/// <summary> /// /// </summary> /// <param name="volume"></param> /// <returns></returns> public static Prefetch[] GetInstances(string volume) { // Get current volume Helper.getVolumeName(ref volume); using (FileStream streamToRead = Helper.getFileStream(volume)) { NtfsVolumeBootRecord VBR = VolumeBootRecord.Get(streamToRead) as NtfsVolumeBootRecord; // Get a byte array representing the Master File Table byte[] MFT = MasterFileTable.GetBytes(streamToRead, volume); // Build Prefetch directory path string pfPath = Helper.GetVolumeLetter(volume) + @"\Windows\Prefetch"; /*if(CheckStatus(Helper.GetVolumeLetter(volume) + @"\Windows\system32\config\SAM") != PREFETCH_ENABLED.DISABLED) * {*/ // Get IndexEntry IndexEntry[] pfEntries = IndexEntry.GetInstances(pfPath); Prefetch[] pfArray = new Prefetch[pfEntries.Length]; int i = 0; foreach (IndexEntry entry in pfEntries) { if (entry.Filename.Contains(".pf")) { pfArray[i] = new Prefetch(FileRecord.Get(volume, (int)entry.RecordNumber, true).GetContent(VBR)); i++; } } return(pfArray); /*} * else * { * throw new Exception("Prefetching is disabled. Check registry to ensure Prefetching is enabled."); * }*/ } }
/// <summary> /// /// </summary> /// <param name="volume"></param> /// <param name="fast"></param> /// <returns></returns> public static Prefetch[] GetInstances(string volume, bool fast) { // Get current volume Helper.getVolumeName(ref volume); // Get volume letter string volLetter = Helper.GetVolumeLetter(volume); // Build Prefetch directory path string prefetchPath = volLetter + @"\Windows\Prefetch"; // Check prefetchPath exists if (Directory.Exists(prefetchPath)) { // Get list of file in the Prefetch directory that end in the .pf extension var pfFiles = System.IO.Directory.GetFiles(prefetchPath, "*.pf"); // Instantiate an array of Prefetch objects Prefetch[] pfArray = new Prefetch[pfFiles.Length]; // Iterate through Prefetch Files for (int i = 0; i < pfFiles.Length; i++) { // Get bytes for specific Prefetch file byte[] fileBytes = null; try { fileBytes = File.ReadAllBytes(pfFiles[i]); } catch (ArgumentException) { throw new ArgumentException("ArgumentException thrown by Prefetch.GetInstance()"); } catch (PathTooLongException) { throw new PathTooLongException("PathTooLongException thrown by Prefetch.GetInstance()"); } catch (DirectoryNotFoundException) { throw new DirectoryNotFoundException("DirectoryNotFoundException thrown by Prefetch.GetInstance()"); } catch (IOException) { throw new IOException("IOException thrown by Prefetch.GetInstance()"); } catch (UnauthorizedAccessException) { throw new UnauthorizedAccessException("UnauthorizedAccessException thrown by Prefetch.GetInstance()"); } // Output the Prefetch object for the corresponding file pfArray[i] = (new Prefetch(fileBytes)); } // Return array or Prefetch objects return(pfArray); } else { return(null); } }