public List <TransactionEntry> ReadTransactionTable(NTFSRestartRecord restartRecord)
{
ulong transactionTableLsn = restartRecord.TransactionTableLsn;
if (transactionTableLsn != 0)
{
NTFSLogRecord record = ReadLogRecord(transactionTableLsn);
if (record.RedoOperation != NTFSLogOperation.TransactionTableDump)
{
string message = String.Format("Restart record TransactionTableLsn points to a record with RedoOperation {0}", record.RedoOperation);
throw new InvalidDataException(message);
}
if (restartRecord.TransactionTableLength != record.RedoData.Length)
{
throw new InvalidDataException("Transcation table length does not match restart record");
}
return(RestartTableHelper.ReadTable <TransactionEntry>(record.RedoData, restartRecord.MajorVersion));
}
else
{
return(null);
}
}
private byte[] GetOpenAttributeTableBytes(out byte[] attributeNameTableBytes)
{
List <OpenAttributeEntry> openAttributeTable = new List <OpenAttributeEntry>();
List <AttributeNameEntry> attributeNameTable = new List <AttributeNameEntry>();
for (int index = 0; index < m_openAttributes.Count; index++)
{
OpenAttribute openAttribute = m_openAttributes[index];
OpenAttributeEntry entry = new OpenAttributeEntry(m_majorVersion);
entry.AllocatedOrNextFree = RestartTableEntry.RestartEntryAllocated;
// Note: NTFS v5.1 driver calulates AttributeOffset using entry length of 0x28, the reason is unclear but we're immitating this.
entry.AttributeOffset = (uint)(RestartTableHeader.Length + index * OpenAttributeEntry.LengthV1);
entry.FileReference = openAttribute.FileReference;
entry.LsnOfOpenRecord = openAttribute.LsnOfOpenRecord;
entry.AttributeTypeCode = openAttribute.AttributeType;
openAttributeTable.Add(entry);
if (openAttribute.AttributeName != String.Empty)
{
int openAttributeOffset = OpenAttributeIndexToOffset(index);
AttributeNameEntry nameEntry = new AttributeNameEntry();
nameEntry.OpenAttributeOffset = (ushort)openAttributeOffset;
nameEntry.Name = openAttribute.AttributeName;
attributeNameTable.Add(nameEntry);
}
}
attributeNameTableBytes = null;
if (attributeNameTable.Count > 0)
{
attributeNameTableBytes = AttributeNameEntry.GetTableBytes(attributeNameTable);
}
return(RestartTableHelper.GetTableBytes <OpenAttributeEntry>(openAttributeTable));
}
