MFT/Mft.cs
/// <summary>
///     Creates a map for directories and their parent directories.
/// </summary>
/// <param name="fileRecords"></param>
Creates a map for directories and their parent directories.
Creates a map for directories and their parent directories .
private void BuildDirectoryNameMap(IEnumerable<KeyValuePair<string, FileRecord>> fileRecords)
        {
            foreach (var fileRecord in fileRecords)
            {
                if (fileRecord.Value.MftRecordToBaseRecord.MftEntryNumber > 0 &&
                    fileRecord.Value.MftRecordToBaseRecord.MftSequenceNumber > 0)
                {
                    continue;
                }
                if (fileRecord.Value.Attributes.Count == 0)
                {
                    _logger.Debug($"Skipping file record at offset 0x{fileRecord.Value.Offset:X} has no attributes");
                    continue;
                }
                var fileNameRecords = fileRecord.Value.Attributes.Where(t => t.AttributeType == AttributeType.FileName)
                    .ToList();
                foreach (var fileNameRecord in fileNameRecords)
                {
                    var fna = (FileName) fileNameRecord;
                    if (fna.FileInfo.NameType == NameTypes.Dos)
                    {
                        continue;
                    }
                    var key = fileRecord.Value.GetKey();
                    if (_directoryNameMap.ContainsKey(key) == false)
                    {
                        _directoryNameMap.Add(key,
                            new DirectoryNameMapValue(fna.FileInfo.FileName, $"{fna.FileInfo.ParentMftRecord.GetKey()}",
                                fileRecord.Value.IsDeleted()));
                    }
                }
            }
            foreach (var unAssociatedExtensionFileRecord in UnAssociatedExtensionFileRecords)
            {
                foreach (var fileRecord in unAssociatedExtensionFileRecord.Value)
                {
                    var fileNameRecords = fileRecord.Attributes.Where(t => t.AttributeType == AttributeType.FileName)
                        .ToList();
                    foreach (var fileNameRecord in fileNameRecords)
                    {
                        var fna = (FileName) fileNameRecord;
                        if (fna.FileInfo.NameType == NameTypes.Dos)
                        {
                            continue;
                        }
                        var key = fileRecord.GetKey();
                        if (_directoryNameMap.ContainsKey(key) == false)
                        {
                            _directoryNameMap.Add(key,
                                new DirectoryNameMapValue(fna.FileInfo.FileName, $"{fna.FileInfo.ParentMftRecord.GetKey()}",
                                    fileRecord.IsDeleted()));
                        }
                    }
                }
            }
        }
private void BuildDirectoryNameMap ( IEnumerable < KeyValuePair < string , FileRecord > > fileRecords ) { foreach ( var fileRecord in fileRecords ) { if ( fileRecord . Value . MftRecordToBaseRecord . MftEntryNumber > 0 && fileRecord . Value . MftRecordToBaseRecord . MftSequenceNumber > 0 ) { continue ; } if ( fileRecord . Value . Attributes . Count == 0 ) { _logger . Debug ( $" Skipping file record at offset 0x { fileRecord . Value . Offset : }  has no attributes " ) ; continue ; } var fileNameRecords = fileRecord . Value . Attributes . Where ( t => t . AttributeType == AttributeType . FileName ) . ToList ( ) ; foreach ( var fileNameRecord in fileNameRecords ) { var fna = ( FileName ) fileNameRecord ; if ( fna . FileInfo . NameType == NameTypes . Dos ) { continue ; } var key = fileRecord . Value . GetKey ( ) ; if ( _directoryNameMap . ContainsKey ( key ) == false ) { _directoryNameMap . Add ( key , new DirectoryNameMapValue ( fna . FileInfo . FileName , $" { fna . FileInfo . ParentMftRecord . GetKey ( ) } " , fileRecord . Value . IsDeleted ( ) ) ) ; } } } foreach ( var unAssociatedExtensionFileRecord in UnAssociatedExtensionFileRecords ) { foreach ( var fileRecord in unAssociatedExtensionFileRecord . Value ) { var fileNameRecords = fileRecord . Attributes . Where ( t => t . AttributeType == AttributeType . FileName ) . ToList ( ) ; foreach ( var fileNameRecord in fileNameRecords ) { var fna = ( FileName ) fileNameRecord ; if ( fna . FileInfo . NameType == NameTypes . Dos ) { continue ; } var key = fileRecord . GetKey ( ) ; if ( _directoryNameMap . ContainsKey ( key ) == false ) { _directoryNameMap . Add ( key , new DirectoryNameMapValue ( fna . FileInfo . FileName , $" { fna . FileInfo . ParentMftRecord . GetKey ( ) } " , fileRecord . IsDeleted ( ) ) ) ; } } } } }
Creates a map for directories and their parent directories.
Creates a map for directories and their parent directories .
//will get this record via extensionRecord // if (unAssociatedExtensionFileRecord.Value.Attributes.Count == 0) // { //     _logger.Debug($"Skipping file record with entry/seq #{unAssociatedExtensionFileRecord.Key} since it has no attributes"); //     continue; // }
fileRecords
IEnumerable<KeyValuePair<string, FileRecord>>
None