NTFS: NTFSVolume: Added ContentType enum to help identify the content of volume clusters being accessed

Author: TalAloni

DiskAccessLibrary/DiskAccessLibrary.csproj

@@ -85,6 +85,7 @@
     <Compile Include="FileSystems\NTFS\Enums\AttributeForm.cs" />
     <Compile Include="FileSystems\NTFS\Enums\AttributeType.cs" />
     <Compile Include="FileSystems\NTFS\Enums\CollationRule.cs" />
+    <Compile Include="FileSystems\NTFS\Enums\ContentType.cs" />
     <Compile Include="FileSystems\NTFS\Enums\FileAttributes.cs" />
     <Compile Include="FileSystems\NTFS\Enums\FileNameFlags.cs" />
     <Compile Include="FileSystems\NTFS\Enums\FileRecordFlags.cs" />

DiskAccessLibrary/FileSystems/NTFS/AttributeData/NonResidentAttributeData.cs

@@ -12,12 +12,14 @@ public class NonResidentAttributeData
         private NTFSVolume m_volume;
         private FileRecord m_fileRecord;
         private NonResidentAttributeRecord m_attributeRecord;
+        private ContentType m_contentType;
 
         public NonResidentAttributeData(NTFSVolume volume, FileRecord fileRecord, NonResidentAttributeRecord attributeRecord)
         {
             m_volume = volume;
             m_fileRecord = fileRecord;
             m_attributeRecord = attributeRecord;
+            m_contentType = GetContentType(fileRecord, attributeRecord.AttributeType);
         }
 
         /// <param name="clusterVCN">Cluster index</param>
@@ -68,7 +70,7 @@ public byte[] ReadSectors(long firstSectorIndex, int count)
                 long bytesRead = 0;
                 foreach (KeyValuePair<long, int> run in sequence)
                 {
-                    byte[] data = m_volume.ReadSectors(run.Key, run.Value);
+                    byte[] data = m_volume.ReadSectors(run.Key, run.Value, m_contentType);
                     Array.Copy(data, 0, result, bytesRead, data.Length);
                     bytesRead += data.Length;
                 }
@@ -164,7 +166,7 @@ public void WriteSectors(long firstSectorIndex, byte[] data)
             {
                 byte[] sectors = new byte[run.Value * bytesPerSector];
                 Array.Copy(data, bytesWritten, sectors, 0, sectors.Length);
-                m_volume.WriteSectors(run.Key, sectors);
+                m_volume.WriteSectors(run.Key, sectors, m_contentType);
                 bytesWritten += sectors.Length;
             }
 
@@ -324,5 +326,42 @@ public NonResidentAttributeRecord AttributeRecord
                 return m_attributeRecord;
             }
         }
+
+        public static ContentType GetContentType(FileRecord fileRecord, AttributeType attributeType)
+        {
+            if (fileRecord != null)
+            {
+                long baseSegmentNumber = fileRecord.BaseSegmentNumber;
+                if (baseSegmentNumber == MasterFileTable.MasterFileTableSegmentNumber || baseSegmentNumber == MasterFileTable.MftMirrorSegmentNumber)
+                {
+                    return (attributeType == AttributeType.Data) ? ContentType.MftData : ContentType.MftBitmap;
+                }
+                else if (baseSegmentNumber == MasterFileTable.VolumeSegmentNumber)
+                {
+                    return ContentType.VolumeBitmap;
+                }
+            }
+            return GetContentType(attributeType);
+        }
+
+        public static ContentType GetContentType(AttributeType attributeType)
+        {
+            if (attributeType == AttributeType.AttributeList)
+            {
+                return ContentType.MftData;
+            }
+            else if (attributeType == AttributeType.IndexAllocation)
+            {
+                return ContentType.IndexData;
+            }
+            else if (attributeType == AttributeType.Bitmap)
+            {
+                return ContentType.IndexBitmap;
+            }
+            else
+            {
+                return ContentType.FileData;
+            }
+        }
     }
 }

DiskAccessLibrary/FileSystems/NTFS/Enums/ContentType.cs

@@ -0,0 +1,13 @@
+
+namespace DiskAccessLibrary.FileSystems.NTFS
+{
+    public enum ContentType
+    {
+        FileData,
+        IndexBitmap,
+        IndexData,
+        MftBitmap,
+        MftData,
+        VolumeBitmap,
+    }
+}

DiskAccessLibrary/FileSystems/NTFS/MasterFileTable.cs

@@ -153,7 +153,7 @@ private FileRecordSegment ReadMftRecordSegment(long mftStartLCN, MftSegmentRefer
         private FileRecordSegment ReadMftRecordSegment(long mftStartLCN, long segmentNumber)
         {
             long sectorIndex = mftStartLCN * m_volume.SectorsPerCluster + segmentNumber * m_volume.SectorsPerFileRecordSegment;
-            byte[] segmentBytes = m_volume.ReadSectors(sectorIndex, m_volume.SectorsPerFileRecordSegment);
+            byte[] segmentBytes = m_volume.ReadSectors(sectorIndex, m_volume.SectorsPerFileRecordSegment, ContentType.MftData);
             MultiSectorHelper.RevertUsaProtection(segmentBytes, 0);
             FileRecordSegment result = new FileRecordSegment(segmentBytes, 0, segmentNumber);
             return result;

DiskAccessLibrary/FileSystems/NTFS/NTFSVolume.Extend.cs

@@ -30,12 +30,12 @@ public void Extend(long numberOfAdditionalSectors)
 
             // Update boot sector
             byte[] bootRecordBytes = m_bootRecord.GetBytes();
-            WriteSectors(0, bootRecordBytes);
+            WriteSectors(0, bootRecordBytes, ContentType.FileData);
 
             // Recreate the backup boot sector at the new end of the raw volume
             // Note: The backup boot sector does not count as part of the NTFS volume
             long backupBootSectorIndex = originalNumberOfSectors + numberOfAdditionalSectors;
-            WriteSectors(backupBootSectorIndex, bootRecordBytes);
+            WriteSectors(backupBootSectorIndex, bootRecordBytes, ContentType.FileData);
         }
     }
 }

DiskAccessLibrary/FileSystems/NTFS/NTFSVolume.cs

@@ -332,13 +332,12 @@ internal void UpdateDirectoryIndex(MftSegmentReference parentDirectory, List<Fil
             }
         }
 
-        // logical cluster
-        protected internal byte[] ReadCluster(long clusterLCN)
+        protected internal byte[] ReadCluster(long clusterLCN, ContentType contentType)
         {
-            return ReadClusters(clusterLCN, 1);
+            return ReadClusters(clusterLCN, 1, contentType);
         }
 
-        protected internal virtual byte[] ReadClusters(long clusterLCN, int count)
+        protected internal virtual byte[] ReadClusters(long clusterLCN, int count, ContentType contentType)
         {
             long firstSectorIndex = clusterLCN * m_bootRecord.SectorsPerCluster;
             int sectorsToRead = m_bootRecord.SectorsPerCluster * count;
@@ -348,18 +347,18 @@ protected internal virtual byte[] ReadClusters(long clusterLCN, int count)
             return result;
         }
 
-        protected internal virtual void WriteClusters(long clusterLCN, byte[] data)
+        protected internal virtual void WriteClusters(long clusterLCN, byte[] data, ContentType contentType)
         {
             long firstSectorIndex = clusterLCN * m_bootRecord.SectorsPerCluster;
             m_volume.WriteSectors(firstSectorIndex, data);
         }
 
-        protected internal virtual byte[] ReadSectors(long sectorIndex, int sectorCount)
+        protected internal virtual byte[] ReadSectors(long sectorIndex, int sectorCount, ContentType contentType)
         {
             return m_volume.ReadSectors(sectorIndex, sectorCount);
         }
 
-        protected internal virtual void WriteSectors(long sectorIndex, byte[] data)
+        protected internal virtual void WriteSectors(long sectorIndex, byte[] data, ContentType contentType)
         {
             m_volume.WriteSectors(sectorIndex, data);
         }
@@ -416,9 +415,9 @@ public override string ToString()
                 builder.AppendLine("Length of Volume Bitmap Attributes: " + volumeBitmapRecord.AttributesLengthOnDisk);
             }
 
-            byte[] bootRecord = ReadSectors(0, 1);
+            byte[] bootRecord = ReadSectors(0, 1, ContentType.FileData);
             long backupBootSectorIndex = (long)m_bootRecord.TotalSectors;
-            byte[] backupBootRecord = ReadSectors(backupBootSectorIndex, 1);
+            byte[] backupBootRecord = ReadSectors(backupBootSectorIndex, 1, ContentType.FileData);
             builder.AppendLine();
             builder.AppendLine("Valid backup boot sector: " + ByteUtils.AreByteArraysEqual(bootRecord, backupBootRecord));
             builder.AppendLine("Free space: " + this.FreeSpace);