FileNameRecord.cs 3.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263
  1. /* Copyright (C) 2014 Tal Aloni <tal.aloni.il@gmail.com>. All rights reserved.
  2. *
  3. * You can redistribute this program and/or modify it under the terms of
  4. * the GNU Lesser Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. */
  7. using System;
  8. using System.Collections.Generic;
  9. using System.Text;
  10. using Utilities;
  11. namespace DiskAccessLibrary.FileSystems.NTFS
  12. {
  13. // FileName attribute is always resident
  14. // This is the record itself (the data that is contained in the attribute / index key)
  15. public class FileNameRecord
  16. {
  17. public const int FixedLength = 0x42;
  18. public MftSegmentReference ParentDirectory;
  19. public DateTime CreationTime;
  20. public DateTime ModificationTime;
  21. public DateTime MftModificationTime;
  22. public DateTime LastAccessTime;
  23. public ulong AllocatedSize; // of the file
  24. public ulong RealSize; // of the file
  25. // byte FileNameLength
  26. public FilenameNamespace Namespace; // Type of filename (e.g. 8.3, long filename etc.)
  27. public string FileName;
  28. public FileNameRecord(byte[] buffer, int offset)
  29. {
  30. ParentDirectory = new MftSegmentReference(buffer, offset + 0x00);
  31. CreationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x08);
  32. ModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x10);
  33. MftModificationTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x18);
  34. LastAccessTime = StandardInformationRecord.ReadDateTime(buffer, offset + 0x20);
  35. AllocatedSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x28);
  36. RealSize = LittleEndianConverter.ToUInt64(buffer, offset + 0x30);
  37. byte fnLen = ByteReader.ReadByte(buffer, offset + 0x40);
  38. Namespace = (FilenameNamespace)ByteReader.ReadByte(buffer, offset + 0x41);
  39. FileName = Encoding.Unicode.GetString(buffer, offset + 0x42, fnLen * 2);
  40. }
  41. public byte[] GetBytes()
  42. {
  43. byte[] buffer = new byte[FixedLength + FileName.Length * 2];
  44. ParentDirectory.WriteBytes(buffer, 0x00);
  45. StandardInformationRecord.WriteDateTime(buffer, 0x08, CreationTime);
  46. StandardInformationRecord.WriteDateTime(buffer, 0x10, ModificationTime);
  47. StandardInformationRecord.WriteDateTime(buffer, 0x18, MftModificationTime);
  48. StandardInformationRecord.WriteDateTime(buffer, 0x20, LastAccessTime);
  49. LittleEndianWriter.WriteUInt64(buffer, 0x28, AllocatedSize);
  50. LittleEndianWriter.WriteUInt64(buffer, 0x30, RealSize);
  51. ByteWriter.WriteByte(buffer, 0x40, (byte)FileName.Length);
  52. ByteWriter.WriteByte(buffer, 0x41, (byte)Namespace);
  53. ByteWriter.WriteBytes(buffer, 0x42, Encoding.Unicode.GetBytes(FileName));
  54. return buffer;
  55. }
  56. }
  57. }