeta.IsPresent && path.StartsWith(@"<root>\$Extend"))
continue;
if (!_showZeroSize.IsPresent && size == 0)
continue;
Console.WriteLine("Index: {0,-4} Size: {1,-8} Path: {2}", entry.Index, Utilities.ApproximateDiskSize(size), path);
}
}
}
}
