internal ulong USN; // USN Journel internal ATTR_STANDARD_INFORMATION(byte[] bytes, int length) { if (length == 120) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24)); AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32)); MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40)); ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48)); Permission = BitConverter.ToUInt32(bytes, 56); MaxVersionNo = BitConverter.ToUInt32(bytes, 60); VersionNo = BitConverter.ToUInt32(bytes, 64); ClassId = BitConverter.ToUInt32(bytes, 68); OwnerId = BitConverter.ToUInt32(bytes, 72); SecurityId = BitConverter.ToUInt32(bytes, 76); QuotaCharged = BitConverter.ToUInt64(bytes, 80); USN = BitConverter.ToUInt64(bytes, 88); } else { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24)); AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32)); MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40)); ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48)); Permission = BitConverter.ToUInt32(bytes, 56); MaxVersionNo = 0; VersionNo = 0; ClassId = 0; OwnerId = 0; SecurityId = 0; QuotaCharged = 0; USN = 0; } }
internal ATTR_EA_INFORMATION(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); PackedSize = BitConverter.ToUInt16(bytes, 24); EACount = BitConverter.ToUInt16(bytes, 26); UnpackedSize = BitConverter.ToUInt32(bytes, 28); }
internal ATTR_OBJECT_ID(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); ObjectId = bytes.Skip(24).Take(16).ToArray(); BirthVolumeId = null; BirthObjectId = null; BirthDomainId = null; }
internal short Flags; // Flags internal ATTR_VOLUME_INFORMATION(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); Reserved1 = bytes.Skip(24).Take(8).ToArray(); MajorVersion = bytes[32]; MinorVersion = bytes[33]; Flags = BitConverter.ToInt16(bytes, 34); }
internal ATTR_INDEX_ROOT(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); AttributeType = BitConverter.ToUInt32(bytes, 32); CollationSortingRule = BitConverter.ToUInt32(bytes, 36); IndexSizeinBytes = BitConverter.ToUInt32(bytes, 40); IndexSizeinClusters = bytes[44]; Padding = bytes.Skip(45).Take(3).ToArray(); NodeHeader = new NODE_HEADER(bytes.Skip(48).Take(16).ToArray()); }
internal byte[] Name; // Filename internal ATTR_FILE_NAME(byte[] bytes) { if (bytes.Length < 90) { header = new AttrHeader.ATTR_HEADER_RESIDENT(new byte[24]); ParentRef = BitConverter.ToUInt64(bytes, 0); CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 8)); AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 16)); MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 24)); ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32)); AllocSize = BitConverter.ToUInt64(bytes, 40); RealSize = BitConverter.ToUInt64(bytes, 48); Flags = BitConverter.ToUInt32(bytes, 56); ER = BitConverter.ToUInt32(bytes, 60); NameLength = bytes[64]; NameSpace = bytes[65]; Name = bytes.Skip(66).Take(NameLength * 2).ToArray(); } else { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); ParentRef = BitConverter.ToUInt64(bytes, 24); CreateTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 32)); AlterTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 40)); MFTTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 48)); ReadTime = DateTime.FromFileTime(BitConverter.ToInt64(bytes, 56)); AllocSize = BitConverter.ToUInt64(bytes, 64); RealSize = BitConverter.ToUInt64(bytes, 72); Flags = BitConverter.ToUInt32(bytes, 80); ER = BitConverter.ToUInt32(bytes, 84); NameLength = bytes[88]; NameSpace = bytes[89]; Name = bytes.Skip(90).Take(NameLength * 2).ToArray(); } }
internal ATTR_DATA(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); RawBytes = bytes.Skip(24).ToArray(); }
internal ATTR_VOLNAME(byte[] bytes) { header = new AttrHeader.ATTR_HEADER_RESIDENT(bytes.Take(24).ToArray()); VolumeNameString = Encoding.Unicode.GetString(bytes.Skip(24).ToArray()); }