internal static byte[] GetBytes(FileStream streamToRead, Superblock superblock, uint offset) { // Derive Length of Inode Table from superblock values uint length = superblock.InodesPerGroup * Inode.EXT4_INODE_SIZE; // Get Inode Table bytes return(NativeMethods.readDrive(streamToRead, offset, length)); }
public byte[] GetBytes(string volume) { IntPtr hDevice = NativeMethods.getHandle(volume); using (FileStream streamToRead = NativeMethods.getFileStream(hDevice)) { Superblock sb = new Superblock(Superblock.GetBytes(streamToRead, 0)); return(Win32.NativeMethods.readDrive(streamToRead, (sb.BlockSize * this.StartBlock), (sb.BlockSize * this.BlockCount))); } }
public byte[] GetBytes(string volume) { IntPtr hDevice = NativeMethods.getHandle(volume); using (FileStream streamToRead = NativeMethods.getFileStream(hDevice)) { Superblock sb = new Superblock(Superblock.GetBytes(streamToRead, 0)); return Win32.NativeMethods.readDrive(streamToRead, (sb.BlockSize * this.StartBlock), (sb.BlockSize * this.BlockCount)); } }
internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock) { // Derive the location and length of the Block Group Descriptor Table uint offset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize); uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1; uint length = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH; // Ensure the bgdtLength value is a multiple of 512 (minimum value for reading bytes from disk) if ((length % NativeMethods.BYTES_PER_SECTOR) != 0) { length += (NativeMethods.BYTES_PER_SECTOR - (length % NativeMethods.BYTES_PER_SECTOR)); } // Get BlockGroupDescriptor bytes return NativeMethods.readDrive(streamToRead, offset, length); }
internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock, uint group) { // Derive the location and length of the Block Group Descriptor Table uint bgdtOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize); uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1; uint bgdtLength = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH; // Determine the offset from the beginning of the BGDT to the desired group uint groupOffset = group * BLOCK_GROUP_DESCRIPTOR_LENGTH; // Determine what Sector contains the raw bytes uint groupSectorOffset = groupOffset / NativeMethods.BYTES_PER_SECTOR; // Read the sector that the desired block resides within byte[] SectorBytes = NativeMethods.readDrive(streamToRead, bgdtOffset + (groupSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR); // Get Block Group Descriptor offset into Sector uint sectorOffset = (group % BLOCK_GROUPS_PER_SECTOR) * BLOCK_GROUP_DESCRIPTOR_LENGTH; // Create byte[] containing only bytes for the requested Block Group Descriptor return NativeMethods.GetSubArray(SectorBytes, sectorOffset, BLOCK_GROUP_DESCRIPTOR_LENGTH); }
internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock) { // Derive the location and length of the Block Group Descriptor Table uint offset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize); uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1; uint length = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH; // Ensure the bgdtLength value is a multiple of 512 (minimum value for reading bytes from disk) if ((length % NativeMethods.BYTES_PER_SECTOR) != 0) { length += (NativeMethods.BYTES_PER_SECTOR - (length % NativeMethods.BYTES_PER_SECTOR)); } // Get BlockGroupDescriptor bytes return(NativeMethods.readDrive(streamToRead, offset, length)); }
internal static byte[] GetBytes(FileStream streamToRead, uint superblockOffset, Superblock superBlock, uint group) { // Derive the location and length of the Block Group Descriptor Table uint bgdtOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize); uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1; uint bgdtLength = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH; // Determine the offset from the beginning of the BGDT to the desired group uint groupOffset = group * BLOCK_GROUP_DESCRIPTOR_LENGTH; // Determine what Sector contains the raw bytes uint groupSectorOffset = groupOffset / NativeMethods.BYTES_PER_SECTOR; // Read the sector that the desired block resides within byte[] SectorBytes = NativeMethods.readDrive(streamToRead, bgdtOffset + (groupSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR); // Get Block Group Descriptor offset into Sector uint sectorOffset = (group % BLOCK_GROUPS_PER_SECTOR) * BLOCK_GROUP_DESCRIPTOR_LENGTH; // Create byte[] containing only bytes for the requested Block Group Descriptor return(NativeMethods.GetSubArray(SectorBytes, sectorOffset, BLOCK_GROUP_DESCRIPTOR_LENGTH)); }
protected override void ProcessRecord() { #region MBR MasterBootRecord mbr = MasterBootRecord.Get(devicePath); uint superblockOffset = 0; foreach (PartitionEntry partition in mbr.PartitionTable) { if (partition.Bootable && partition.SystemID == "LINUX") { superblockOffset = partition.StartSector; } } #endregion MBR // Obtain a handle to the device named "devicePath" IntPtr hDevice = NativeMethods.getHandle(devicePath); using (FileStream streamToRead = NativeMethods.getFileStream(hDevice)) { // Get Superblock to understand File System Layout Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset)); if (this.MyInvocation.BoundParameters.ContainsKey("Inode")) { if (inode == 0) { throw new Exception("0 is not a valid Inode value."); } else { uint block_group = (inode - 1) / superBlock.InodesPerGroup; BlockGroupDescriptor bgd = new BlockGroupDescriptor(BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock)); uint inodeTableOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + (bgd.InodeTableOffset * superBlock.BlockSize); uint inodeSectorOffset = (inode - 1) / (NativeMethods.BYTES_PER_SECTOR / (uint)superBlock.InodeSize); byte[] SectorBytes = NativeMethods.readDrive(streamToRead, inodeTableOffset + (inodeSectorOffset * NativeMethods.BYTES_PER_SECTOR), NativeMethods.BYTES_PER_SECTOR); uint sectorOffset = ((inode - 1) % (NativeMethods.BYTES_PER_SECTOR / (uint)superBlock.InodeSize)) * (uint)superBlock.InodeSize; byte[] inodeBytes = NativeMethods.GetSubArray(SectorBytes, sectorOffset, (uint)superBlock.InodeSize); if (asbytes) { WriteObject(inodeBytes); } else { WriteObject(new Inode(inodeBytes, inode)); } } } else { // Create a byte array representing the BGDT byte[] bgdtBytes = BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock); // Iterate through BGDTs and output associate Inodes for (uint o = 0; o < bgdtBytes.Length; o += BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH) { BlockGroupDescriptor bgd = new BlockGroupDescriptor(NativeMethods.GetSubArray(bgdtBytes, o, BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH)); uint inodeTableOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + (bgd.InodeTableOffset * superBlock.BlockSize); byte[] inodeTableBytes = InodeTable.GetBytes(streamToRead, superBlock, inodeTableOffset); for (uint i = 0; i < inodeTableBytes.Length; i += (uint)superBlock.InodeSize) { uint inode = ((o / BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH) + 1) * ((i / (uint)superBlock.InodeSize) + 1); WriteObject(new Inode(NativeMethods.GetSubArray(inodeTableBytes, i, superBlock.InodeSize), inode)); } } } } }
protected override void ProcessRecord() { #region MBR MasterBootRecord mbr = MasterBootRecord.Get(devicePath); uint superblockOffset = 0; foreach (PartitionEntry partition in mbr.PartitionTable) { if (partition.Bootable && partition.SystemID == "LINUX") { superblockOffset = partition.StartSector; } } #endregion MBR // Obtain a handle to the device named "devicePath" IntPtr hDevice = NativeMethods.getHandle(devicePath); using (FileStream streamToRead = NativeMethods.getFileStream(hDevice)) { // Get Superblock to understand File System Layout Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset)); // Derive the location and length of the Block Group Descriptor Table uint bgdtOffset = (superblockOffset * NativeMethods.BYTES_PER_SECTOR) + ((superBlock.FirstDataBlock + 1) * superBlock.BlockSize); uint bgdtEntries = (superBlock.TotalBlockCount / superBlock.BlocksPerGroup) + 1; uint bgdtLength = bgdtEntries * BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH; } }
protected override void ProcessRecord() { #region MBR MasterBootRecord mbr = MasterBootRecord.Get(devicePath); uint superblockOffset = 0; foreach (PartitionEntry partition in mbr.PartitionTable) { if (partition.Bootable && partition.SystemID == "LINUX") { superblockOffset = partition.StartSector; } } #endregion MBR // Obtain a handle to the device named "devicePath" IntPtr hDevice = NativeMethods.getHandle(devicePath); using (FileStream streamToRead = NativeMethods.getFileStream(hDevice)) { // Get Superblock to understand File System Layout Superblock superBlock = new Superblock(Superblock.GetBytes(streamToRead, superblockOffset)); if(this.MyInvocation.BoundParameters.ContainsKey("GroupNumber")) { if (asbytes) { WriteObject(BlockGroupDescriptor.GetBytes(streamToRead, superblockOffset, superBlock, number)); } else { WriteObject(new BlockGroupDescriptor(BlockGroupDescriptor.GetBytes(streamToRead, superblockOffset, superBlock, number))); } } else { if (asbytes) { BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock); } else { byte[] bgdtBytes = BlockGroupDescriptorTable.GetBytes(streamToRead, superblockOffset, superBlock); for (uint o = 0; o < bgdtBytes.Length; o += BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH) { WriteObject(new BlockGroupDescriptor(NativeMethods.GetSubArray(bgdtBytes, o, BlockGroupDescriptor.BLOCK_GROUP_DESCRIPTOR_LENGTH))); } } } } }