NTFS: Clone attributes when assembled from and splitted to FileRecordSegments

Author: TalAloni

DiskAccessLibrary/FileSystems/NTFS/FileRecord/FileRecord.cs

@@ -55,7 +55,7 @@ public void UpdateSegments(int bytesPerFileRecordSegment, byte minorNTFSVersion)
                 // A single record segment is needed
                 foreach (AttributeRecord attribute in attributes)
                 {
-                    m_segments[0].AddAttributeRecord(attribute);
+                    m_segments[0].AddAttributeRecord(attribute.Clone());
                 }
 
                 // Free the rest of the segments, if there are any
@@ -79,7 +79,12 @@ private List<AttributeRecord> GetAttributes()
             }
             else
             {
-                return new List<AttributeRecord>(m_segments[0].ImmediateAttributes);
+                List<AttributeRecord> result = new List<AttributeRecord>();
+                foreach (AttributeRecord attribute in m_segments[0].ImmediateAttributes)
+                {
+                    result.Add(attribute.Clone());
+                }
+                return result;
             }
         }
 

DiskAccessLibrary/FileSystems/NTFS/FileRecord/FileRecordHelper.cs

@@ -48,7 +48,7 @@ public static List<AttributeRecord> GetAssembledAttributes(List<FileRecordSegmen
 
                     if (attribute is ResidentAttributeRecord)
                     {
-                        result.Add(attribute);
+                        result.Add(attribute.Clone());
                     }
                     else
                     {
@@ -102,7 +102,7 @@ private static NonResidentAttributeRecord AssembleFragments(List<NonResidentAttr
                     long relativeOffset = absoluteOffset - previousLCN;
 
                     int runIndex = attribute.DataRunSequence.Count;
-                    attribute.DataRunSequence.AddRange(attributeFragment.DataRunSequence);
+                    attribute.DataRunSequence.AddRange(attributeFragment.DataRunSequence.Clone());
                     attribute.DataRunSequence[runIndex] = new DataRun(runLength, relativeOffset);
                     attribute.HighestVCN = attributeFragment.HighestVCN;
                 }
@@ -127,7 +127,7 @@ public static void SliceAttributes(List<FileRecordSegment> segments, List<Attrib
                 if (attribute.AttributeType == AttributeType.StandardInformation ||
                     attribute.AttributeType == AttributeType.FileName)
                 {
-                    baseFileRecordSegment.AddAttributeRecord(attribute);
+                    baseFileRecordSegment.AddAttributeRecord(attribute.Clone());
                 }
                 else if (isMftFileRecord && attribute.AttributeType == AttributeType.Data)
                 {
@@ -163,6 +163,10 @@ public static void SliceAttributes(List<FileRecordSegment> segments, List<Attrib
                 if (attribute.RecordLength <= remainingLengthInCurrentSegment)
                 {
                     remainingLengthInCurrentSegment -= (int)attribute.RecordLength;
+                    if (attribute is ResidentAttributeRecord)
+                    {
+                        attribute = attribute.Clone();
+                    }
                     segments[segmentIndex].AddAttributeRecord(attribute);
                     remainingAttributes.RemoveFirst();
                 }
@@ -226,7 +230,7 @@ private static NonResidentAttributeRecord FitMaxNumberOfRuns(NonResidentAttribut
                 slice.AllocatedLength = record.AllocatedLength;
                 slice.FileSize = record.FileSize;
                 slice.ValidDataLength = record.ValidDataLength;
-                slice.DataRunSequence.Add(dataRuns[runIndex]);
+                slice.DataRunSequence.Add(dataRuns[runIndex].Clone());
             }
             else
             {
@@ -246,7 +250,7 @@ private static NonResidentAttributeRecord FitMaxNumberOfRuns(NonResidentAttribut
             runIndex++;
             while (runIndex < dataRuns.Count && sliceRecordLength + dataRuns[runIndex].RecordLength <= availableLength)
             {
-                slice.DataRunSequence.Add(record.DataRunSequence[runIndex]);
+                slice.DataRunSequence.Add(record.DataRunSequence[runIndex].Clone());
                 sliceRecordLength += dataRuns[runIndex].RecordLength;
                 clusterCount += dataRuns[runIndex].RunLength;
                 runIndex++;