/// <summary> /// /// </summary> /// <param name="bytes"></param> /// <param name="volume"></param> /// <returns></returns> internal static DataRun[] GetInstances(byte[] bytes, string volume) { List <DataRun> datarunList = new List <DataRun>(); int i = 0; DataRun dr = new DataRun(); while (i < bytes.Length - 1) { int DataRunLengthByteCount = bytes[i] & 0x0F; int DataRunOffsetByteCount = ((bytes[i] & 0xF0) >> 4); if (DataRunLengthByteCount == 0) { break; } else if ((i + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } dr = Get(bytes, i, DataRunLengthByteCount, DataRunOffsetByteCount, dr, volume); datarunList.Add(dr); i += (1 + DataRunLengthByteCount + DataRunOffsetByteCount); } return(datarunList.ToArray()); }
/// <summary> /// /// </summary> /// <param name="volume"></param> /// <returns></returns> public byte[] GetSlack() { Helper.getVolumeName(ref this.Volume); using (FileStream streamToRead = Helper.getFileStream(this.Volume)) { if (this.DataRun.Length != 0) { VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead); ulong slackSize = this.AllocatedSize - this.RealSize; if ((slackSize > 0) && (slackSize <= (ulong)VBR.BytesPerCluster)) { DataRun dr = this.DataRun[this.DataRun.Length - 1]; long lastCluster = dr.StartCluster + dr.ClusterLength - 1; byte[] dataRunBytes = Helper.readDrive(streamToRead, VBR.BytesPerCluster * lastCluster, VBR.BytesPerCluster); byte[] slackBytes = new byte[slackSize]; Array.Copy(dataRunBytes, VBR.BytesPerCluster - ((int)this.AllocatedSize - (int)this.RealSize), slackBytes, 0x00, slackBytes.Length); return(slackBytes); } else { return(null); } } else { return(null); } } }
public static DataRun[] GetInstances(byte[] bytes, int offset) { List<DataRun> datarunList = new List<DataRun>(); int i = offset; DataRun dr = new DataRun(); while (i < bytes.Length - 1) { int DataRunLengthByteCount = bytes[i] & 0x0F; int DataRunOffsetByteCount = ((bytes[i] & 0xF0) >> 4); if (DataRunLengthByteCount == 0) { break; } else if ((i + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } dr = Get(bytes, i, DataRunLengthByteCount, DataRunOffsetByteCount, dr); datarunList.Add(dr); i += (1 + DataRunLengthByteCount + DataRunOffsetByteCount); } return datarunList.ToArray(); }
public byte[] GetSlack(string volume) { NativeMethods.getVolumeName(ref volume); IntPtr hVolume = NativeMethods.getHandle(volume); using (FileStream streamToRead = NativeMethods.getFileStream(hVolume)) { if (this.DataRun != null) { VolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead); ulong slackSize = this.AllocatedSize - this.RealSize; if (slackSize <= VBR.BytesPerCluster) { DataRun dr = this.DataRun[this.DataRun.Length - 1]; ulong lastCluster = (ulong)dr.StartCluster + (ulong)dr.ClusterLength - 1; byte[] dataRunBytes = NativeMethods.readDrive(streamToRead, VBR.BytesPerCluster * lastCluster, VBR.BytesPerCluster); byte[] slackBytes = new byte[slackSize]; Array.Copy(dataRunBytes, (long)VBR.BytesPerCluster - ((long)this.AllocatedSize - (long)this.RealSize), slackBytes, 0x00, slackBytes.Length); return(slackBytes); } else { return(null); } } else { return(null); } } }
internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List <DataRun> dataRunList = new List <DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunOffsetByteCount <= 3) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
private DataRun(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR) { if (offsetByteCount == 0) { Sparse = true; } byte[] DataRunLengthBytes = new byte[8]; Array.Copy(bytes, offset + 1, DataRunLengthBytes, 0, lengthByteCount); ClusterLength = BitConverter.ToInt64(DataRunLengthBytes, 0); byte[] offsetBytes = new byte[0x08]; int arrayOffset = 0x08 - offsetByteCount; Array.Copy(bytes, offset + 0x01 + lengthByteCount, offsetBytes, arrayOffset, offsetByteCount); long relativeOffset = BitConverter.ToInt64(offsetBytes, 0x00) >> arrayOffset * 0x08; StartCluster = previousDR.StartCluster + relativeOffset; }
private DataRun(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR, string volume) { Volume = volume; if (offsetByteCount == 0) { Sparse = true; } if (!((lengthByteCount > 8) || (offsetByteCount > 8))) { byte[] DataRunLengthBytes = new byte[0x08]; Array.Copy(bytes, offset + 1, DataRunLengthBytes, 0x00, lengthByteCount); ClusterLength = BitConverter.ToInt64(DataRunLengthBytes, 0x00); byte[] offsetBytes = new byte[0x08]; int arrayOffset = 0x08 - offsetByteCount; Array.Copy(bytes, offset + 0x01 + lengthByteCount, offsetBytes, arrayOffset, offsetByteCount); long relativeOffset = BitConverter.ToInt64(offsetBytes, 0x00) >> arrayOffset * 0x08; StartCluster = previousDR.StartCluster + relativeOffset; } }
/// <summary> /// /// </summary> /// <param name="bytes"></param> /// <param name="offset"></param> /// <param name="lengthByteCount"></param> /// <param name="offsetByteCount"></param> /// <param name="previousDR"></param> /// <param name="volume"></param> /// <returns></returns> private static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR, string volume) { return(new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR, volume)); }
internal ulong StartVCN; // Starting VCN #endregion Fields #region Constructors internal NonResident(NonResidentHeader header, byte[] bytes, string attrName) { // Attr Object Name = (ATTR_TYPE)header.commonHeader.ATTRType; NameString = attrName; NonResident = header.commonHeader.NonResident; AttributeId = header.commonHeader.Id; // NonResident Attribute commonHeader = header.commonHeader; StartVCN = header.StartVCN; LastVCN = header.LastVCN; DataRunOffset = header.DataRunOffset; CompUnitSize = header.CompUnitSize; AllocatedSize = header.AllocatedSize; RealSize = header.RealSize; InitializedSize = header.InitializedSize; int DataRunLengthByteCount = bytes[0] & 0x0F; int DataRunOffsetByteCount = ((bytes[0] & 0xF0) >> 4); if (DataRunLengthByteCount != 0) { // DataRun int offset = 0; long startCluster = 0; List<DataRun> dataRunList = new List<DataRun>(); do { if ((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) > bytes.Length) { break; } // Instantiate a DataRun object DataRun dataRun = new DataRun(NativeMethods.GetSubArray(bytes, (uint)(offset + 1), (uint)DataRunLengthByteCount + (uint)DataRunOffsetByteCount), DataRunLengthByteCount, DataRunOffsetByteCount, ref startCluster); // Add DataRun Object to dataRunList dataRunList.Add(dataRun); // Increment offset offset = offset + 1 + DataRunLengthByteCount + DataRunOffsetByteCount; if (offset <= (bytes.Length - 1)) { DataRunLengthByteCount = bytes[offset] & 0x0F; DataRunOffsetByteCount = ((bytes[offset] & 0xF0) >> 4); } else { break; } } while (((offset + DataRunLengthByteCount + DataRunOffsetByteCount + 1) < bytes.Length) && (DataRunLengthByteCount != 0)); DataRun = dataRunList.ToArray(); } }
public static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR) { return new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR); }
public static DataRun Get(byte[] bytes, int offset, int lengthByteCount, int offsetByteCount, DataRun previousDR) { return(new DataRun(bytes, offset, lengthByteCount, offsetByteCount, previousDR)); }