├── .gitattributes ├── .github └── workflows │ └── dotnet-core.yml ├── .gitignore ├── LICENSE ├── README.md └── src ├── NtfsReader.sln └── NtfsReader ├── License.txt ├── NtfsReader.csproj └── System └── IO └── Filesystem └── Ntfs ├── Algorithms.cs ├── Attributes.cs ├── IDiskInfo.cs ├── IFragment.cs ├── INode.cs ├── IStream.cs ├── NtfsReader.Algorithms.cs ├── NtfsReader.NativeMethods.cs ├── NtfsReader.Public.cs ├── NtfsReader.cs └── RetrieveMode.cs /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | -------------------------------------------------------------------------------- /.github/workflows/dotnet-core.yml: -------------------------------------------------------------------------------- 1 | name: .NET Core 2 | 3 | on: 4 | push: 5 | branches: [ master ] 6 | pull_request: 7 | branches: [ master ] 8 | 9 | jobs: 10 | build: 11 | 12 | runs-on: ubuntu-latest 13 | 14 | steps: 15 | - uses: actions/checkout@v2 16 | - name: Setup .NET Core 17 | uses: actions/setup-dotnet@v1 18 | with: 19 | dotnet-version: 3.1.301 20 | - name: Install dependencies 21 | working-directory: ./src 22 | run: dotnet restore 23 | - name: Build 24 | working-directory: ./src 25 | run: dotnet build --configuration Release --no-restore 26 | - name: Test 27 | working-directory: ./src 28 | run: dotnet test --no-restore --verbosity normal 29 | - name: Publish NuGet 30 | # You may pin to the exact commit or the version. 31 | # uses: brandedoutcast/publish-nuget@c12b8546b67672ee38ac87bea491ac94a587f7cc 32 | uses: brandedoutcast/publish-nuget@v2.5.5 33 | with: 34 | # Filepath of the project to be packaged, relative to root of repository 35 | PROJECT_FILE_PATH: src/NtfsReader/NtfsReader.csproj 36 | # NuGet package id, used for version detection & defaults to project name 37 | PACKAGE_NAME: Michaelkc.NtfsReader 38 | # API key to authenticate with NuGet server 39 | NUGET_KEY: ${{secrets.NUGET_API_KEY}} 40 | # Flag to toggle pushing symbols along with nuget package to the server, disabled by default 41 | INCLUDE_SYMBOLS: true 42 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.rsuser 8 | *.suo 9 | *.user 10 | *.userosscache 11 | *.sln.docstates 12 | 13 | # User-specific files (MonoDevelop/Xamarin Studio) 14 | *.userprefs 15 | 16 | # Build results 17 | [Dd]ebug/ 18 | [Dd]ebugPublic/ 19 | [Rr]elease/ 20 | [Rr]eleases/ 21 | x64/ 22 | x86/ 23 | bld/ 24 | [Bb]in/ 25 | [Oo]bj/ 26 | [Ll]og/ 27 | 28 | # Visual Studio 2015/2017 cache/options directory 29 | .vs/ 30 | # Uncomment if you have tasks that create the project's static files in wwwroot 31 | #wwwroot/ 32 | 33 | # Visual Studio 2017 auto generated files 34 | Generated\ Files/ 35 | 36 | # MSTest test Results 37 | [Tt]est[Rr]esult*/ 38 | [Bb]uild[Ll]og.* 39 | 40 | # NUNIT 41 | *.VisualState.xml 42 | TestResult.xml 43 | 44 | # Build Results of an ATL Project 45 | [Dd]ebugPS/ 46 | [Rr]eleasePS/ 47 | dlldata.c 48 | 49 | # Benchmark Results 50 | BenchmarkDotNet.Artifacts/ 51 | 52 | # .NET Core 53 | project.lock.json 54 | project.fragment.lock.json 55 | artifacts/ 56 | 57 | # StyleCop 58 | StyleCopReport.xml 59 | 60 | # Files built by Visual Studio 61 | *_i.c 62 | *_p.c 63 | *_h.h 64 | *.ilk 65 | *.meta 66 | *.obj 67 | *.iobj 68 | *.pch 69 | *.pdb 70 | *.ipdb 71 | *.pgc 72 | *.pgd 73 | *.rsp 74 | *.sbr 75 | *.tlb 76 | *.tli 77 | *.tlh 78 | *.tmp 79 | *.tmp_proj 80 | *_wpftmp.csproj 81 | *.log 82 | *.vspscc 83 | *.vssscc 84 | .builds 85 | *.pidb 86 | *.svclog 87 | *.scc 88 | 89 | # Chutzpah Test files 90 | _Chutzpah* 91 | 92 | # Visual C++ cache files 93 | ipch/ 94 | *.aps 95 | *.ncb 96 | *.opendb 97 | *.opensdf 98 | *.sdf 99 | *.cachefile 100 | *.VC.db 101 | *.VC.VC.opendb 102 | 103 | # Visual Studio profiler 104 | *.psess 105 | *.vsp 106 | *.vspx 107 | *.sap 108 | 109 | # Visual Studio Trace Files 110 | *.e2e 111 | 112 | # TFS 2012 Local Workspace 113 | $tf/ 114 | 115 | # Guidance Automation Toolkit 116 | *.gpState 117 | 118 | # ReSharper is a .NET coding add-in 119 | _ReSharper*/ 120 | *.[Rr]e[Ss]harper 121 | *.DotSettings.user 122 | 123 | # JustCode is a .NET coding add-in 124 | .JustCode 125 | 126 | # TeamCity is a build add-in 127 | _TeamCity* 128 | 129 | # DotCover is a Code Coverage Tool 130 | *.dotCover 131 | 132 | # AxoCover is a Code Coverage Tool 133 | .axoCover/* 134 | !.axoCover/settings.json 135 | 136 | # Visual Studio code coverage results 137 | *.coverage 138 | *.coveragexml 139 | 140 | # NCrunch 141 | _NCrunch_* 142 | .*crunch*.local.xml 143 | nCrunchTemp_* 144 | 145 | # MightyMoose 146 | *.mm.* 147 | AutoTest.Net/ 148 | 149 | # Web workbench (sass) 150 | .sass-cache/ 151 | 152 | # Installshield output folder 153 | [Ee]xpress/ 154 | 155 | # DocProject is a documentation generator add-in 156 | DocProject/buildhelp/ 157 | DocProject/Help/*.HxT 158 | DocProject/Help/*.HxC 159 | DocProject/Help/*.hhc 160 | DocProject/Help/*.hhk 161 | DocProject/Help/*.hhp 162 | DocProject/Help/Html2 163 | DocProject/Help/html 164 | 165 | # Click-Once directory 166 | publish/ 167 | 168 | # Publish Web Output 169 | *.[Pp]ublish.xml 170 | *.azurePubxml 171 | # Note: Comment the next line if you want to checkin your web deploy settings, 172 | # but database connection strings (with potential passwords) will be unencrypted 173 | *.pubxml 174 | *.publishproj 175 | 176 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 177 | # checkin your Azure Web App publish settings, but sensitive information contained 178 | # in these scripts will be unencrypted 179 | PublishScripts/ 180 | 181 | # NuGet Packages 182 | *.nupkg 183 | # The packages folder can be ignored because of Package Restore 184 | **/[Pp]ackages/* 185 | # except build/, which is used as an MSBuild target. 186 | !**/[Pp]ackages/build/ 187 | # Uncomment if necessary however generally it will be regenerated when needed 188 | #!**/[Pp]ackages/repositories.config 189 | # NuGet v3's project.json files produces more ignorable files 190 | *.nuget.props 191 | *.nuget.targets 192 | 193 | # Microsoft Azure Build Output 194 | csx/ 195 | *.build.csdef 196 | 197 | # Microsoft Azure Emulator 198 | ecf/ 199 | rcf/ 200 | 201 | # Windows Store app package directories and files 202 | AppPackages/ 203 | BundleArtifacts/ 204 | Package.StoreAssociation.xml 205 | _pkginfo.txt 206 | *.appx 207 | 208 | # Visual Studio cache files 209 | # files ending in .cache can be ignored 210 | *.[Cc]ache 211 | # but keep track of directories ending in .cache 212 | !*.[Cc]ache/ 213 | 214 | # Others 215 | ClientBin/ 216 | ~$* 217 | *~ 218 | *.dbmdl 219 | *.dbproj.schemaview 220 | *.jfm 221 | *.pfx 222 | *.publishsettings 223 | orleans.codegen.cs 224 | 225 | # Including strong name files can present a security risk 226 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 227 | #*.snk 228 | 229 | # Since there are multiple workflows, uncomment next line to ignore bower_components 230 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 231 | #bower_components/ 232 | 233 | # RIA/Silverlight projects 234 | Generated_Code/ 235 | 236 | # Backup & report files from converting an old project file 237 | # to a newer Visual Studio version. Backup files are not needed, 238 | # because we have git ;-) 239 | _UpgradeReport_Files/ 240 | Backup*/ 241 | UpgradeLog*.XML 242 | UpgradeLog*.htm 243 | ServiceFabricBackup/ 244 | *.rptproj.bak 245 | 246 | # SQL Server files 247 | *.mdf 248 | *.ldf 249 | *.ndf 250 | 251 | # Business Intelligence projects 252 | *.rdl.data 253 | *.bim.layout 254 | *.bim_*.settings 255 | *.rptproj.rsuser 256 | 257 | # Microsoft Fakes 258 | FakesAssemblies/ 259 | 260 | # GhostDoc plugin setting file 261 | *.GhostDoc.xml 262 | 263 | # Node.js Tools for Visual Studio 264 | .ntvs_analysis.dat 265 | node_modules/ 266 | 267 | # Visual Studio 6 build log 268 | *.plg 269 | 270 | # Visual Studio 6 workspace options file 271 | *.opt 272 | 273 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 274 | *.vbw 275 | 276 | # Visual Studio LightSwitch build output 277 | **/*.HTMLClient/GeneratedArtifacts 278 | **/*.DesktopClient/GeneratedArtifacts 279 | **/*.DesktopClient/ModelManifest.xml 280 | **/*.Server/GeneratedArtifacts 281 | **/*.Server/ModelManifest.xml 282 | _Pvt_Extensions 283 | 284 | # Paket dependency manager 285 | .paket/paket.exe 286 | paket-files/ 287 | 288 | # FAKE - F# Make 289 | .fake/ 290 | 291 | # JetBrains Rider 292 | .idea/ 293 | *.sln.iml 294 | 295 | # CodeRush personal settings 296 | .cr/personal 297 | 298 | # Python Tools for Visual Studio (PTVS) 299 | __pycache__/ 300 | *.pyc 301 | 302 | # Cake - Uncomment if you are using it 303 | # tools/** 304 | # !tools/packages.config 305 | 306 | # Tabs Studio 307 | *.tss 308 | 309 | # Telerik's JustMock configuration file 310 | *.jmconfig 311 | 312 | # BizTalk build output 313 | *.btp.cs 314 | *.btm.cs 315 | *.odx.cs 316 | *.xsd.cs 317 | 318 | # OpenCover UI analysis results 319 | OpenCover/ 320 | 321 | # Azure Stream Analytics local run output 322 | ASALocalRun/ 323 | 324 | # MSBuild Binary and Structured Log 325 | *.binlog 326 | 327 | # NVidia Nsight GPU debugger configuration file 328 | *.nvuser 329 | 330 | # MFractors (Xamarin productivity tool) working folder 331 | .mfractor/ 332 | 333 | # Local History for Visual Studio 334 | .localhistory/ 335 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU LESSER GENERAL PUBLIC LICENSE 2 | Version 2.1, February 1999 3 | 4 | Copyright (C) 1991, 1999 Free Software Foundation, Inc. 5 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 6 | Everyone is permitted to copy and distribute verbatim copies 7 | of this license document, but changing it is not allowed. 8 | 9 | [This is the first released version of the Lesser GPL. It also counts 10 | as the successor of the GNU Library Public License, version 2, hence 11 | the version number 2.1.] 12 | 13 | Preamble 14 | 15 | The licenses for most software are designed to take away your 16 | freedom to share and change it. By contrast, the GNU General Public 17 | Licenses are intended to guarantee your freedom to share and change 18 | free software--to make sure the software is free for all its users. 19 | 20 | This license, the Lesser General Public License, applies to some 21 | specially designated software packages--typically libraries--of the 22 | Free Software Foundation and other authors who decide to use it. You 23 | can use it too, but we suggest you first think carefully about whether 24 | this license or the ordinary General Public License is the better 25 | strategy to use in any particular case, based on the explanations below. 26 | 27 | When we speak of free software, we are referring to freedom of use, 28 | not price. Our General Public Licenses are designed to make sure that 29 | you have the freedom to distribute copies of free software (and charge 30 | for this service if you wish); that you receive source code or can get 31 | it if you want it; that you can change the software and use pieces of 32 | it in new free programs; and that you are informed that you can do 33 | these things. 34 | 35 | To protect your rights, we need to make restrictions that forbid 36 | distributors to deny you these rights or to ask you to surrender these 37 | rights. These restrictions translate to certain responsibilities for 38 | you if you distribute copies of the library or if you modify it. 39 | 40 | For example, if you distribute copies of the library, whether gratis 41 | or for a fee, you must give the recipients all the rights that we gave 42 | you. You must make sure that they, too, receive or can get the source 43 | code. If you link other code with the library, you must provide 44 | complete object files to the recipients, so that they can relink them 45 | with the library after making changes to the library and recompiling 46 | it. And you must show them these terms so they know their rights. 47 | 48 | We protect your rights with a two-step method: (1) we copyright the 49 | library, and (2) we offer you this license, which gives you legal 50 | permission to copy, distribute and/or modify the library. 51 | 52 | To protect each distributor, we want to make it very clear that 53 | there is no warranty for the free library. Also, if the library is 54 | modified by someone else and passed on, the recipients should know 55 | that what they have is not the original version, so that the original 56 | author's reputation will not be affected by problems that might be 57 | introduced by others. 58 | 59 | Finally, software patents pose a constant threat to the existence of 60 | any free program. We wish to make sure that a company cannot 61 | effectively restrict the users of a free program by obtaining a 62 | restrictive license from a patent holder. Therefore, we insist that 63 | any patent license obtained for a version of the library must be 64 | consistent with the full freedom of use specified in this license. 65 | 66 | Most GNU software, including some libraries, is covered by the 67 | ordinary GNU General Public License. This license, the GNU Lesser 68 | General Public License, applies to certain designated libraries, and 69 | is quite different from the ordinary General Public License. We use 70 | this license for certain libraries in order to permit linking those 71 | libraries into non-free programs. 72 | 73 | When a program is linked with a library, whether statically or using 74 | a shared library, the combination of the two is legally speaking a 75 | combined work, a derivative of the original library. The ordinary 76 | General Public License therefore permits such linking only if the 77 | entire combination fits its criteria of freedom. The Lesser General 78 | Public License permits more lax criteria for linking other code with 79 | the library. 80 | 81 | We call this license the "Lesser" General Public License because it 82 | does Less to protect the user's freedom than the ordinary General 83 | Public License. It also provides other free software developers Less 84 | of an advantage over competing non-free programs. These disadvantages 85 | are the reason we use the ordinary General Public License for many 86 | libraries. However, the Lesser license provides advantages in certain 87 | special circumstances. 88 | 89 | For example, on rare occasions, there may be a special need to 90 | encourage the widest possible use of a certain library, so that it becomes 91 | a de-facto standard. To achieve this, non-free programs must be 92 | allowed to use the library. A more frequent case is that a free 93 | library does the same job as widely used non-free libraries. In this 94 | case, there is little to gain by limiting the free library to free 95 | software only, so we use the Lesser General Public License. 96 | 97 | In other cases, permission to use a particular library in non-free 98 | programs enables a greater number of people to use a large body of 99 | free software. For example, permission to use the GNU C Library in 100 | non-free programs enables many more people to use the whole GNU 101 | operating system, as well as its variant, the GNU/Linux operating 102 | system. 103 | 104 | Although the Lesser General Public License is Less protective of the 105 | users' freedom, it does ensure that the user of a program that is 106 | linked with the Library has the freedom and the wherewithal to run 107 | that program using a modified version of the Library. 108 | 109 | The precise terms and conditions for copying, distribution and 110 | modification follow. Pay close attention to the difference between a 111 | "work based on the library" and a "work that uses the library". The 112 | former contains code derived from the library, whereas the latter must 113 | be combined with the library in order to run. 114 | 115 | GNU LESSER GENERAL PUBLIC LICENSE 116 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 117 | 118 | 0. This License Agreement applies to any software library or other 119 | program which contains a notice placed by the copyright holder or 120 | other authorized party saying it may be distributed under the terms of 121 | this Lesser General Public License (also called "this License"). 122 | Each licensee is addressed as "you". 123 | 124 | A "library" means a collection of software functions and/or data 125 | prepared so as to be conveniently linked with application programs 126 | (which use some of those functions and data) to form executables. 127 | 128 | The "Library", below, refers to any such software library or work 129 | which has been distributed under these terms. A "work based on the 130 | Library" means either the Library or any derivative work under 131 | copyright law: that is to say, a work containing the Library or a 132 | portion of it, either verbatim or with modifications and/or translated 133 | straightforwardly into another language. (Hereinafter, translation is 134 | included without limitation in the term "modification".) 135 | 136 | "Source code" for a work means the preferred form of the work for 137 | making modifications to it. For a library, complete source code means 138 | all the source code for all modules it contains, plus any associated 139 | interface definition files, plus the scripts used to control compilation 140 | and installation of the library. 141 | 142 | Activities other than copying, distribution and modification are not 143 | covered by this License; they are outside its scope. The act of 144 | running a program using the Library is not restricted, and output from 145 | such a program is covered only if its contents constitute a work based 146 | on the Library (independent of the use of the Library in a tool for 147 | writing it). Whether that is true depends on what the Library does 148 | and what the program that uses the Library does. 149 | 150 | 1. You may copy and distribute verbatim copies of the Library's 151 | complete source code as you receive it, in any medium, provided that 152 | you conspicuously and appropriately publish on each copy an 153 | appropriate copyright notice and disclaimer of warranty; keep intact 154 | all the notices that refer to this License and to the absence of any 155 | warranty; and distribute a copy of this License along with the 156 | Library. 157 | 158 | You may charge a fee for the physical act of transferring a copy, 159 | and you may at your option offer warranty protection in exchange for a 160 | fee. 161 | 162 | 2. You may modify your copy or copies of the Library or any portion 163 | of it, thus forming a work based on the Library, and copy and 164 | distribute such modifications or work under the terms of Section 1 165 | above, provided that you also meet all of these conditions: 166 | 167 | a) The modified work must itself be a software library. 168 | 169 | b) You must cause the files modified to carry prominent notices 170 | stating that you changed the files and the date of any change. 171 | 172 | c) You must cause the whole of the work to be licensed at no 173 | charge to all third parties under the terms of this License. 174 | 175 | d) If a facility in the modified Library refers to a function or a 176 | table of data to be supplied by an application program that uses 177 | the facility, other than as an argument passed when the facility 178 | is invoked, then you must make a good faith effort to ensure that, 179 | in the event an application does not supply such function or 180 | table, the facility still operates, and performs whatever part of 181 | its purpose remains meaningful. 182 | 183 | (For example, a function in a library to compute square roots has 184 | a purpose that is entirely well-defined independent of the 185 | application. Therefore, Subsection 2d requires that any 186 | application-supplied function or table used by this function must 187 | be optional: if the application does not supply it, the square 188 | root function must still compute square roots.) 189 | 190 | These requirements apply to the modified work as a whole. If 191 | identifiable sections of that work are not derived from the Library, 192 | and can be reasonably considered independent and separate works in 193 | themselves, then this License, and its terms, do not apply to those 194 | sections when you distribute them as separate works. But when you 195 | distribute the same sections as part of a whole which is a work based 196 | on the Library, the distribution of the whole must be on the terms of 197 | this License, whose permissions for other licensees extend to the 198 | entire whole, and thus to each and every part regardless of who wrote 199 | it. 200 | 201 | Thus, it is not the intent of this section to claim rights or contest 202 | your rights to work written entirely by you; rather, the intent is to 203 | exercise the right to control the distribution of derivative or 204 | collective works based on the Library. 205 | 206 | In addition, mere aggregation of another work not based on the Library 207 | with the Library (or with a work based on the Library) on a volume of 208 | a storage or distribution medium does not bring the other work under 209 | the scope of this License. 210 | 211 | 3. You may opt to apply the terms of the ordinary GNU General Public 212 | License instead of this License to a given copy of the Library. To do 213 | this, you must alter all the notices that refer to this License, so 214 | that they refer to the ordinary GNU General Public License, version 2, 215 | instead of to this License. (If a newer version than version 2 of the 216 | ordinary GNU General Public License has appeared, then you can specify 217 | that version instead if you wish.) Do not make any other change in 218 | these notices. 219 | 220 | Once this change is made in a given copy, it is irreversible for 221 | that copy, so the ordinary GNU General Public License applies to all 222 | subsequent copies and derivative works made from that copy. 223 | 224 | This option is useful when you wish to copy part of the code of 225 | the Library into a program that is not a library. 226 | 227 | 4. You may copy and distribute the Library (or a portion or 228 | derivative of it, under Section 2) in object code or executable form 229 | under the terms of Sections 1 and 2 above provided that you accompany 230 | it with the complete corresponding machine-readable source code, which 231 | must be distributed under the terms of Sections 1 and 2 above on a 232 | medium customarily used for software interchange. 233 | 234 | If distribution of object code is made by offering access to copy 235 | from a designated place, then offering equivalent access to copy the 236 | source code from the same place satisfies the requirement to 237 | distribute the source code, even though third parties are not 238 | compelled to copy the source along with the object code. 239 | 240 | 5. A program that contains no derivative of any portion of the 241 | Library, but is designed to work with the Library by being compiled or 242 | linked with it, is called a "work that uses the Library". Such a 243 | work, in isolation, is not a derivative work of the Library, and 244 | therefore falls outside the scope of this License. 245 | 246 | However, linking a "work that uses the Library" with the Library 247 | creates an executable that is a derivative of the Library (because it 248 | contains portions of the Library), rather than a "work that uses the 249 | library". The executable is therefore covered by this License. 250 | Section 6 states terms for distribution of such executables. 251 | 252 | When a "work that uses the Library" uses material from a header file 253 | that is part of the Library, the object code for the work may be a 254 | derivative work of the Library even though the source code is not. 255 | Whether this is true is especially significant if the work can be 256 | linked without the Library, or if the work is itself a library. The 257 | threshold for this to be true is not precisely defined by law. 258 | 259 | If such an object file uses only numerical parameters, data 260 | structure layouts and accessors, and small macros and small inline 261 | functions (ten lines or less in length), then the use of the object 262 | file is unrestricted, regardless of whether it is legally a derivative 263 | work. (Executables containing this object code plus portions of the 264 | Library will still fall under Section 6.) 265 | 266 | Otherwise, if the work is a derivative of the Library, you may 267 | distribute the object code for the work under the terms of Section 6. 268 | Any executables containing that work also fall under Section 6, 269 | whether or not they are linked directly with the Library itself. 270 | 271 | 6. As an exception to the Sections above, you may also combine or 272 | link a "work that uses the Library" with the Library to produce a 273 | work containing portions of the Library, and distribute that work 274 | under terms of your choice, provided that the terms permit 275 | modification of the work for the customer's own use and reverse 276 | engineering for debugging such modifications. 277 | 278 | You must give prominent notice with each copy of the work that the 279 | Library is used in it and that the Library and its use are covered by 280 | this License. You must supply a copy of this License. If the work 281 | during execution displays copyright notices, you must include the 282 | copyright notice for the Library among them, as well as a reference 283 | directing the user to the copy of this License. Also, you must do one 284 | of these things: 285 | 286 | a) Accompany the work with the complete corresponding 287 | machine-readable source code for the Library including whatever 288 | changes were used in the work (which must be distributed under 289 | Sections 1 and 2 above); and, if the work is an executable linked 290 | with the Library, with the complete machine-readable "work that 291 | uses the Library", as object code and/or source code, so that the 292 | user can modify the Library and then relink to produce a modified 293 | executable containing the modified Library. (It is understood 294 | that the user who changes the contents of definitions files in the 295 | Library will not necessarily be able to recompile the application 296 | to use the modified definitions.) 297 | 298 | b) Use a suitable shared library mechanism for linking with the 299 | Library. A suitable mechanism is one that (1) uses at run time a 300 | copy of the library already present on the user's computer system, 301 | rather than copying library functions into the executable, and (2) 302 | will operate properly with a modified version of the library, if 303 | the user installs one, as long as the modified version is 304 | interface-compatible with the version that the work was made with. 305 | 306 | c) Accompany the work with a written offer, valid for at 307 | least three years, to give the same user the materials 308 | specified in Subsection 6a, above, for a charge no more 309 | than the cost of performing this distribution. 310 | 311 | d) If distribution of the work is made by offering access to copy 312 | from a designated place, offer equivalent access to copy the above 313 | specified materials from the same place. 314 | 315 | e) Verify that the user has already received a copy of these 316 | materials or that you have already sent this user a copy. 317 | 318 | For an executable, the required form of the "work that uses the 319 | Library" must include any data and utility programs needed for 320 | reproducing the executable from it. However, as a special exception, 321 | the materials to be distributed need not include anything that is 322 | normally distributed (in either source or binary form) with the major 323 | components (compiler, kernel, and so on) of the operating system on 324 | which the executable runs, unless that component itself accompanies 325 | the executable. 326 | 327 | It may happen that this requirement contradicts the license 328 | restrictions of other proprietary libraries that do not normally 329 | accompany the operating system. Such a contradiction means you cannot 330 | use both them and the Library together in an executable that you 331 | distribute. 332 | 333 | 7. You may place library facilities that are a work based on the 334 | Library side-by-side in a single library together with other library 335 | facilities not covered by this License, and distribute such a combined 336 | library, provided that the separate distribution of the work based on 337 | the Library and of the other library facilities is otherwise 338 | permitted, and provided that you do these two things: 339 | 340 | a) Accompany the combined library with a copy of the same work 341 | based on the Library, uncombined with any other library 342 | facilities. This must be distributed under the terms of the 343 | Sections above. 344 | 345 | b) Give prominent notice with the combined library of the fact 346 | that part of it is a work based on the Library, and explaining 347 | where to find the accompanying uncombined form of the same work. 348 | 349 | 8. You may not copy, modify, sublicense, link with, or distribute 350 | the Library except as expressly provided under this License. Any 351 | attempt otherwise to copy, modify, sublicense, link with, or 352 | distribute the Library is void, and will automatically terminate your 353 | rights under this License. However, parties who have received copies, 354 | or rights, from you under this License will not have their licenses 355 | terminated so long as such parties remain in full compliance. 356 | 357 | 9. You are not required to accept this License, since you have not 358 | signed it. However, nothing else grants you permission to modify or 359 | distribute the Library or its derivative works. These actions are 360 | prohibited by law if you do not accept this License. Therefore, by 361 | modifying or distributing the Library (or any work based on the 362 | Library), you indicate your acceptance of this License to do so, and 363 | all its terms and conditions for copying, distributing or modifying 364 | the Library or works based on it. 365 | 366 | 10. Each time you redistribute the Library (or any work based on the 367 | Library), the recipient automatically receives a license from the 368 | original licensor to copy, distribute, link with or modify the Library 369 | subject to these terms and conditions. You may not impose any further 370 | restrictions on the recipients' exercise of the rights granted herein. 371 | You are not responsible for enforcing compliance by third parties with 372 | this License. 373 | 374 | 11. If, as a consequence of a court judgment or allegation of patent 375 | infringement or for any other reason (not limited to patent issues), 376 | conditions are imposed on you (whether by court order, agreement or 377 | otherwise) that contradict the conditions of this License, they do not 378 | excuse you from the conditions of this License. If you cannot 379 | distribute so as to satisfy simultaneously your obligations under this 380 | License and any other pertinent obligations, then as a consequence you 381 | may not distribute the Library at all. For example, if a patent 382 | license would not permit royalty-free redistribution of the Library by 383 | all those who receive copies directly or indirectly through you, then 384 | the only way you could satisfy both it and this License would be to 385 | refrain entirely from distribution of the Library. 386 | 387 | If any portion of this section is held invalid or unenforceable under any 388 | particular circumstance, the balance of the section is intended to apply, 389 | and the section as a whole is intended to apply in other circumstances. 390 | 391 | It is not the purpose of this section to induce you to infringe any 392 | patents or other property right claims or to contest validity of any 393 | such claims; this section has the sole purpose of protecting the 394 | integrity of the free software distribution system which is 395 | implemented by public license practices. Many people have made 396 | generous contributions to the wide range of software distributed 397 | through that system in reliance on consistent application of that 398 | system; it is up to the author/donor to decide if he or she is willing 399 | to distribute software through any other system and a licensee cannot 400 | impose that choice. 401 | 402 | This section is intended to make thoroughly clear what is believed to 403 | be a consequence of the rest of this License. 404 | 405 | 12. If the distribution and/or use of the Library is restricted in 406 | certain countries either by patents or by copyrighted interfaces, the 407 | original copyright holder who places the Library under this License may add 408 | an explicit geographical distribution limitation excluding those countries, 409 | so that distribution is permitted only in or among countries not thus 410 | excluded. In such case, this License incorporates the limitation as if 411 | written in the body of this License. 412 | 413 | 13. The Free Software Foundation may publish revised and/or new 414 | versions of the Lesser General Public License from time to time. 415 | Such new versions will be similar in spirit to the present version, 416 | but may differ in detail to address new problems or concerns. 417 | 418 | Each version is given a distinguishing version number. If the Library 419 | specifies a version number of this License which applies to it and 420 | "any later version", you have the option of following the terms and 421 | conditions either of that version or of any later version published by 422 | the Free Software Foundation. If the Library does not specify a 423 | license version number, you may choose any version ever published by 424 | the Free Software Foundation. 425 | 426 | 14. If you wish to incorporate parts of the Library into other free 427 | programs whose distribution conditions are incompatible with these, 428 | write to the author to ask for permission. For software which is 429 | copyrighted by the Free Software Foundation, write to the Free 430 | Software Foundation; we sometimes make exceptions for this. Our 431 | decision will be guided by the two goals of preserving the free status 432 | of all derivatives of our free software and of promoting the sharing 433 | and reuse of software generally. 434 | 435 | NO WARRANTY 436 | 437 | 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO 438 | WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. 439 | EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR 440 | OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY 441 | KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE 442 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 443 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE 444 | LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME 445 | THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 446 | 447 | 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN 448 | WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY 449 | AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU 450 | FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR 451 | CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE 452 | LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING 453 | RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A 454 | FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF 455 | SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 456 | DAMAGES. 457 | 458 | END OF TERMS AND CONDITIONS 459 | 460 | How to Apply These Terms to Your New Libraries 461 | 462 | If you develop a new library, and you want it to be of the greatest 463 | possible use to the public, we recommend making it free software that 464 | everyone can redistribute and change. You can do so by permitting 465 | redistribution under these terms (or, alternatively, under the terms of the 466 | ordinary General Public License). 467 | 468 | To apply these terms, attach the following notices to the library. It is 469 | safest to attach them to the start of each source file to most effectively 470 | convey the exclusion of warranty; and each file should have at least the 471 | "copyright" line and a pointer to where the full notice is found. 472 | 473 | 474 | Copyright (C) 475 | 476 | This library is free software; you can redistribute it and/or 477 | modify it under the terms of the GNU Lesser General Public 478 | License as published by the Free Software Foundation; either 479 | version 2.1 of the License, or (at your option) any later version. 480 | 481 | This library is distributed in the hope that it will be useful, 482 | but WITHOUT ANY WARRANTY; without even the implied warranty of 483 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 484 | Lesser General Public License for more details. 485 | 486 | You should have received a copy of the GNU Lesser General Public 487 | License along with this library; if not, write to the Free Software 488 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 489 | USA 490 | 491 | Also add information on how to contact you by electronic and paper mail. 492 | 493 | You should also get your employer (if you work as a programmer) or your 494 | school, if any, to sign a "copyright disclaimer" for the library, if 495 | necessary. Here is a sample; alter the names: 496 | 497 | Yoyodyne, Inc., hereby disclaims all copyright interest in the 498 | library `Frob' (a library for tweaking knobs) written by James Random 499 | Hacker. 500 | 501 | , 1 April 1990 502 | Ty Coon, President of Vice 503 | 504 | That's all there is to it! -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # NtfsReader 2 | Modifications: 3 | - source on Github instead of sourceforge 4 | - netstandard2.0 targetting project file added to allow library to be consumed from .NET Core 5 | 6 | Original description from https://sourceforge.net/projects/ntfsreader/ : 7 | 8 | The NtfsReader library. 9 | 10 | Copyright (C) 2008 Danny Couture 11 | 12 | This library is free software; you can redistribute it and/or 13 | modify it under the terms of the GNU Lesser General Public 14 | License as published by the Free Software Foundation; either 15 | version 2.1 of the License, or (at your option) any later version. 16 | 17 | This library is distributed in the hope that it will be useful, 18 | but WITHOUT ANY WARRANTY; without even the implied warranty of 19 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 20 | Lesser General Public License for more details. 21 | 22 | You should have received a copy of the GNU Lesser General Public 23 | License along with this library; if not, write to the Free Software 24 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 25 | 26 | For the full text of the license see the "License.txt" file. 27 | 28 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 29 | http://www.kessels.com/Jkdefrag/ 30 | 31 | Special thanks goes to him. 32 | 33 | Danny Couture 34 | Software Architect 35 | 36 | -------------------------------------------------------------------------------- /src/NtfsReader.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.26124.0 5 | MinimumVisualStudioVersion = 15.0.26124.0 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "NtfsReader", "NtfsReader\NtfsReader.csproj", "{B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Debug|x64 = Debug|x64 12 | Debug|x86 = Debug|x86 13 | Release|Any CPU = Release|Any CPU 14 | Release|x64 = Release|x64 15 | Release|x86 = Release|x86 16 | EndGlobalSection 17 | GlobalSection(SolutionProperties) = preSolution 18 | HideSolutionNode = FALSE 19 | EndGlobalSection 20 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 21 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 22 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|Any CPU.Build.0 = Debug|Any CPU 23 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|x64.ActiveCfg = Debug|Any CPU 24 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|x64.Build.0 = Debug|Any CPU 25 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|x86.ActiveCfg = Debug|Any CPU 26 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Debug|x86.Build.0 = Debug|Any CPU 27 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|Any CPU.ActiveCfg = Release|Any CPU 28 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|Any CPU.Build.0 = Release|Any CPU 29 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|x64.ActiveCfg = Release|Any CPU 30 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|x64.Build.0 = Release|Any CPU 31 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|x86.ActiveCfg = Release|Any CPU 32 | {B826059C-31A3-4CC6-A6CA-834FE3D9D9CA}.Release|x86.Build.0 = Release|Any CPU 33 | EndGlobalSection 34 | EndGlobal 35 | -------------------------------------------------------------------------------- /src/NtfsReader/License.txt: -------------------------------------------------------------------------------- 1 | GNU LESSER GENERAL PUBLIC LICENSE 2 | Version 2.1, February 1999 3 | 4 | Copyright (C) 1991, 1999 Free Software Foundation, Inc. 5 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 6 | Everyone is permitted to copy and distribute verbatim copies 7 | of this license document, but changing it is not allowed. 8 | 9 | [This is the first released version of the Lesser GPL. It also counts 10 | as the successor of the GNU Library Public License, version 2, hence 11 | the version number 2.1.] 12 | 13 | Preamble 14 | 15 | The licenses for most software are designed to take away your 16 | freedom to share and change it. By contrast, the GNU General Public 17 | Licenses are intended to guarantee your freedom to share and change 18 | free software--to make sure the software is free for all its users. 19 | 20 | This license, the Lesser General Public License, applies to some 21 | specially designated software packages--typically libraries--of the 22 | Free Software Foundation and other authors who decide to use it. You 23 | can use it too, but we suggest you first think carefully about whether 24 | this license or the ordinary General Public License is the better 25 | strategy to use in any particular case, based on the explanations below. 26 | 27 | When we speak of free software, we are referring to freedom of use, 28 | not price. Our General Public Licenses are designed to make sure that 29 | you have the freedom to distribute copies of free software (and charge 30 | for this service if you wish); that you receive source code or can get 31 | it if you want it; that you can change the software and use pieces of 32 | it in new free programs; and that you are informed that you can do 33 | these things. 34 | 35 | To protect your rights, we need to make restrictions that forbid 36 | distributors to deny you these rights or to ask you to surrender these 37 | rights. These restrictions translate to certain responsibilities for 38 | you if you distribute copies of the library or if you modify it. 39 | 40 | For example, if you distribute copies of the library, whether gratis 41 | or for a fee, you must give the recipients all the rights that we gave 42 | you. You must make sure that they, too, receive or can get the source 43 | code. If you link other code with the library, you must provide 44 | complete object files to the recipients, so that they can relink them 45 | with the library after making changes to the library and recompiling 46 | it. And you must show them these terms so they know their rights. 47 | 48 | We protect your rights with a two-step method: (1) we copyright the 49 | library, and (2) we offer you this license, which gives you legal 50 | permission to copy, distribute and/or modify the library. 51 | 52 | To protect each distributor, we want to make it very clear that 53 | there is no warranty for the free library. Also, if the library is 54 | modified by someone else and passed on, the recipients should know 55 | that what they have is not the original version, so that the original 56 | author's reputation will not be affected by problems that might be 57 | introduced by others. 58 | 59 | Finally, software patents pose a constant threat to the existence of 60 | any free program. We wish to make sure that a company cannot 61 | effectively restrict the users of a free program by obtaining a 62 | restrictive license from a patent holder. Therefore, we insist that 63 | any patent license obtained for a version of the library must be 64 | consistent with the full freedom of use specified in this license. 65 | 66 | Most GNU software, including some libraries, is covered by the 67 | ordinary GNU General Public License. This license, the GNU Lesser 68 | General Public License, applies to certain designated libraries, and 69 | is quite different from the ordinary General Public License. We use 70 | this license for certain libraries in order to permit linking those 71 | libraries into non-free programs. 72 | 73 | When a program is linked with a library, whether statically or using 74 | a shared library, the combination of the two is legally speaking a 75 | combined work, a derivative of the original library. The ordinary 76 | General Public License therefore permits such linking only if the 77 | entire combination fits its criteria of freedom. The Lesser General 78 | Public License permits more lax criteria for linking other code with 79 | the library. 80 | 81 | We call this license the "Lesser" General Public License because it 82 | does Less to protect the user's freedom than the ordinary General 83 | Public License. It also provides other free software developers Less 84 | of an advantage over competing non-free programs. These disadvantages 85 | are the reason we use the ordinary General Public License for many 86 | libraries. However, the Lesser license provides advantages in certain 87 | special circumstances. 88 | 89 | For example, on rare occasions, there may be a special need to 90 | encourage the widest possible use of a certain library, so that it becomes 91 | a de-facto standard. To achieve this, non-free programs must be 92 | allowed to use the library. A more frequent case is that a free 93 | library does the same job as widely used non-free libraries. In this 94 | case, there is little to gain by limiting the free library to free 95 | software only, so we use the Lesser General Public License. 96 | 97 | In other cases, permission to use a particular library in non-free 98 | programs enables a greater number of people to use a large body of 99 | free software. For example, permission to use the GNU C Library in 100 | non-free programs enables many more people to use the whole GNU 101 | operating system, as well as its variant, the GNU/Linux operating 102 | system. 103 | 104 | Although the Lesser General Public License is Less protective of the 105 | users' freedom, it does ensure that the user of a program that is 106 | linked with the Library has the freedom and the wherewithal to run 107 | that program using a modified version of the Library. 108 | 109 | The precise terms and conditions for copying, distribution and 110 | modification follow. Pay close attention to the difference between a 111 | "work based on the library" and a "work that uses the library". The 112 | former contains code derived from the library, whereas the latter must 113 | be combined with the library in order to run. 114 | 115 | GNU LESSER GENERAL PUBLIC LICENSE 116 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 117 | 118 | 0. This License Agreement applies to any software library or other 119 | program which contains a notice placed by the copyright holder or 120 | other authorized party saying it may be distributed under the terms of 121 | this Lesser General Public License (also called "this License"). 122 | Each licensee is addressed as "you". 123 | 124 | A "library" means a collection of software functions and/or data 125 | prepared so as to be conveniently linked with application programs 126 | (which use some of those functions and data) to form executables. 127 | 128 | The "Library", below, refers to any such software library or work 129 | which has been distributed under these terms. A "work based on the 130 | Library" means either the Library or any derivative work under 131 | copyright law: that is to say, a work containing the Library or a 132 | portion of it, either verbatim or with modifications and/or translated 133 | straightforwardly into another language. (Hereinafter, translation is 134 | included without limitation in the term "modification".) 135 | 136 | "Source code" for a work means the preferred form of the work for 137 | making modifications to it. For a library, complete source code means 138 | all the source code for all modules it contains, plus any associated 139 | interface definition files, plus the scripts used to control compilation 140 | and installation of the library. 141 | 142 | Activities other than copying, distribution and modification are not 143 | covered by this License; they are outside its scope. The act of 144 | running a program using the Library is not restricted, and output from 145 | such a program is covered only if its contents constitute a work based 146 | on the Library (independent of the use of the Library in a tool for 147 | writing it). Whether that is true depends on what the Library does 148 | and what the program that uses the Library does. 149 | 150 | 1. You may copy and distribute verbatim copies of the Library's 151 | complete source code as you receive it, in any medium, provided that 152 | you conspicuously and appropriately publish on each copy an 153 | appropriate copyright notice and disclaimer of warranty; keep intact 154 | all the notices that refer to this License and to the absence of any 155 | warranty; and distribute a copy of this License along with the 156 | Library. 157 | 158 | You may charge a fee for the physical act of transferring a copy, 159 | and you may at your option offer warranty protection in exchange for a 160 | fee. 161 | 162 | 2. You may modify your copy or copies of the Library or any portion 163 | of it, thus forming a work based on the Library, and copy and 164 | distribute such modifications or work under the terms of Section 1 165 | above, provided that you also meet all of these conditions: 166 | 167 | a) The modified work must itself be a software library. 168 | 169 | b) You must cause the files modified to carry prominent notices 170 | stating that you changed the files and the date of any change. 171 | 172 | c) You must cause the whole of the work to be licensed at no 173 | charge to all third parties under the terms of this License. 174 | 175 | d) If a facility in the modified Library refers to a function or a 176 | table of data to be supplied by an application program that uses 177 | the facility, other than as an argument passed when the facility 178 | is invoked, then you must make a good faith effort to ensure that, 179 | in the event an application does not supply such function or 180 | table, the facility still operates, and performs whatever part of 181 | its purpose remains meaningful. 182 | 183 | (For example, a function in a library to compute square roots has 184 | a purpose that is entirely well-defined independent of the 185 | application. Therefore, Subsection 2d requires that any 186 | application-supplied function or table used by this function must 187 | be optional: if the application does not supply it, the square 188 | root function must still compute square roots.) 189 | 190 | These requirements apply to the modified work as a whole. If 191 | identifiable sections of that work are not derived from the Library, 192 | and can be reasonably considered independent and separate works in 193 | themselves, then this License, and its terms, do not apply to those 194 | sections when you distribute them as separate works. But when you 195 | distribute the same sections as part of a whole which is a work based 196 | on the Library, the distribution of the whole must be on the terms of 197 | this License, whose permissions for other licensees extend to the 198 | entire whole, and thus to each and every part regardless of who wrote 199 | it. 200 | 201 | Thus, it is not the intent of this section to claim rights or contest 202 | your rights to work written entirely by you; rather, the intent is to 203 | exercise the right to control the distribution of derivative or 204 | collective works based on the Library. 205 | 206 | In addition, mere aggregation of another work not based on the Library 207 | with the Library (or with a work based on the Library) on a volume of 208 | a storage or distribution medium does not bring the other work under 209 | the scope of this License. 210 | 211 | 3. You may opt to apply the terms of the ordinary GNU General Public 212 | License instead of this License to a given copy of the Library. To do 213 | this, you must alter all the notices that refer to this License, so 214 | that they refer to the ordinary GNU General Public License, version 2, 215 | instead of to this License. (If a newer version than version 2 of the 216 | ordinary GNU General Public License has appeared, then you can specify 217 | that version instead if you wish.) Do not make any other change in 218 | these notices. 219 | 220 | Once this change is made in a given copy, it is irreversible for 221 | that copy, so the ordinary GNU General Public License applies to all 222 | subsequent copies and derivative works made from that copy. 223 | 224 | This option is useful when you wish to copy part of the code of 225 | the Library into a program that is not a library. 226 | 227 | 4. You may copy and distribute the Library (or a portion or 228 | derivative of it, under Section 2) in object code or executable form 229 | under the terms of Sections 1 and 2 above provided that you accompany 230 | it with the complete corresponding machine-readable source code, which 231 | must be distributed under the terms of Sections 1 and 2 above on a 232 | medium customarily used for software interchange. 233 | 234 | If distribution of object code is made by offering access to copy 235 | from a designated place, then offering equivalent access to copy the 236 | source code from the same place satisfies the requirement to 237 | distribute the source code, even though third parties are not 238 | compelled to copy the source along with the object code. 239 | 240 | 5. A program that contains no derivative of any portion of the 241 | Library, but is designed to work with the Library by being compiled or 242 | linked with it, is called a "work that uses the Library". Such a 243 | work, in isolation, is not a derivative work of the Library, and 244 | therefore falls outside the scope of this License. 245 | 246 | However, linking a "work that uses the Library" with the Library 247 | creates an executable that is a derivative of the Library (because it 248 | contains portions of the Library), rather than a "work that uses the 249 | library". The executable is therefore covered by this License. 250 | Section 6 states terms for distribution of such executables. 251 | 252 | When a "work that uses the Library" uses material from a header file 253 | that is part of the Library, the object code for the work may be a 254 | derivative work of the Library even though the source code is not. 255 | Whether this is true is especially significant if the work can be 256 | linked without the Library, or if the work is itself a library. The 257 | threshold for this to be true is not precisely defined by law. 258 | 259 | If such an object file uses only numerical parameters, data 260 | structure layouts and accessors, and small macros and small inline 261 | functions (ten lines or less in length), then the use of the object 262 | file is unrestricted, regardless of whether it is legally a derivative 263 | work. (Executables containing this object code plus portions of the 264 | Library will still fall under Section 6.) 265 | 266 | Otherwise, if the work is a derivative of the Library, you may 267 | distribute the object code for the work under the terms of Section 6. 268 | Any executables containing that work also fall under Section 6, 269 | whether or not they are linked directly with the Library itself. 270 | 271 | 6. As an exception to the Sections above, you may also combine or 272 | link a "work that uses the Library" with the Library to produce a 273 | work containing portions of the Library, and distribute that work 274 | under terms of your choice, provided that the terms permit 275 | modification of the work for the customer's own use and reverse 276 | engineering for debugging such modifications. 277 | 278 | You must give prominent notice with each copy of the work that the 279 | Library is used in it and that the Library and its use are covered by 280 | this License. You must supply a copy of this License. If the work 281 | during execution displays copyright notices, you must include the 282 | copyright notice for the Library among them, as well as a reference 283 | directing the user to the copy of this License. Also, you must do one 284 | of these things: 285 | 286 | a) Accompany the work with the complete corresponding 287 | machine-readable source code for the Library including whatever 288 | changes were used in the work (which must be distributed under 289 | Sections 1 and 2 above); and, if the work is an executable linked 290 | with the Library, with the complete machine-readable "work that 291 | uses the Library", as object code and/or source code, so that the 292 | user can modify the Library and then relink to produce a modified 293 | executable containing the modified Library. (It is understood 294 | that the user who changes the contents of definitions files in the 295 | Library will not necessarily be able to recompile the application 296 | to use the modified definitions.) 297 | 298 | b) Use a suitable shared library mechanism for linking with the 299 | Library. A suitable mechanism is one that (1) uses at run time a 300 | copy of the library already present on the user's computer system, 301 | rather than copying library functions into the executable, and (2) 302 | will operate properly with a modified version of the library, if 303 | the user installs one, as long as the modified version is 304 | interface-compatible with the version that the work was made with. 305 | 306 | c) Accompany the work with a written offer, valid for at 307 | least three years, to give the same user the materials 308 | specified in Subsection 6a, above, for a charge no more 309 | than the cost of performing this distribution. 310 | 311 | d) If distribution of the work is made by offering access to copy 312 | from a designated place, offer equivalent access to copy the above 313 | specified materials from the same place. 314 | 315 | e) Verify that the user has already received a copy of these 316 | materials or that you have already sent this user a copy. 317 | 318 | For an executable, the required form of the "work that uses the 319 | Library" must include any data and utility programs needed for 320 | reproducing the executable from it. However, as a special exception, 321 | the materials to be distributed need not include anything that is 322 | normally distributed (in either source or binary form) with the major 323 | components (compiler, kernel, and so on) of the operating system on 324 | which the executable runs, unless that component itself accompanies 325 | the executable. 326 | 327 | It may happen that this requirement contradicts the license 328 | restrictions of other proprietary libraries that do not normally 329 | accompany the operating system. Such a contradiction means you cannot 330 | use both them and the Library together in an executable that you 331 | distribute. 332 | 333 | 7. You may place library facilities that are a work based on the 334 | Library side-by-side in a single library together with other library 335 | facilities not covered by this License, and distribute such a combined 336 | library, provided that the separate distribution of the work based on 337 | the Library and of the other library facilities is otherwise 338 | permitted, and provided that you do these two things: 339 | 340 | a) Accompany the combined library with a copy of the same work 341 | based on the Library, uncombined with any other library 342 | facilities. This must be distributed under the terms of the 343 | Sections above. 344 | 345 | b) Give prominent notice with the combined library of the fact 346 | that part of it is a work based on the Library, and explaining 347 | where to find the accompanying uncombined form of the same work. 348 | 349 | 8. You may not copy, modify, sublicense, link with, or distribute 350 | the Library except as expressly provided under this License. Any 351 | attempt otherwise to copy, modify, sublicense, link with, or 352 | distribute the Library is void, and will automatically terminate your 353 | rights under this License. However, parties who have received copies, 354 | or rights, from you under this License will not have their licenses 355 | terminated so long as such parties remain in full compliance. 356 | 357 | 9. You are not required to accept this License, since you have not 358 | signed it. However, nothing else grants you permission to modify or 359 | distribute the Library or its derivative works. These actions are 360 | prohibited by law if you do not accept this License. Therefore, by 361 | modifying or distributing the Library (or any work based on the 362 | Library), you indicate your acceptance of this License to do so, and 363 | all its terms and conditions for copying, distributing or modifying 364 | the Library or works based on it. 365 | 366 | 10. Each time you redistribute the Library (or any work based on the 367 | Library), the recipient automatically receives a license from the 368 | original licensor to copy, distribute, link with or modify the Library 369 | subject to these terms and conditions. You may not impose any further 370 | restrictions on the recipients' exercise of the rights granted herein. 371 | You are not responsible for enforcing compliance by third parties with 372 | this License. 373 | 374 | 11. If, as a consequence of a court judgment or allegation of patent 375 | infringement or for any other reason (not limited to patent issues), 376 | conditions are imposed on you (whether by court order, agreement or 377 | otherwise) that contradict the conditions of this License, they do not 378 | excuse you from the conditions of this License. If you cannot 379 | distribute so as to satisfy simultaneously your obligations under this 380 | License and any other pertinent obligations, then as a consequence you 381 | may not distribute the Library at all. For example, if a patent 382 | license would not permit royalty-free redistribution of the Library by 383 | all those who receive copies directly or indirectly through you, then 384 | the only way you could satisfy both it and this License would be to 385 | refrain entirely from distribution of the Library. 386 | 387 | If any portion of this section is held invalid or unenforceable under any 388 | particular circumstance, the balance of the section is intended to apply, 389 | and the section as a whole is intended to apply in other circumstances. 390 | 391 | It is not the purpose of this section to induce you to infringe any 392 | patents or other property right claims or to contest validity of any 393 | such claims; this section has the sole purpose of protecting the 394 | integrity of the free software distribution system which is 395 | implemented by public license practices. Many people have made 396 | generous contributions to the wide range of software distributed 397 | through that system in reliance on consistent application of that 398 | system; it is up to the author/donor to decide if he or she is willing 399 | to distribute software through any other system and a licensee cannot 400 | impose that choice. 401 | 402 | This section is intended to make thoroughly clear what is believed to 403 | be a consequence of the rest of this License. 404 | 405 | 12. If the distribution and/or use of the Library is restricted in 406 | certain countries either by patents or by copyrighted interfaces, the 407 | original copyright holder who places the Library under this License may add 408 | an explicit geographical distribution limitation excluding those countries, 409 | so that distribution is permitted only in or among countries not thus 410 | excluded. In such case, this License incorporates the limitation as if 411 | written in the body of this License. 412 | 413 | 13. The Free Software Foundation may publish revised and/or new 414 | versions of the Lesser General Public License from time to time. 415 | Such new versions will be similar in spirit to the present version, 416 | but may differ in detail to address new problems or concerns. 417 | 418 | Each version is given a distinguishing version number. If the Library 419 | specifies a version number of this License which applies to it and 420 | "any later version", you have the option of following the terms and 421 | conditions either of that version or of any later version published by 422 | the Free Software Foundation. If the Library does not specify a 423 | license version number, you may choose any version ever published by 424 | the Free Software Foundation. 425 | 426 | 14. If you wish to incorporate parts of the Library into other free 427 | programs whose distribution conditions are incompatible with these, 428 | write to the author to ask for permission. For software which is 429 | copyrighted by the Free Software Foundation, write to the Free 430 | Software Foundation; we sometimes make exceptions for this. Our 431 | decision will be guided by the two goals of preserving the free status 432 | of all derivatives of our free software and of promoting the sharing 433 | and reuse of software generally. 434 | 435 | NO WARRANTY 436 | 437 | 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO 438 | WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. 439 | EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR 440 | OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY 441 | KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE 442 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 443 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE 444 | LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME 445 | THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 446 | 447 | 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN 448 | WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY 449 | AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU 450 | FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR 451 | CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE 452 | LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING 453 | RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A 454 | FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF 455 | SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 456 | DAMAGES. 457 | 458 | END OF TERMS AND CONDITIONS 459 | 460 | How to Apply These Terms to Your New Libraries 461 | 462 | If you develop a new library, and you want it to be of the greatest 463 | possible use to the public, we recommend making it free software that 464 | everyone can redistribute and change. You can do so by permitting 465 | redistribution under these terms (or, alternatively, under the terms of the 466 | ordinary General Public License). 467 | 468 | To apply these terms, attach the following notices to the library. It is 469 | safest to attach them to the start of each source file to most effectively 470 | convey the exclusion of warranty; and each file should have at least the 471 | "copyright" line and a pointer to where the full notice is found. 472 | 473 | 474 | Copyright (C) 475 | 476 | This library is free software; you can redistribute it and/or 477 | modify it under the terms of the GNU Lesser General Public 478 | License as published by the Free Software Foundation; either 479 | version 2.1 of the License, or (at your option) any later version. 480 | 481 | This library is distributed in the hope that it will be useful, 482 | but WITHOUT ANY WARRANTY; without even the implied warranty of 483 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 484 | Lesser General Public License for more details. 485 | 486 | You should have received a copy of the GNU Lesser General Public 487 | License along with this library; if not, write to the Free Software 488 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 489 | USA 490 | 491 | Also add information on how to contact you by electronic and paper mail. 492 | 493 | You should also get your employer (if you work as a programmer) or your 494 | school, if any, to sign a "copyright disclaimer" for the library, if 495 | necessary. Here is a sample; alter the names: 496 | 497 | Yoyodyne, Inc., hereby disclaims all copyright interest in the 498 | library `Frob' (a library for tweaking knobs) written by James Random 499 | Hacker. 500 | 501 | , 1 April 1990 502 | Ty Coon, President of Vice 503 | 504 | That's all there is to it! -------------------------------------------------------------------------------- /src/NtfsReader/NtfsReader.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | netstandard2.0 4 | true 5 | Michaelkc.NtfsReader 6 | 0.0.3 7 | Michael Christensen 8 | - 9 | https://github.com/michaelkc/NtfsReader 10 | true 11 | snupkg 12 | LGPL-2.1-or-later 13 | 14 | 15 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/Algorithms.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System; 31 | using System.Collections.Generic; 32 | using System.Text; 33 | 34 | namespace System.IO.Filesystem.Ntfs 35 | { 36 | public static class Algorithms 37 | { 38 | public static IDictionary> AggregateByFragments(IEnumerable nodes, UInt32 minimumFragments) 39 | { 40 | Dictionary> fragmentsAggregate = new Dictionary>(); 41 | 42 | foreach (INode node in nodes) 43 | { 44 | IList streams = node.Streams; 45 | if (streams == null || streams.Count == 0) 46 | continue; 47 | 48 | IList fragments = streams[0].Fragments; 49 | if (fragments == null) 50 | continue; 51 | 52 | UInt32 fragmentCount = (UInt32)fragments.Count; 53 | 54 | if (fragmentCount < minimumFragments) 55 | continue; 56 | 57 | List nodeList; 58 | fragmentsAggregate.TryGetValue(fragmentCount, out nodeList); 59 | 60 | if (nodeList == null) 61 | { 62 | nodeList = new List(); 63 | fragmentsAggregate[fragmentCount] = nodeList; 64 | } 65 | 66 | nodeList.Add(node); 67 | } 68 | 69 | return fragmentsAggregate; 70 | } 71 | 72 | public static IDictionary> AggregateBySize(IEnumerable nodes, UInt64 minimumSize) 73 | { 74 | Dictionary> sizeAggregate = new Dictionary>(); 75 | 76 | foreach (INode node in nodes) 77 | { 78 | if ((node.Attributes & Attributes.Directory) != 0 || node.Size < minimumSize) 79 | continue; 80 | 81 | List nodeList; 82 | sizeAggregate.TryGetValue(node.Size, out nodeList); 83 | 84 | if (nodeList == null) 85 | { 86 | nodeList = new List(); 87 | sizeAggregate[node.Size] = nodeList; 88 | } 89 | 90 | nodeList.Add(node); 91 | } 92 | 93 | return sizeAggregate; 94 | } 95 | } 96 | } 97 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/Attributes.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | namespace System.IO.Filesystem.Ntfs 31 | { 32 | /// 33 | /// Node attributes. 34 | /// 35 | [Flags] 36 | public enum Attributes : uint 37 | { 38 | /// 39 | /// The file is read-only. 40 | /// 41 | ReadOnly = 1, 42 | 43 | /// 44 | /// The file is hidden, and thus is not included in an ordinary directory listing. 45 | /// 46 | Hidden = 2, 47 | 48 | /// 49 | /// The file is a system file. The file is part of the operating system or is 50 | /// used exclusively by the operating system. 51 | /// 52 | System = 4, 53 | 54 | /// 55 | /// The file is a directory. 56 | /// 57 | Directory = 16, 58 | 59 | /// 60 | /// The file's archive status. Applications use this attribute to mark files 61 | /// for backup or removal. 62 | /// 63 | Archive = 32, 64 | 65 | /// 66 | /// Reserved for future use. 67 | /// 68 | Device = 64, 69 | 70 | /// 71 | /// The file is normal and has no other attributes set. This attribute is valid 72 | /// only if used alone. 73 | /// 74 | Normal = 128, 75 | 76 | /// 77 | /// The file is temporary. File systems attempt to keep all of the data in memory 78 | /// for quicker access rather than flushing the data back to mass storage. A 79 | /// temporary file should be deleted by the application as soon as it is no longer 80 | /// needed. 81 | /// 82 | Temporary = 256, 83 | 84 | /// 85 | /// The file is a sparse file. Sparse files are typically large files whose data 86 | /// are mostly zeros. 87 | /// 88 | SparseFile = 512, 89 | 90 | /// 91 | /// The file contains a reparse point, which is a block of user-defined data 92 | /// associated with a file or a directory. 93 | /// 94 | ReparsePoint = 1024, 95 | 96 | /// 97 | /// The file is compressed. 98 | /// 99 | Compressed = 2048, 100 | 101 | /// 102 | /// The file is offline. The data of the file is not immediately available. 103 | /// 104 | Offline = 4096, 105 | 106 | /// 107 | /// The file will not be indexed by the operating system's content indexing service. 108 | /// 109 | NotContentIndexed = 8192, 110 | 111 | /// 112 | /// The file or directory is encrypted. For a file, this means that all data 113 | /// in the file is encrypted. For a directory, this means that encryption is 114 | /// the default for newly created files and directories. 115 | /// 116 | Encrypted = 16384, 117 | } 118 | } 119 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/IDiskInfo.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | namespace System.IO.Filesystem.Ntfs 31 | { 32 | /// 33 | /// Disk information 34 | /// 35 | public interface IDiskInfo 36 | { 37 | UInt16 BytesPerSector { get; } 38 | byte SectorsPerCluster { get; } 39 | UInt64 TotalSectors { get; } 40 | UInt64 MftStartLcn { get; } 41 | UInt64 Mft2StartLcn { get; } 42 | UInt32 ClustersPerMftRecord { get; } 43 | UInt32 ClustersPerIndexRecord { get; } 44 | UInt64 BytesPerMftRecord { get; } 45 | UInt64 BytesPerCluster { get; } 46 | UInt64 TotalClusters { get; } 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/IFragment.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | namespace System.IO.Filesystem.Ntfs 31 | { 32 | /// 33 | /// This is where the parts of the file are located on the volume. 34 | /// 35 | public interface IFragment 36 | { 37 | /// 38 | /// Logical cluster number, location on disk. 39 | /// 40 | UInt64 Lcn { get; } 41 | 42 | /// 43 | /// Virtual cluster number of next fragment. 44 | /// 45 | UInt64 NextVcn { get; } 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/INode.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System.Collections.Generic; 31 | 32 | namespace System.IO.Filesystem.Ntfs 33 | { 34 | /// 35 | /// Directory & Files Information are stored in inodes 36 | /// 37 | public interface INode 38 | { 39 | Attributes Attributes { get; } 40 | UInt32 NodeIndex { get; } 41 | UInt32 ParentNodeIndex { get; } 42 | string Name { get; } 43 | UInt64 Size { get; } 44 | string FullName { get; } 45 | IList Streams { get; } 46 | 47 | DateTime CreationTime { get; } 48 | DateTime LastChangeTime { get; } 49 | DateTime LastAccessTime { get; } 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/IStream.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System.Collections.Generic; 31 | 32 | namespace System.IO.Filesystem.Ntfs 33 | { 34 | /// 35 | /// In Ntfs, each node may have multiple streams. 36 | /// 37 | public interface IStream 38 | { 39 | string Name { get; } 40 | UInt64 Size { get; } 41 | IList Fragments { get; } 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/NtfsReader.Algorithms.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System.Collections.Generic; 31 | using System.Text; 32 | 33 | namespace System.IO.Filesystem.Ntfs 34 | { 35 | public partial class NtfsReader 36 | { 37 | /// 38 | /// Recurse the node hierarchy and construct its entire name 39 | /// stopping at the root directory. 40 | /// 41 | private string GetNodeFullNameCore(UInt32 nodeIndex) 42 | { 43 | UInt32 node = nodeIndex; 44 | 45 | Stack fullPathNodes = new Stack(); 46 | fullPathNodes.Push(node); 47 | 48 | UInt32 lastNode = node; 49 | while (true) 50 | { 51 | UInt32 parent = _nodes[node].ParentNodeIndex; 52 | 53 | //loop until we reach the root directory 54 | if (parent == ROOTDIRECTORY) 55 | break; 56 | 57 | if (parent == lastNode) 58 | throw new InvalidDataException("Detected a loop in the tree structure."); 59 | 60 | fullPathNodes.Push(parent); 61 | 62 | lastNode = node; 63 | node = parent; 64 | } 65 | 66 | StringBuilder fullPath = new StringBuilder(); 67 | fullPath.Append(_driveInfo.Name.TrimEnd(new char[] { '\\' })); 68 | 69 | while (fullPathNodes.Count > 0) 70 | { 71 | node = fullPathNodes.Pop(); 72 | 73 | fullPath.Append(@"\"); 74 | fullPath.Append(GetNameFromIndex(_nodes[node].NameIndex)); 75 | } 76 | 77 | return fullPath.ToString(); 78 | } 79 | } 80 | } 81 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/NtfsReader.NativeMethods.cs: -------------------------------------------------------------------------------- 1 | using System.Runtime.InteropServices; 2 | /* 3 | The NtfsReader library. 4 | 5 | Copyright (C) 2008 Danny Couture 6 | 7 | This library is free software; you can redistribute it and/or 8 | modify it under the terms of the GNU Lesser General Public 9 | License as published by the Free Software Foundation; either 10 | version 2.1 of the License, or (at your option) any later version. 11 | 12 | This library is distributed in the hope that it will be useful, 13 | but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 | Lesser General Public License for more details. 16 | 17 | You should have received a copy of the GNU Lesser General Public 18 | License along with this library; if not, write to the Free Software 19 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 20 | 21 | For the full text of the license see the "License.txt" file. 22 | 23 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 24 | http://www.kessels.com/Jkdefrag/ 25 | 26 | Special thanks goes to him. 27 | 28 | Danny Couture 29 | Software Architect 30 | */ 31 | using System.Text; 32 | using Microsoft.Win32.SafeHandles; 33 | 34 | namespace System.IO.Filesystem.Ntfs 35 | { 36 | public partial class NtfsReader 37 | { 38 | [DllImport("kernel32", CharSet = CharSet.Auto, BestFitMapping = false)] 39 | private static extern bool GetVolumeNameForVolumeMountPoint(String volumeName, StringBuilder uniqueVolumeName, int uniqueNameBufferCapacity); 40 | 41 | [DllImport("kernel32", CharSet = CharSet.Auto, BestFitMapping = false)] 42 | private static extern SafeFileHandle CreateFile(string lpFileName, FileAccess fileAccess, FileShare fileShare, IntPtr lpSecurityAttributes, FileMode fileMode, int dwFlagsAndAttributes, IntPtr hTemplateFile); 43 | 44 | [DllImport("kernel32", CharSet = CharSet.Auto)] 45 | private static extern bool ReadFile(SafeFileHandle hFile, IntPtr lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, ref NativeOverlapped lpOverlapped); 46 | 47 | [Serializable] 48 | private enum FileMode : int 49 | { 50 | Append = 6, 51 | Create = 2, 52 | CreateNew = 1, 53 | Open = 3, 54 | OpenOrCreate = 4, 55 | Truncate = 5 56 | } 57 | 58 | [Serializable, Flags] 59 | private enum FileShare : int 60 | { 61 | None = 0, 62 | Read = 1, 63 | Write = 2, 64 | Delete = 4, 65 | All = Read | Write | Delete 66 | } 67 | 68 | [Serializable, Flags] 69 | private enum FileAccess : int 70 | { 71 | Read = 1, 72 | ReadWrite = 3, 73 | Write = 2 74 | } 75 | 76 | [StructLayout(LayoutKind.Sequential)] 77 | private struct NativeOverlapped 78 | { 79 | public IntPtr privateLow; 80 | public IntPtr privateHigh; 81 | public UInt64 Offset; 82 | public IntPtr EventHandle; 83 | 84 | public NativeOverlapped(UInt64 offset) 85 | { 86 | Offset = offset; 87 | EventHandle = IntPtr.Zero; 88 | privateLow = IntPtr.Zero; 89 | privateHigh = IntPtr.Zero; 90 | } 91 | } 92 | } 93 | } 94 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/NtfsReader.Public.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System.Collections.Generic; 31 | using System.Text; 32 | using System.Diagnostics; 33 | 34 | namespace System.IO.Filesystem.Ntfs 35 | { 36 | /// 37 | /// Ntfs metadata reader. 38 | /// 39 | /// This class is used to get files & directories information of an NTFS volume. 40 | /// This is a lot faster than using conventional directory browsing method 41 | /// particularly when browsing really big directories. 42 | /// 43 | /// Admnistrator rights are required in order to use this method. 44 | public partial class NtfsReader 45 | { 46 | /// 47 | /// NtfsReader constructor. 48 | /// 49 | /// The drive you want to read metadata from. 50 | /// Information to retrieve from each node while scanning the disk 51 | /// Streams & Fragments are expensive to store in memory, if you don't need them, don't retrieve them. 52 | public NtfsReader(DriveInfo driveInfo, RetrieveMode retrieveMode) 53 | { 54 | if (driveInfo == null) 55 | throw new ArgumentNullException("driveInfo"); 56 | 57 | _driveInfo = driveInfo; 58 | _retrieveMode = retrieveMode; 59 | 60 | StringBuilder builder = new StringBuilder(1024); 61 | GetVolumeNameForVolumeMountPoint(_driveInfo.RootDirectory.Name, builder, builder.Capacity); 62 | 63 | string volume = builder.ToString().TrimEnd(new char[] { '\\' }); 64 | 65 | _volumeHandle = 66 | CreateFile( 67 | volume, 68 | FileAccess.Read, 69 | FileShare.All, 70 | IntPtr.Zero, 71 | FileMode.Open, 72 | 0, 73 | IntPtr.Zero 74 | ); 75 | 76 | if (_volumeHandle == null || _volumeHandle.IsInvalid) 77 | throw new IOException( 78 | string.Format( 79 | "Unable to open volume {0}. Make sure it exists and that you have Administrator privileges.", 80 | driveInfo 81 | ) 82 | ); 83 | 84 | using (_volumeHandle) 85 | { 86 | InitializeDiskInfo(); 87 | 88 | _nodes = ProcessMft(); 89 | } 90 | 91 | //cleanup anything that isn't used anymore 92 | _nameIndex = null; 93 | _volumeHandle = null; 94 | 95 | GC.Collect(); 96 | } 97 | 98 | public IDiskInfo DiskInfo 99 | { 100 | get { return _diskInfo; } 101 | } 102 | 103 | /// 104 | /// Get all nodes under the specified rootPath. 105 | /// 106 | /// The rootPath must at least contains the drive and may include any number of subdirectories. Wildcards aren't supported. 107 | public List GetNodes(string rootPath) 108 | { 109 | Stopwatch stopwatch = new Stopwatch(); 110 | stopwatch.Start(); 111 | 112 | List nodes = new List(); 113 | 114 | //TODO use Parallel.Net to process this when it becomes available 115 | UInt32 nodeCount = (UInt32)_nodes.Length; 116 | for (UInt32 i = 0; i < nodeCount; ++i) 117 | if (_nodes[i].NameIndex != 0 && GetNodeFullNameCore(i).StartsWith(rootPath, StringComparison.InvariantCultureIgnoreCase)) 118 | nodes.Add(new NodeWrapper(this, i, _nodes[i])); 119 | 120 | stopwatch.Stop(); 121 | 122 | Trace.WriteLine( 123 | string.Format( 124 | "{0} node{1} have been retrieved in {2} ms", 125 | nodes.Count, 126 | nodes.Count > 1 ? "s" : string.Empty, 127 | (float)stopwatch.ElapsedTicks / TimeSpan.TicksPerMillisecond 128 | ) 129 | ); 130 | 131 | return nodes; 132 | } 133 | 134 | public byte[] GetVolumeBitmap() 135 | { 136 | return _bitmapData; 137 | } 138 | 139 | #region IDisposable Members 140 | 141 | public void Dispose() 142 | { 143 | if (_volumeHandle != null) 144 | { 145 | _volumeHandle.Dispose(); 146 | _volumeHandle = null; 147 | } 148 | } 149 | 150 | #endregion 151 | } 152 | } 153 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/NtfsReader.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | using System.Collections.Generic; 31 | using System.Runtime.InteropServices; 32 | using Microsoft.Win32.SafeHandles; 33 | using System.Diagnostics; 34 | 35 | namespace System.IO.Filesystem.Ntfs 36 | { 37 | public sealed partial class NtfsReader : IDisposable 38 | { 39 | #region Ntfs Structures 40 | 41 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 42 | private unsafe struct BootSector 43 | { 44 | fixed byte AlignmentOrReserved1[3]; 45 | public UInt64 Signature; 46 | public UInt16 BytesPerSector; 47 | public byte SectorsPerCluster; 48 | fixed byte AlignmentOrReserved2[26]; 49 | public UInt64 TotalSectors; 50 | public UInt64 MftStartLcn; 51 | public UInt64 Mft2StartLcn; 52 | public UInt32 ClustersPerMftRecord; 53 | public UInt32 ClustersPerIndexRecord; 54 | } 55 | 56 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 57 | private struct VolumeData 58 | { 59 | public UInt64 VolumeSerialNumber; 60 | public UInt64 NumberSectors; 61 | public UInt64 TotalClusters; 62 | public UInt64 FreeClusters; 63 | public UInt64 TotalReserved; 64 | public UInt32 BytesPerSector; 65 | public UInt32 BytesPerCluster; 66 | public UInt32 BytesPerFileRecordSegment; 67 | public UInt32 ClustersPerFileRecordSegment; 68 | public UInt64 MftValidDataLength; 69 | public UInt64 MftStartLcn; 70 | public UInt64 Mft2StartLcn; 71 | public UInt64 MftZoneStart; 72 | public UInt64 MftZoneEnd; 73 | } 74 | 75 | private enum RecordType : uint 76 | { 77 | File = 0x454c4946, //'FILE' in ASCII 78 | } 79 | 80 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 81 | private struct RecordHeader 82 | { 83 | public RecordType Type; /* File type, for example 'FILE' */ 84 | public UInt16 UsaOffset; /* Offset to the Update Sequence Array */ 85 | public UInt16 UsaCount; /* Size in words of Update Sequence Array */ 86 | public UInt64 Lsn; /* $LogFile Sequence Number (LSN) */ 87 | } 88 | 89 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 90 | private struct INodeReference 91 | { 92 | public UInt32 InodeNumberLowPart; 93 | public UInt16 InodeNumberHighPart; 94 | public UInt16 SequenceNumber; 95 | }; 96 | 97 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 98 | private struct FileRecordHeader 99 | { 100 | public RecordHeader RecordHeader; 101 | public UInt16 SequenceNumber; /* Sequence number */ 102 | public UInt16 LinkCount; /* Hard link count */ 103 | public UInt16 AttributeOffset; /* Offset to the first Attribute */ 104 | public UInt16 Flags; /* Flags. bit 1 = in use, bit 2 = directory, bit 4 & 8 = unknown. */ 105 | public UInt32 BytesInUse; /* Real size of the FILE record */ 106 | public UInt32 BytesAllocated; /* Allocated size of the FILE record */ 107 | public INodeReference BaseFileRecord; /* File reference to the base FILE record */ 108 | public UInt16 NextAttributeNumber; /* Next Attribute Id */ 109 | public UInt16 Padding; /* Align to 4 UCHAR boundary (XP) */ 110 | public UInt32 MFTRecordNumber; /* Number of this MFT Record (XP) */ 111 | public UInt16 UpdateSeqNum; /* */ 112 | }; 113 | 114 | private enum AttributeType : uint 115 | { 116 | AttributeInvalid = 0x00, /* Not defined by Windows */ 117 | AttributeStandardInformation = 0x10, 118 | AttributeAttributeList = 0x20, 119 | AttributeFileName = 0x30, 120 | AttributeObjectId = 0x40, 121 | AttributeSecurityDescriptor = 0x50, 122 | AttributeVolumeName = 0x60, 123 | AttributeVolumeInformation = 0x70, 124 | AttributeData = 0x80, 125 | AttributeIndexRoot = 0x90, 126 | AttributeIndexAllocation = 0xA0, 127 | AttributeBitmap = 0xB0, 128 | AttributeReparsePoint = 0xC0, /* Reparse Point = Symbolic link */ 129 | AttributeEAInformation = 0xD0, 130 | AttributeEA = 0xE0, 131 | AttributePropertySet = 0xF0, 132 | AttributeLoggedUtilityStream = 0x100 133 | }; 134 | 135 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 136 | private struct Attribute 137 | { 138 | public AttributeType AttributeType; 139 | public UInt32 Length; 140 | public byte Nonresident; 141 | public byte NameLength; 142 | public UInt16 NameOffset; 143 | public UInt16 Flags; /* 0x0001 = Compressed, 0x4000 = Encrypted, 0x8000 = Sparse */ 144 | public UInt16 AttributeNumber; 145 | } 146 | 147 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 148 | private unsafe struct AttributeList 149 | { 150 | public AttributeType AttributeType; 151 | public UInt16 Length; 152 | public byte NameLength; 153 | public byte NameOffset; 154 | public UInt64 LowestVcn; 155 | public INodeReference FileReferenceNumber; 156 | public UInt16 Instance; 157 | public fixed UInt16 AlignmentOrReserved[3]; 158 | }; 159 | 160 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 161 | private struct AttributeFileName 162 | { 163 | public INodeReference ParentDirectory; 164 | public UInt64 CreationTime; 165 | public UInt64 ChangeTime; 166 | public UInt64 LastWriteTime; 167 | public UInt64 LastAccessTime; 168 | public UInt64 AllocatedSize; 169 | public UInt64 DataSize; 170 | public UInt32 FileAttributes; 171 | public UInt32 AlignmentOrReserved; 172 | public byte NameLength; 173 | public byte NameType; /* NTFS=0x01, DOS=0x02 */ 174 | public char Name; 175 | }; 176 | 177 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 178 | private struct AttributeStandardInformation 179 | { 180 | public UInt64 CreationTime; 181 | public UInt64 FileChangeTime; 182 | public UInt64 MftChangeTime; 183 | public UInt64 LastAccessTime; 184 | public UInt32 FileAttributes; /* READ_ONLY=0x01, HIDDEN=0x02, SYSTEM=0x04, VOLUME_ID=0x08, ARCHIVE=0x20, DEVICE=0x40 */ 185 | public UInt32 MaximumVersions; 186 | public UInt32 VersionNumber; 187 | public UInt32 ClassId; 188 | public UInt32 OwnerId; // NTFS 3.0 only 189 | public UInt32 SecurityId; // NTFS 3.0 only 190 | public UInt64 QuotaCharge; // NTFS 3.0 only 191 | public UInt64 Usn; // NTFS 3.0 only 192 | }; 193 | 194 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 195 | private struct ResidentAttribute 196 | { 197 | public Attribute Attribute; 198 | public UInt32 ValueLength; 199 | public UInt16 ValueOffset; 200 | public UInt16 Flags; // 0x0001 = Indexed 201 | }; 202 | 203 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 204 | private unsafe struct NonResidentAttribute 205 | { 206 | public Attribute Attribute; 207 | public UInt64 StartingVcn; 208 | public UInt64 LastVcn; 209 | public UInt16 RunArrayOffset; 210 | public byte CompressionUnit; 211 | public fixed byte AlignmentOrReserved[5]; 212 | public UInt64 AllocatedSize; 213 | public UInt64 DataSize; 214 | public UInt64 InitializedSize; 215 | public UInt64 CompressedSize; // Only when compressed 216 | }; 217 | 218 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 219 | private struct Fragment 220 | { 221 | public UInt64 Lcn; // Logical cluster number, location on disk. 222 | public UInt64 NextVcn; // Virtual cluster number of next fragment. 223 | 224 | public Fragment(UInt64 lcn, UInt64 nextVcn) 225 | { 226 | Lcn = lcn; 227 | NextVcn = nextVcn; 228 | } 229 | } 230 | 231 | #endregion 232 | 233 | #region Private Classes 234 | 235 | private sealed class Stream 236 | { 237 | public UInt64 Clusters; // Total number of clusters. 238 | public UInt64 Size; // Total number of bytes. 239 | public AttributeType Type; 240 | public int NameIndex; 241 | public List _fragments; 242 | 243 | public Stream(int nameIndex, AttributeType type, UInt64 size) 244 | { 245 | NameIndex = nameIndex; 246 | Type = type; 247 | Size = size; 248 | } 249 | 250 | public List Fragments 251 | { 252 | get 253 | { 254 | if (_fragments == null) 255 | _fragments = new List(5); 256 | 257 | return _fragments; 258 | } 259 | } 260 | } 261 | 262 | /// 263 | /// Node struct for file and directory entries 264 | /// 265 | /// 266 | /// We keep this as small as possible to reduce footprint for large volume. 267 | /// 268 | private struct Node 269 | { 270 | public Attributes Attributes; 271 | public UInt32 ParentNodeIndex; 272 | public UInt64 Size; 273 | public int NameIndex; 274 | } 275 | 276 | /// 277 | /// Contains extra information not required for basic purposes. 278 | /// 279 | private struct StandardInformation 280 | { 281 | public UInt64 CreationTime; 282 | public UInt64 LastAccessTime; 283 | public UInt64 LastChangeTime; 284 | 285 | public StandardInformation( 286 | UInt64 creationTime, 287 | UInt64 lastAccessTime, 288 | UInt64 lastChangeTime 289 | ) 290 | { 291 | CreationTime = creationTime; 292 | LastAccessTime = lastAccessTime; 293 | LastChangeTime = lastChangeTime; 294 | } 295 | } 296 | 297 | /// 298 | /// Add some functionality to the basic stream 299 | /// 300 | private sealed class FragmentWrapper : IFragment 301 | { 302 | StreamWrapper _owner; 303 | Fragment _fragment; 304 | 305 | public FragmentWrapper(StreamWrapper owner, Fragment fragment) 306 | { 307 | _owner = owner; 308 | _fragment = fragment; 309 | } 310 | 311 | #region IFragment Members 312 | 313 | public ulong Lcn 314 | { 315 | get { return _fragment.Lcn; } 316 | } 317 | 318 | public ulong NextVcn 319 | { 320 | get { return _fragment.NextVcn; } 321 | } 322 | 323 | #endregion 324 | } 325 | 326 | /// 327 | /// Add some functionality to the basic stream 328 | /// 329 | private sealed class StreamWrapper : IStream 330 | { 331 | NtfsReader _reader; 332 | NodeWrapper _parentNode; 333 | int _streamIndex; 334 | 335 | public StreamWrapper(NtfsReader reader, NodeWrapper parentNode, int streamIndex) 336 | { 337 | _reader = reader; 338 | _parentNode = parentNode; 339 | _streamIndex = streamIndex; 340 | } 341 | 342 | #region IStream Members 343 | 344 | public string Name 345 | { 346 | get 347 | { 348 | return _reader.GetNameFromIndex(_reader._streams[_parentNode.NodeIndex][_streamIndex].NameIndex); 349 | } 350 | } 351 | 352 | public UInt64 Size 353 | { 354 | get 355 | { 356 | return _reader._streams[_parentNode.NodeIndex][_streamIndex].Size; 357 | } 358 | } 359 | 360 | public IList Fragments 361 | { 362 | get 363 | { 364 | //if ((_reader._retrieveMode & RetrieveMode.Fragments) != RetrieveMode.Fragments) 365 | // throw new NotSupportedException("The fragments haven't been retrieved. Make sure to use the proper RetrieveMode."); 366 | 367 | IList fragments = 368 | _reader._streams[_parentNode.NodeIndex][_streamIndex].Fragments; 369 | 370 | if (fragments == null || fragments.Count == 0) 371 | return null; 372 | 373 | List newFragments = new List(); 374 | foreach (Fragment fragment in fragments) 375 | newFragments.Add(new FragmentWrapper(this, fragment)); 376 | 377 | return newFragments; 378 | } 379 | } 380 | 381 | #endregion 382 | } 383 | 384 | /// 385 | /// Add some functionality to the basic node 386 | /// 387 | private sealed class NodeWrapper : INode 388 | { 389 | NtfsReader _reader; 390 | UInt32 _nodeIndex; 391 | Node _node; 392 | string _fullName; 393 | 394 | public NodeWrapper(NtfsReader reader, UInt32 nodeIndex, Node node) 395 | { 396 | _reader = reader; 397 | _nodeIndex = nodeIndex; 398 | _node = node; 399 | } 400 | 401 | public UInt32 NodeIndex 402 | { 403 | get { return _nodeIndex; } 404 | } 405 | 406 | public UInt32 ParentNodeIndex 407 | { 408 | get { return _node.ParentNodeIndex; } 409 | } 410 | 411 | public Attributes Attributes 412 | { 413 | get { return _node.Attributes; } 414 | } 415 | 416 | public string Name 417 | { 418 | get { return _reader.GetNameFromIndex(_node.NameIndex); } 419 | } 420 | 421 | public UInt64 Size 422 | { 423 | get { return _node.Size; } 424 | } 425 | 426 | public string FullName 427 | { 428 | get 429 | { 430 | if (_fullName == null) 431 | _fullName = _reader.GetNodeFullNameCore(_nodeIndex); 432 | 433 | return _fullName; 434 | } 435 | } 436 | 437 | public IList Streams 438 | { 439 | get 440 | { 441 | if (_reader._streams == null) 442 | throw new NotSupportedException("The streams haven't been retrieved. Make sure to use the proper RetrieveMode."); 443 | 444 | Stream[] streams = _reader._streams[_nodeIndex]; 445 | if (streams == null) 446 | return null; 447 | 448 | List newStreams = new List(); 449 | for (int i = 0; i < streams.Length; ++i) 450 | newStreams.Add(new StreamWrapper(_reader, this, i)); 451 | 452 | return newStreams; 453 | } 454 | } 455 | 456 | #region INode Members 457 | 458 | public DateTime CreationTime 459 | { 460 | get 461 | { 462 | if (_reader._standardInformations == null) 463 | throw new NotSupportedException("The StandardInformation haven't been retrieved. Make sure to use the proper RetrieveMode."); 464 | 465 | return DateTime.FromFileTimeUtc((Int64)_reader._standardInformations[_nodeIndex].CreationTime); 466 | } 467 | } 468 | 469 | public DateTime LastChangeTime 470 | { 471 | get 472 | { 473 | if (_reader._standardInformations == null) 474 | throw new NotSupportedException("The StandardInformation haven't been retrieved. Make sure to use the proper RetrieveMode."); 475 | 476 | return DateTime.FromFileTimeUtc((Int64)_reader._standardInformations[_nodeIndex].LastChangeTime); 477 | } 478 | } 479 | 480 | public DateTime LastAccessTime 481 | { 482 | get 483 | { 484 | if (_reader._standardInformations == null) 485 | throw new NotSupportedException("The StandardInformation haven't been retrieved. Make sure to use the proper RetrieveMode."); 486 | 487 | return DateTime.FromFileTimeUtc((Int64)_reader._standardInformations[_nodeIndex].LastAccessTime); 488 | } 489 | } 490 | 491 | #endregion 492 | } 493 | 494 | /// 495 | /// Simple structure of available disk informations. 496 | /// 497 | private sealed class DiskInfoWrapper : IDiskInfo 498 | { 499 | public UInt16 BytesPerSector; 500 | public byte SectorsPerCluster; 501 | public UInt64 TotalSectors; 502 | public UInt64 MftStartLcn; 503 | public UInt64 Mft2StartLcn; 504 | public UInt32 ClustersPerMftRecord; 505 | public UInt32 ClustersPerIndexRecord; 506 | public UInt64 BytesPerMftRecord; 507 | public UInt64 BytesPerCluster; 508 | public UInt64 TotalClusters; 509 | 510 | #region IDiskInfo Members 511 | 512 | ushort IDiskInfo.BytesPerSector 513 | { 514 | get { return BytesPerSector; } 515 | } 516 | 517 | byte IDiskInfo.SectorsPerCluster 518 | { 519 | get { return SectorsPerCluster; } 520 | } 521 | 522 | ulong IDiskInfo.TotalSectors 523 | { 524 | get { return TotalSectors; } 525 | } 526 | 527 | ulong IDiskInfo.MftStartLcn 528 | { 529 | get { return MftStartLcn; } 530 | } 531 | 532 | ulong IDiskInfo.Mft2StartLcn 533 | { 534 | get { return Mft2StartLcn; } 535 | } 536 | 537 | uint IDiskInfo.ClustersPerMftRecord 538 | { 539 | get { return ClustersPerMftRecord; } 540 | } 541 | 542 | uint IDiskInfo.ClustersPerIndexRecord 543 | { 544 | get { return ClustersPerIndexRecord; } 545 | } 546 | 547 | ulong IDiskInfo.BytesPerMftRecord 548 | { 549 | get { return BytesPerMftRecord; } 550 | } 551 | 552 | ulong IDiskInfo.BytesPerCluster 553 | { 554 | get { return BytesPerCluster; } 555 | } 556 | 557 | ulong IDiskInfo.TotalClusters 558 | { 559 | get { return TotalClusters; } 560 | } 561 | 562 | #endregion 563 | } 564 | 565 | #endregion 566 | 567 | #region Constants 568 | 569 | private const UInt64 VIRTUALFRAGMENT = 18446744073709551615; // _UI64_MAX - 1 */ 570 | private const UInt32 ROOTDIRECTORY = 5; 571 | 572 | private readonly byte[] BitmapMasks = new byte[] { 1, 2, 4, 8, 16, 32, 64, 128 }; 573 | 574 | #endregion 575 | 576 | SafeFileHandle _volumeHandle; 577 | DiskInfoWrapper _diskInfo; 578 | Node[] _nodes; 579 | StandardInformation[] _standardInformations; 580 | Stream[][] _streams; 581 | DriveInfo _driveInfo; 582 | List _names = new List(); 583 | RetrieveMode _retrieveMode; 584 | byte[] _bitmapData; 585 | 586 | //preallocate a lot of space for the strings to avoid too much dictionary resizing 587 | //use ordinal comparison to improve performance 588 | //this will be deallocated once the MFT reading is finished 589 | Dictionary _nameIndex = new Dictionary(128 * 1024, StringComparer.Ordinal); 590 | 591 | #region Events 592 | 593 | /// 594 | /// Raised once the bitmap data has been read. 595 | /// 596 | public event EventHandler BitmapDataAvailable; 597 | 598 | private void OnBitmapDataAvailable() 599 | { 600 | if (BitmapDataAvailable != null) 601 | BitmapDataAvailable(this, EventArgs.Empty); 602 | } 603 | 604 | #endregion 605 | 606 | #region Helpers 607 | 608 | /// 609 | /// Allocate or retrieve an existing index for the particular string. 610 | /// 611 | /// 612 | /// In order to mimize memory usage, we reuse string as much as possible. 613 | /// 614 | private int GetNameIndex(string name) 615 | { 616 | int existingIndex; 617 | if (_nameIndex.TryGetValue(name, out existingIndex)) 618 | return existingIndex; 619 | 620 | _names.Add(name); 621 | _nameIndex[name] = _names.Count - 1; 622 | 623 | return _names.Count - 1; 624 | } 625 | 626 | /// 627 | /// Get the string from our stringtable from the given index. 628 | /// 629 | private string GetNameFromIndex(int nameIndex) 630 | { 631 | return nameIndex == 0 ? null : _names[nameIndex]; 632 | } 633 | 634 | private Stream SearchStream(List streams, AttributeType streamType) 635 | { 636 | //since the number of stream is usually small, we can afford O(n) 637 | foreach (Stream stream in streams) 638 | if (stream.Type == streamType) 639 | return stream; 640 | 641 | return null; 642 | } 643 | 644 | private Stream SearchStream(List streams, AttributeType streamType, int streamNameIndex) 645 | { 646 | //since the number of stream is usually small, we can afford O(n) 647 | foreach (Stream stream in streams) 648 | if (stream.Type == streamType && 649 | stream.NameIndex == streamNameIndex) 650 | return stream; 651 | 652 | return null; 653 | } 654 | 655 | #endregion 656 | 657 | #region File Reading Wrappers 658 | 659 | private unsafe void ReadFile(byte* buffer, int len, UInt64 absolutePosition) 660 | { 661 | ReadFile(buffer, (UInt64)len, absolutePosition); 662 | } 663 | 664 | private unsafe void ReadFile(byte* buffer, UInt32 len, UInt64 absolutePosition) 665 | { 666 | ReadFile(buffer, (UInt64)len, absolutePosition); 667 | } 668 | 669 | private unsafe void ReadFile(byte* buffer, UInt64 len, UInt64 absolutePosition) 670 | { 671 | NativeOverlapped overlapped = new NativeOverlapped(absolutePosition); 672 | 673 | uint read; 674 | if (!ReadFile(_volumeHandle, (IntPtr)buffer, (uint)len, out read, ref overlapped)) 675 | throw new Exception("Unable to read volume information"); 676 | 677 | if (read != (uint)len) 678 | throw new Exception("Unable to read volume information"); 679 | } 680 | 681 | #endregion 682 | 683 | #region Ntfs Interpretor 684 | 685 | /// 686 | /// Read the next contiguous block of information on disk 687 | /// 688 | private unsafe bool ReadNextChunk( 689 | byte* buffer, 690 | UInt32 bufferSize, 691 | UInt32 nodeIndex, 692 | int fragmentIndex, 693 | Stream dataStream, 694 | ref UInt64 BlockStart, 695 | ref UInt64 BlockEnd, 696 | ref UInt64 Vcn, 697 | ref UInt64 RealVcn 698 | ) 699 | { 700 | BlockStart = nodeIndex; 701 | BlockEnd = BlockStart + bufferSize / _diskInfo.BytesPerMftRecord; 702 | if (BlockEnd > dataStream.Size * 8) 703 | BlockEnd = dataStream.Size * 8; 704 | 705 | UInt64 u1 = 0; 706 | 707 | int fragmentCount = dataStream.Fragments.Count; 708 | while (fragmentIndex < fragmentCount) 709 | { 710 | Fragment fragment = dataStream.Fragments[fragmentIndex]; 711 | 712 | /* Calculate Inode at the end of the fragment. */ 713 | u1 = (RealVcn + fragment.NextVcn - Vcn) * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster / _diskInfo.BytesPerMftRecord; 714 | 715 | if (u1 > nodeIndex) 716 | break; 717 | 718 | do 719 | { 720 | if (fragment.Lcn != VIRTUALFRAGMENT) 721 | RealVcn = RealVcn + fragment.NextVcn - Vcn; 722 | 723 | Vcn = fragment.NextVcn; 724 | 725 | if (++fragmentIndex >= fragmentCount) 726 | break; 727 | 728 | } while (fragment.Lcn == VIRTUALFRAGMENT); 729 | } 730 | 731 | if (fragmentIndex >= fragmentCount) 732 | return false; 733 | 734 | if (BlockEnd >= u1) 735 | BlockEnd = u1; 736 | 737 | ulong position = 738 | (dataStream.Fragments[fragmentIndex].Lcn - RealVcn) * _diskInfo.BytesPerSector * 739 | _diskInfo.SectorsPerCluster + BlockStart * _diskInfo.BytesPerMftRecord; 740 | 741 | ReadFile(buffer, (BlockEnd - BlockStart) * _diskInfo.BytesPerMftRecord, position); 742 | 743 | return true; 744 | } 745 | 746 | /// 747 | /// Gather basic disk information we need to interpret data 748 | /// 749 | private unsafe void InitializeDiskInfo() 750 | { 751 | byte[] volumeData = new byte[512]; 752 | 753 | fixed (byte* ptr = volumeData) 754 | { 755 | ReadFile(ptr, volumeData.Length, 0); 756 | 757 | BootSector* bootSector = (BootSector*)ptr; 758 | 759 | if (bootSector->Signature != 0x202020205346544E) 760 | throw new Exception("This is not an NTFS disk."); 761 | 762 | DiskInfoWrapper diskInfo = new DiskInfoWrapper(); 763 | diskInfo.BytesPerSector = bootSector->BytesPerSector; 764 | diskInfo.SectorsPerCluster = bootSector->SectorsPerCluster; 765 | diskInfo.TotalSectors = bootSector->TotalSectors; 766 | diskInfo.MftStartLcn = bootSector->MftStartLcn; 767 | diskInfo.Mft2StartLcn = bootSector->Mft2StartLcn; 768 | diskInfo.ClustersPerMftRecord = bootSector->ClustersPerMftRecord; 769 | diskInfo.ClustersPerIndexRecord = bootSector->ClustersPerIndexRecord; 770 | 771 | if (bootSector->ClustersPerMftRecord >= 128) 772 | diskInfo.BytesPerMftRecord = ((ulong)1 << (byte)(256 - (byte)bootSector->ClustersPerMftRecord)); 773 | else 774 | diskInfo.BytesPerMftRecord = diskInfo.ClustersPerMftRecord * diskInfo.BytesPerSector * diskInfo.SectorsPerCluster; 775 | 776 | diskInfo.BytesPerCluster = (UInt64)diskInfo.BytesPerSector * (UInt64)diskInfo.SectorsPerCluster; 777 | 778 | if (diskInfo.SectorsPerCluster > 0) 779 | diskInfo.TotalClusters = diskInfo.TotalSectors / diskInfo.SectorsPerCluster; 780 | 781 | _diskInfo = diskInfo; 782 | } 783 | } 784 | 785 | /// 786 | /// Used to check/adjust data before we begin to interpret it 787 | /// 788 | private unsafe void FixupRawMftdata(byte* buffer, UInt64 len) 789 | { 790 | FileRecordHeader* ntfsFileRecordHeader = (FileRecordHeader*)buffer; 791 | 792 | if (ntfsFileRecordHeader->RecordHeader.Type != RecordType.File) 793 | return; 794 | 795 | UInt16* wordBuffer = (UInt16*)buffer; 796 | 797 | UInt16* UpdateSequenceArray = (UInt16*)(buffer + ntfsFileRecordHeader->RecordHeader.UsaOffset); 798 | UInt32 increment = (UInt32)_diskInfo.BytesPerSector / sizeof(UInt16); 799 | 800 | UInt32 Index = increment - 1; 801 | 802 | for (int i = 1; i < ntfsFileRecordHeader->RecordHeader.UsaCount; i++) 803 | { 804 | /* Check if we are inside the buffer. */ 805 | if (Index * sizeof(UInt16) >= len) 806 | throw new Exception("USA data indicates that data is missing, the MFT may be corrupt."); 807 | 808 | // Check if the last 2 bytes of the sector contain the Update Sequence Number. 809 | if (wordBuffer[Index] != UpdateSequenceArray[0]) 810 | throw new Exception("USA fixup word is not equal to the Update Sequence Number, the MFT may be corrupt."); 811 | 812 | /* Replace the last 2 bytes in the sector with the value from the Usa array. */ 813 | wordBuffer[Index] = UpdateSequenceArray[i]; 814 | Index = Index + increment; 815 | } 816 | } 817 | 818 | /// 819 | /// Decode the RunLength value. 820 | /// 821 | private static unsafe Int64 ProcessRunLength(byte* runData, UInt32 runDataLength, Int32 runLengthSize, ref UInt32 index) 822 | { 823 | Int64 runLength = 0; 824 | byte* runLengthBytes = (byte*)&runLength; 825 | for (int i = 0; i < runLengthSize; i++) 826 | { 827 | runLengthBytes[i] = runData[index]; 828 | if (++index >= runDataLength) 829 | throw new Exception("Datarun is longer than buffer, the MFT may be corrupt."); 830 | } 831 | return runLength; 832 | } 833 | 834 | /// 835 | /// Decode the RunOffset value. 836 | /// 837 | private static unsafe Int64 ProcessRunOffset(byte* runData, UInt32 runDataLength, Int32 runOffsetSize, ref UInt32 index) 838 | { 839 | Int64 runOffset = 0; 840 | byte* runOffsetBytes = (byte*)&runOffset; 841 | 842 | int i; 843 | for (i = 0; i < runOffsetSize; i++) 844 | { 845 | runOffsetBytes[i] = runData[index]; 846 | if (++index >= runDataLength) 847 | throw new Exception("Datarun is longer than buffer, the MFT may be corrupt."); 848 | } 849 | 850 | //process negative values 851 | if (runOffsetBytes[i - 1] >= 0x80) 852 | while (i < 8) 853 | runOffsetBytes[i++] = 0xFF; 854 | 855 | return runOffset; 856 | } 857 | 858 | /// 859 | /// Read the data that is specified in a RunData list from disk into memory, 860 | /// skipping the first Offset bytes. 861 | /// 862 | private unsafe byte[] ProcessNonResidentData( 863 | byte* RunData, 864 | UInt32 RunDataLength, 865 | UInt64 Offset, /* Bytes to skip from begin of data. */ 866 | UInt64 WantedLength /* Number of bytes to read. */ 867 | ) 868 | { 869 | /* Sanity check. */ 870 | if (RunData == null || RunDataLength == 0) 871 | throw new Exception("nothing to read"); 872 | 873 | if (WantedLength >= UInt32.MaxValue) 874 | throw new Exception("too many bytes to read"); 875 | 876 | /* We have to round up the WantedLength to the nearest sector. For some 877 | reason or other Microsoft has decided that raw reading from disk can 878 | only be done by whole sector, even though ReadFile() accepts it's 879 | parameters in bytes. */ 880 | if (WantedLength % _diskInfo.BytesPerSector > 0) 881 | WantedLength += _diskInfo.BytesPerSector - (WantedLength % _diskInfo.BytesPerSector); 882 | 883 | /* Walk through the RunData and read the requested data from disk. */ 884 | UInt32 Index = 0; 885 | Int64 Lcn = 0; 886 | Int64 Vcn = 0; 887 | 888 | byte[] buffer = new byte[WantedLength]; 889 | 890 | fixed (byte* bufPtr = buffer) 891 | { 892 | while (RunData[Index] != 0) 893 | { 894 | /* Decode the RunData and calculate the next Lcn. */ 895 | Int32 RunLengthSize = (RunData[Index] & 0x0F); 896 | Int32 RunOffsetSize = ((RunData[Index] & 0xF0) >> 4); 897 | 898 | if (++Index >= RunDataLength) 899 | throw new Exception("Error: datarun is longer than buffer, the MFT may be corrupt."); 900 | 901 | Int64 RunLength = 902 | ProcessRunLength(RunData, RunDataLength, RunLengthSize, ref Index); 903 | 904 | Int64 RunOffset = 905 | ProcessRunOffset(RunData, RunDataLength, RunOffsetSize, ref Index); 906 | 907 | // Ignore virtual extents. 908 | if (RunOffset == 0 || RunLength == 0) 909 | continue; 910 | 911 | Lcn += RunOffset; 912 | Vcn += RunLength; 913 | 914 | /* Determine how many and which bytes we want to read. If we don't need 915 | any bytes from this extent then loop. */ 916 | UInt64 ExtentVcn = (UInt64)((Vcn - RunLength) * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster); 917 | UInt64 ExtentLcn = (UInt64)(Lcn * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster); 918 | UInt64 ExtentLength = (UInt64)(RunLength * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster); 919 | 920 | if (Offset >= ExtentVcn + ExtentLength) 921 | continue; 922 | 923 | if (Offset > ExtentVcn) 924 | { 925 | ExtentLcn = ExtentLcn + Offset - ExtentVcn; 926 | ExtentLength = ExtentLength - (Offset - ExtentVcn); 927 | ExtentVcn = Offset; 928 | } 929 | 930 | if (Offset + WantedLength <= ExtentVcn) 931 | continue; 932 | 933 | if (Offset + WantedLength < ExtentVcn + ExtentLength) 934 | ExtentLength = Offset + WantedLength - ExtentVcn; 935 | 936 | if (ExtentLength == 0) 937 | continue; 938 | 939 | ReadFile(bufPtr + ExtentVcn - Offset, ExtentLength, ExtentLcn); 940 | } 941 | } 942 | 943 | return buffer; 944 | } 945 | 946 | /// 947 | /// Process each attributes and gather information when necessary 948 | /// 949 | private unsafe void ProcessAttributes(ref Node node, UInt32 nodeIndex, byte* ptr, UInt64 BufLength, UInt16 instance, int depth, List streams, bool isMftNode) 950 | { 951 | Attribute* attribute = null; 952 | for (uint AttributeOffset = 0; AttributeOffset < BufLength; AttributeOffset = AttributeOffset + attribute->Length) 953 | { 954 | attribute = (Attribute*)(ptr + AttributeOffset); 955 | 956 | // exit the loop if end-marker. 957 | if ((AttributeOffset + 4 <= BufLength) && 958 | (*(UInt32*)attribute == 0xFFFFFFFF)) 959 | break; 960 | 961 | //make sure we did read the data correctly 962 | if ((AttributeOffset + 4 > BufLength) || attribute->Length < 3 || 963 | (AttributeOffset + attribute->Length > BufLength)) 964 | throw new Exception("Error: attribute in Inode %I64u is bigger than the data, the MFT may be corrupt."); 965 | 966 | //attributes list needs to be processed at the end 967 | if (attribute->AttributeType == AttributeType.AttributeAttributeList) 968 | continue; 969 | 970 | /* If the Instance does not equal the AttributeNumber then ignore the attribute. 971 | This is used when an AttributeList is being processed and we only want a specific 972 | instance. */ 973 | if ((instance != 65535) && (instance != attribute->AttributeNumber)) 974 | continue; 975 | 976 | if (attribute->Nonresident == 0) 977 | { 978 | ResidentAttribute* residentAttribute = (ResidentAttribute*)attribute; 979 | 980 | switch (attribute->AttributeType) 981 | { 982 | case AttributeType.AttributeFileName: 983 | AttributeFileName* attributeFileName = (AttributeFileName*)(ptr + AttributeOffset + residentAttribute->ValueOffset); 984 | 985 | if (attributeFileName->ParentDirectory.InodeNumberHighPart > 0) 986 | throw new NotSupportedException("48 bits inode are not supported to reduce memory footprint."); 987 | 988 | //node.ParentNodeIndex = ((UInt64)attributeFileName->ParentDirectory.InodeNumberHighPart << 32) + attributeFileName->ParentDirectory.InodeNumberLowPart; 989 | node.ParentNodeIndex = attributeFileName->ParentDirectory.InodeNumberLowPart; 990 | 991 | if (attributeFileName->NameType == 1 || node.NameIndex == 0) 992 | node.NameIndex = GetNameIndex(new string(&attributeFileName->Name, 0, attributeFileName->NameLength)); 993 | 994 | break; 995 | 996 | case AttributeType.AttributeStandardInformation: 997 | AttributeStandardInformation* attributeStandardInformation = (AttributeStandardInformation*)(ptr + AttributeOffset + residentAttribute->ValueOffset); 998 | 999 | node.Attributes |= (Attributes)attributeStandardInformation->FileAttributes; 1000 | 1001 | if ((_retrieveMode & RetrieveMode.StandardInformations) == RetrieveMode.StandardInformations) 1002 | _standardInformations[nodeIndex] = 1003 | new StandardInformation( 1004 | attributeStandardInformation->CreationTime, 1005 | attributeStandardInformation->FileChangeTime, 1006 | attributeStandardInformation->LastAccessTime 1007 | ); 1008 | 1009 | break; 1010 | 1011 | case AttributeType.AttributeData: 1012 | node.Size = residentAttribute->ValueLength; 1013 | break; 1014 | } 1015 | } 1016 | else 1017 | { 1018 | NonResidentAttribute* nonResidentAttribute = (NonResidentAttribute*)attribute; 1019 | 1020 | //save the length (number of bytes) of the data. 1021 | if (attribute->AttributeType == AttributeType.AttributeData && node.Size == 0) 1022 | node.Size = nonResidentAttribute->DataSize; 1023 | 1024 | if (streams != null) 1025 | { 1026 | //extract the stream name 1027 | int streamNameIndex = 0; 1028 | if (attribute->NameLength > 0) 1029 | streamNameIndex = GetNameIndex(new string((char*)(ptr + AttributeOffset + attribute->NameOffset), 0, (int)attribute->NameLength)); 1030 | 1031 | //find or create the stream 1032 | Stream stream = 1033 | SearchStream(streams, attribute->AttributeType, streamNameIndex); 1034 | 1035 | if (stream == null) 1036 | { 1037 | stream = new Stream(streamNameIndex, attribute->AttributeType, nonResidentAttribute->DataSize); 1038 | streams.Add(stream); 1039 | } 1040 | else if (stream.Size == 0) 1041 | stream.Size = nonResidentAttribute->DataSize; 1042 | 1043 | //we need the fragment of the MFTNode so retrieve them this time 1044 | //even if fragments aren't normally read 1045 | if (isMftNode || (_retrieveMode & RetrieveMode.Fragments) == RetrieveMode.Fragments) 1046 | ProcessFragments( 1047 | ref node, 1048 | stream, 1049 | ptr + AttributeOffset + nonResidentAttribute->RunArrayOffset, 1050 | attribute->Length - nonResidentAttribute->RunArrayOffset, 1051 | nonResidentAttribute->StartingVcn 1052 | ); 1053 | } 1054 | } 1055 | } 1056 | 1057 | //for (uint AttributeOffset = 0; AttributeOffset < BufLength; AttributeOffset = AttributeOffset + attribute->Length) 1058 | //{ 1059 | // attribute = (Attribute*)&ptr[AttributeOffset]; 1060 | 1061 | // if (*(UInt32*)attribute == 0xFFFFFFFF) 1062 | // break; 1063 | 1064 | // if (attribute->AttributeType != AttributeType.AttributeAttributeList) 1065 | // continue; 1066 | 1067 | // if (attribute->Nonresident == 0) 1068 | // { 1069 | // ResidentAttribute* residentAttribute = (ResidentAttribute*)attribute; 1070 | 1071 | // ProcessAttributeList( 1072 | // node, 1073 | // ptr + AttributeOffset + residentAttribute->ValueOffset, 1074 | // residentAttribute->ValueLength, 1075 | // depth 1076 | // ); 1077 | // } 1078 | // else 1079 | // { 1080 | // NonResidentAttribute* nonResidentAttribute = (NonResidentAttribute*)attribute; 1081 | 1082 | // byte[] buffer = 1083 | // ProcessNonResidentData( 1084 | // ptr + AttributeOffset + nonResidentAttribute->RunArrayOffset, 1085 | // attribute->Length - nonResidentAttribute->RunArrayOffset, 1086 | // 0, 1087 | // nonResidentAttribute->DataSize 1088 | // ); 1089 | 1090 | // fixed (byte* bufPtr = buffer) 1091 | // ProcessAttributeList(node, bufPtr, nonResidentAttribute->DataSize, depth + 1); 1092 | // } 1093 | //} 1094 | 1095 | if (streams != null && streams.Count > 0) 1096 | node.Size = streams[0].Size; 1097 | } 1098 | 1099 | //private unsafe void ProcessAttributeList(Node mftNode, Node node, byte* ptr, UInt64 bufLength, int depth, InterpretMode interpretMode) 1100 | //{ 1101 | // if (ptr == null || bufLength == 0) 1102 | // return; 1103 | 1104 | // if (depth > 1000) 1105 | // throw new Exception("Error: infinite attribute loop, the MFT may be corrupt."); 1106 | 1107 | // AttributeList* attribute = null; 1108 | // for (uint AttributeOffset = 0; AttributeOffset < bufLength; AttributeOffset = AttributeOffset + attribute->Length) 1109 | // { 1110 | // attribute = (AttributeList*)&ptr[AttributeOffset]; 1111 | 1112 | // /* Exit if no more attributes. AttributeLists are usually not closed by the 1113 | // 0xFFFFFFFF endmarker. Reaching the end of the buffer is therefore normal and 1114 | // not an error. */ 1115 | // if (AttributeOffset + 3 > bufLength) break; 1116 | // if (*(UInt32*)attribute == 0xFFFFFFFF) break; 1117 | // if (attribute->Length < 3) break; 1118 | // if (AttributeOffset + attribute->Length > bufLength) break; 1119 | 1120 | // /* Extract the referenced Inode. If it's the same as the calling Inode then ignore 1121 | // (if we don't ignore then the program will loop forever, because for some 1122 | // reason the info in the calling Inode is duplicated here...). */ 1123 | // UInt64 RefInode = ((UInt64)attribute->FileReferenceNumber.InodeNumberHighPart << 32) + attribute->FileReferenceNumber.InodeNumberLowPart; 1124 | // if (RefInode == node.NodeIndex) 1125 | // continue; 1126 | 1127 | // /* Extract the streamname. I don't know why AttributeLists can have names, and 1128 | // the name is not used further down. It is only extracted for debugging purposes. 1129 | // */ 1130 | // string streamName; 1131 | // if (attribute->NameLength > 0) 1132 | // streamName = new string((char*)((UInt64)ptr + AttributeOffset + attribute->NameOffset), 0, attribute->NameLength); 1133 | 1134 | // /* Find the fragment in the MFT that contains the referenced Inode. */ 1135 | // UInt64 Vcn = 0; 1136 | // UInt64 RealVcn = 0; 1137 | // UInt64 RefInodeVcn = (RefInode * _diskInfo.BytesPerMftRecord) / (UInt64)(_diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster); 1138 | 1139 | // Stream dataStream = null; 1140 | // foreach (Stream stream in mftNode.Streams) 1141 | // if (stream.Type == AttributeType.AttributeData) 1142 | // { 1143 | // dataStream = stream; 1144 | // break; 1145 | // } 1146 | 1147 | // Fragment? fragment = null; 1148 | // for (int i = 0; i < dataStream.Fragments.Count; ++i) 1149 | // { 1150 | // fragment = dataStream.Fragments[i]; 1151 | 1152 | // if (fragment.Value.Lcn != VIRTUALFRAGMENT) 1153 | // { 1154 | // if ((RefInodeVcn >= RealVcn) && (RefInodeVcn < RealVcn + fragment.Value.NextVcn - Vcn)) 1155 | // break; 1156 | 1157 | // RealVcn = RealVcn + fragment.Value.NextVcn - Vcn; 1158 | // } 1159 | 1160 | // Vcn = fragment.Value.NextVcn; 1161 | // } 1162 | 1163 | // if (fragment == null) 1164 | // throw new Exception("Error: Inode %I64u is an extension of Inode %I64u, but does not exist (outside the MFT)."); 1165 | 1166 | // /* Fetch the record of the referenced Inode from disk. */ 1167 | // byte[] buffer = new byte[_diskInfo.BytesPerMftRecord]; 1168 | 1169 | // NativeOverlapped overlapped = 1170 | // new NativeOverlapped( 1171 | // fragment.Value.Lcn - RealVcn * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster + RefInode * _diskInfo.BytesPerMftRecord 1172 | // ); 1173 | 1174 | // fixed (byte* bufPtr = buffer) 1175 | // { 1176 | // uint read; 1177 | // bool result = 1178 | // ReadFile( 1179 | // _volumeHandle, 1180 | // (IntPtr)bufPtr, 1181 | // (UInt32)_diskInfo.BytesPerMftRecord, 1182 | // out read, 1183 | // ref overlapped 1184 | // ); 1185 | 1186 | // if (!result) 1187 | // throw new Exception("error reading disk"); 1188 | 1189 | // /* Fixup the raw data. */ 1190 | // FixupRawMftdata(bufPtr, _diskInfo.BytesPerMftRecord); 1191 | 1192 | // /* If the Inode is not in use then skip. */ 1193 | // FileRecordHeader* fileRecordHeader = (FileRecordHeader*)bufPtr; 1194 | // if ((fileRecordHeader->Flags & 1) != 1) 1195 | // continue; 1196 | 1197 | // ///* If the BaseInode inside the Inode is not the same as the calling Inode then 1198 | // // skip. */ 1199 | // UInt64 baseInode = ((UInt64)fileRecordHeader->BaseFileRecord.InodeNumberHighPart << 32) + fileRecordHeader->BaseFileRecord.InodeNumberLowPart; 1200 | // if (node.NodeIndex != baseInode) 1201 | // continue; 1202 | 1203 | // ///* Process the list of attributes in the Inode, by recursively calling the 1204 | // // ProcessAttributes() subroutine. */ 1205 | // ProcessAttributes( 1206 | // node, 1207 | // bufPtr + fileRecordHeader->AttributeOffset, 1208 | // _diskInfo.BytesPerMftRecord - fileRecordHeader->AttributeOffset, 1209 | // attribute->Instance, 1210 | // depth + 1 1211 | // ); 1212 | // } 1213 | // } 1214 | //} 1215 | 1216 | /// 1217 | /// Process fragments for streams 1218 | /// 1219 | private unsafe void ProcessFragments( 1220 | ref Node node, 1221 | Stream stream, 1222 | byte* runData, 1223 | UInt32 runDataLength, 1224 | UInt64 StartingVcn) 1225 | { 1226 | if (runData == null) 1227 | return; 1228 | 1229 | /* Walk through the RunData and add the extents. */ 1230 | uint index = 0; 1231 | Int64 lcn = 0; 1232 | Int64 vcn = (Int64)StartingVcn; 1233 | int runOffsetSize = 0; 1234 | int runLengthSize = 0; 1235 | 1236 | while (runData[index] != 0) 1237 | { 1238 | /* Decode the RunData and calculate the next Lcn. */ 1239 | runLengthSize = (runData[index] & 0x0F); 1240 | runOffsetSize = ((runData[index] & 0xF0) >> 4); 1241 | 1242 | if (++index >= runDataLength) 1243 | throw new Exception("Error: datarun is longer than buffer, the MFT may be corrupt."); 1244 | 1245 | Int64 runLength = 1246 | ProcessRunLength(runData, runDataLength, runLengthSize, ref index); 1247 | 1248 | Int64 runOffset = 1249 | ProcessRunOffset(runData, runDataLength, runOffsetSize, ref index); 1250 | 1251 | lcn += runOffset; 1252 | vcn += runLength; 1253 | 1254 | /* Add the size of the fragment to the total number of clusters. 1255 | There are two kinds of fragments: real and virtual. The latter do not 1256 | occupy clusters on disk, but are information used by compressed 1257 | and sparse files. */ 1258 | if (runOffset != 0) 1259 | stream.Clusters += (UInt64)runLength; 1260 | 1261 | stream.Fragments.Add( 1262 | new Fragment( 1263 | runOffset == 0 ? VIRTUALFRAGMENT : (UInt64)lcn, 1264 | (UInt64)vcn 1265 | ) 1266 | ); 1267 | } 1268 | } 1269 | 1270 | /// 1271 | /// Process an actual MFT record from the buffer 1272 | /// 1273 | private unsafe bool ProcessMftRecord(byte* buffer, UInt64 length, UInt32 nodeIndex, out Node node, List streams, bool isMftNode) 1274 | { 1275 | node = new Node(); 1276 | 1277 | FileRecordHeader* ntfsFileRecordHeader = (FileRecordHeader*)buffer; 1278 | 1279 | if (ntfsFileRecordHeader->RecordHeader.Type != RecordType.File) 1280 | return false; 1281 | 1282 | //the inode is not in use 1283 | if ((ntfsFileRecordHeader->Flags & 1) != 1) 1284 | return false; 1285 | 1286 | UInt64 baseInode = ((UInt64)ntfsFileRecordHeader->BaseFileRecord.InodeNumberHighPart << 32) + ntfsFileRecordHeader->BaseFileRecord.InodeNumberLowPart; 1287 | 1288 | //This is an inode extension used in an AttributeAttributeList of another inode, don't parse it 1289 | if (baseInode != 0) 1290 | return false; 1291 | 1292 | if (ntfsFileRecordHeader->AttributeOffset >= length) 1293 | throw new Exception("Error: attributes in Inode %I64u are outside the FILE record, the MFT may be corrupt."); 1294 | 1295 | if (ntfsFileRecordHeader->BytesInUse > length) 1296 | throw new Exception("Error: in Inode %I64u the record is bigger than the size of the buffer, the MFT may be corrupt."); 1297 | 1298 | //make the file appear in the rootdirectory by default 1299 | node.ParentNodeIndex = ROOTDIRECTORY; 1300 | 1301 | if ((ntfsFileRecordHeader->Flags & 2) == 2) 1302 | node.Attributes |= Attributes.Directory; 1303 | 1304 | ProcessAttributes(ref node, nodeIndex, buffer + ntfsFileRecordHeader->AttributeOffset, length - ntfsFileRecordHeader->AttributeOffset, 65535, 0, streams, isMftNode); 1305 | 1306 | return true; 1307 | } 1308 | 1309 | /// 1310 | /// Process the bitmap data that contains information on inode usage. 1311 | /// 1312 | private unsafe byte[] ProcessBitmapData(List streams) 1313 | { 1314 | UInt64 Vcn = 0; 1315 | UInt64 MaxMftBitmapBytes = 0; 1316 | 1317 | Stream bitmapStream = SearchStream(streams, AttributeType.AttributeBitmap); 1318 | if (bitmapStream == null) 1319 | throw new Exception("No Bitmap Data"); 1320 | 1321 | foreach (Fragment fragment in bitmapStream.Fragments) 1322 | { 1323 | if (fragment.Lcn != VIRTUALFRAGMENT) 1324 | MaxMftBitmapBytes += (fragment.NextVcn - Vcn) * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster; 1325 | 1326 | Vcn = fragment.NextVcn; 1327 | } 1328 | 1329 | byte[] bitmapData = new byte[MaxMftBitmapBytes]; 1330 | 1331 | fixed (byte* bitmapDataPtr = bitmapData) 1332 | { 1333 | Vcn = 0; 1334 | UInt64 RealVcn = 0; 1335 | 1336 | foreach (Fragment fragment in bitmapStream.Fragments) 1337 | { 1338 | if (fragment.Lcn != VIRTUALFRAGMENT) 1339 | { 1340 | ReadFile( 1341 | bitmapDataPtr + RealVcn * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster, 1342 | (fragment.NextVcn - Vcn) * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster, 1343 | fragment.Lcn * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster 1344 | ); 1345 | 1346 | RealVcn = RealVcn + fragment.NextVcn - Vcn; 1347 | } 1348 | 1349 | Vcn = fragment.NextVcn; 1350 | } 1351 | } 1352 | 1353 | return bitmapData; 1354 | } 1355 | 1356 | /// 1357 | /// Begin the process of interpreting MFT data 1358 | /// 1359 | private unsafe Node[] ProcessMft() 1360 | { 1361 | //64 KB seems to be optimal for Windows XP, Vista is happier with 256KB... 1362 | uint bufferSize = 1363 | (Environment.OSVersion.Version.Major >= 6 ? 256u : 64u) * 1024; 1364 | 1365 | byte[] data = new byte[bufferSize]; 1366 | 1367 | fixed (byte* buffer = data) 1368 | { 1369 | //Read the $MFT record from disk into memory, which is always the first record in the MFT. 1370 | ReadFile(buffer, _diskInfo.BytesPerMftRecord, _diskInfo.MftStartLcn * _diskInfo.BytesPerSector * _diskInfo.SectorsPerCluster); 1371 | 1372 | //Fixup the raw data from disk. This will also test if it's a valid $MFT record. 1373 | FixupRawMftdata(buffer, _diskInfo.BytesPerMftRecord); 1374 | 1375 | List mftStreams = new List(); 1376 | 1377 | if ((_retrieveMode & RetrieveMode.StandardInformations) == RetrieveMode.StandardInformations) 1378 | _standardInformations = new StandardInformation[1]; //allocate some space for $MFT record 1379 | 1380 | Node mftNode; 1381 | if (!ProcessMftRecord(buffer, _diskInfo.BytesPerMftRecord, 0, out mftNode, mftStreams, true)) 1382 | throw new Exception("Can't interpret Mft Record"); 1383 | 1384 | //the bitmap data contains all used inodes on the disk 1385 | _bitmapData = 1386 | ProcessBitmapData(mftStreams); 1387 | 1388 | OnBitmapDataAvailable(); 1389 | 1390 | Stream dataStream = SearchStream(mftStreams, AttributeType.AttributeData); 1391 | 1392 | UInt32 maxInode = (UInt32)_bitmapData.Length * 8; 1393 | if (maxInode > (UInt32)(dataStream.Size / _diskInfo.BytesPerMftRecord)) 1394 | maxInode = (UInt32)(dataStream.Size / _diskInfo.BytesPerMftRecord); 1395 | 1396 | Node[] nodes = new Node[maxInode]; 1397 | nodes[0] = mftNode; 1398 | 1399 | if ((_retrieveMode & RetrieveMode.StandardInformations) == RetrieveMode.StandardInformations) 1400 | { 1401 | StandardInformation mftRecordInformation = _standardInformations[0]; 1402 | _standardInformations = new StandardInformation[maxInode]; 1403 | _standardInformations[0] = mftRecordInformation; 1404 | } 1405 | 1406 | if ((_retrieveMode & RetrieveMode.Streams) == RetrieveMode.Streams) 1407 | _streams = new Stream[maxInode][]; 1408 | 1409 | /* Read and process all the records in the MFT. The records are read into a 1410 | buffer and then given one by one to the InterpretMftRecord() subroutine. */ 1411 | 1412 | UInt64 BlockStart = 0, BlockEnd = 0; 1413 | UInt64 RealVcn = 0, Vcn = 0; 1414 | 1415 | Stopwatch stopwatch = new Stopwatch(); 1416 | stopwatch.Start(); 1417 | 1418 | ulong totalBytesRead = 0; 1419 | int fragmentIndex = 0; 1420 | int fragmentCount = dataStream.Fragments.Count; 1421 | for (UInt32 nodeIndex = 1; nodeIndex < maxInode; nodeIndex++) 1422 | { 1423 | // Ignore the Inode if the bitmap says it's not in use. 1424 | if ((_bitmapData[nodeIndex >> 3] & BitmapMasks[nodeIndex % 8]) == 0) 1425 | continue; 1426 | 1427 | if (nodeIndex >= BlockEnd) 1428 | { 1429 | if (!ReadNextChunk( 1430 | buffer, 1431 | bufferSize, 1432 | nodeIndex, 1433 | fragmentIndex, 1434 | dataStream, 1435 | ref BlockStart, 1436 | ref BlockEnd, 1437 | ref Vcn, 1438 | ref RealVcn)) 1439 | break; 1440 | 1441 | totalBytesRead += (BlockEnd - BlockStart) * _diskInfo.BytesPerMftRecord; 1442 | } 1443 | 1444 | FixupRawMftdata( 1445 | buffer + (nodeIndex - BlockStart) * _diskInfo.BytesPerMftRecord, 1446 | _diskInfo.BytesPerMftRecord 1447 | ); 1448 | 1449 | List streams = null; 1450 | if ((_retrieveMode & RetrieveMode.Streams) == RetrieveMode.Streams) 1451 | streams = new List(); 1452 | 1453 | Node newNode; 1454 | if (!ProcessMftRecord( 1455 | buffer + (nodeIndex - BlockStart) * _diskInfo.BytesPerMftRecord, 1456 | _diskInfo.BytesPerMftRecord, 1457 | nodeIndex, 1458 | out newNode, 1459 | streams, 1460 | false)) 1461 | continue; 1462 | 1463 | nodes[nodeIndex] = newNode; 1464 | 1465 | if (streams != null) 1466 | _streams[nodeIndex] = streams.ToArray(); 1467 | } 1468 | 1469 | stopwatch.Stop(); 1470 | 1471 | Trace.WriteLine( 1472 | string.Format( 1473 | "{0:F3} MB of volume metadata has been read in {1:F3} s at {2:F3} MB/s", 1474 | (float)totalBytesRead / (1024*1024), 1475 | (float)stopwatch.Elapsed.TotalSeconds, 1476 | ((float)totalBytesRead / (1024*1024)) / stopwatch.Elapsed.TotalSeconds 1477 | ) 1478 | ); 1479 | 1480 | return nodes; 1481 | } 1482 | } 1483 | 1484 | #endregion 1485 | } 1486 | } 1487 | -------------------------------------------------------------------------------- /src/NtfsReader/System/IO/Filesystem/Ntfs/RetrieveMode.cs: -------------------------------------------------------------------------------- 1 | /* 2 | The NtfsReader library. 3 | 4 | Copyright (C) 2008 Danny Couture 5 | 6 | This library is free software; you can redistribute it and/or 7 | modify it under the terms of the GNU Lesser General Public 8 | License as published by the Free Software Foundation; either 9 | version 2.1 of the License, or (at your option) any later version. 10 | 11 | This library is distributed in the hope that it will be useful, 12 | but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 | Lesser General Public License for more details. 15 | 16 | You should have received a copy of the GNU Lesser General Public 17 | License along with this library; if not, write to the Free Software 18 | Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 | 20 | For the full text of the license see the "License.txt" file. 21 | 22 | This library is based on the work of Jeroen Kessels, Author of JkDefrag. 23 | http://www.kessels.com/Jkdefrag/ 24 | 25 | Special thanks goes to him. 26 | 27 | Danny Couture 28 | Software Architect 29 | */ 30 | namespace System.IO.Filesystem.Ntfs 31 | { 32 | /// 33 | /// Allow one to retrieve only needed information to reduce memory footprint. 34 | /// 35 | [Flags] 36 | public enum RetrieveMode 37 | { 38 | /// 39 | /// Includes the name, size, attributes and hierarchical information only. 40 | /// 41 | Minimal = 0, 42 | 43 | /// 44 | /// Retrieve the lastModified, lastAccessed and creationTime. 45 | /// 46 | StandardInformations = 1, 47 | 48 | /// 49 | /// Retrieve file's streams information. 50 | /// 51 | Streams = 2, 52 | 53 | /// 54 | /// Retrieve file's fragments information. 55 | /// 56 | Fragments = 4, 57 | 58 | /// 59 | /// Retrieve all information available. 60 | /// 61 | All = StandardInformations | Streams | Fragments, 62 | } 63 | } 64 | --------------------------------------------------------------------------------