IndexNodeEntry.cs 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263
  1. /* Copyright (C) 2014 Tal Aloni <tal.aloni.il@gmail.com>. All rights reserved.
  2. *
  3. * You can redistribute this program and/or modify it under the terms of
  4. * the GNU Lesser Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. */
  7. using System;
  8. using System.Collections.Generic;
  9. using System.Text;
  10. using Utilities;
  11. namespace DiskAccessLibrary.FileSystems.NTFS
  12. {
  13. [Flags]
  14. public enum IndexEntryFlags : ushort
  15. {
  16. PointsToSubnode = 0x01,
  17. LastEntryInNode = 0x02,
  18. }
  19. public class IndexNodeEntry // intermediate node entry
  20. {
  21. public MftSegmentReference SegmentReference; // 0 for self reference
  22. //ushort RecordLength;
  23. //ushort KeyLength;
  24. public IndexEntryFlags Flags;
  25. // 2 zero bytes (padding)
  26. public byte[] Key;
  27. public long SubnodeVCN; // if PointsToSubnode flag is set, stored as ulong but can be represented using long
  28. public IndexNodeEntry(byte[] buffer, ref int offset)
  29. {
  30. SegmentReference = new MftSegmentReference(buffer, offset + 0x00);
  31. ushort recordLength = LittleEndianConverter.ToUInt16(buffer, offset + 0x08);
  32. ushort keyLength = LittleEndianConverter.ToUInt16(buffer, offset + 0x0A);
  33. Flags = (IndexEntryFlags)LittleEndianConverter.ToUInt16(buffer, offset + 0x0C);
  34. Key = ByteReader.ReadBytes(buffer, offset + 0x10, keyLength);
  35. if (PointsToSubnode)
  36. {
  37. // key is padded to align to 8 byte boundary
  38. int keyLengthWithPadding = (int)Math.Ceiling((double)keyLength / 8) * 8;
  39. SubnodeVCN = (long)LittleEndianConverter.ToUInt64(buffer, offset + 0x10 + keyLengthWithPadding);
  40. }
  41. offset += recordLength;
  42. }
  43. public bool IsLastEntry
  44. {
  45. get
  46. {
  47. return ((Flags & IndexEntryFlags.LastEntryInNode) > 0);
  48. }
  49. }
  50. public bool PointsToSubnode
  51. {
  52. get
  53. {
  54. return ((Flags & IndexEntryFlags.PointsToSubnode) > 0);
  55. }
  56. }
  57. }
  58. }