Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- void ReadDateAndValue(FileClass f, ulong &uint_value, DateClass &date, bool &date_is_exact)
- {
- f.ReadBinary(uint_value);
- date_is_exact = (uint_value && ((uint_value % 10000000) == 0));
- DebugClass::Assert(!date_is_exact, "Got timestamp without fractional value.");
- f.Skip(-8);
- f.ReadWinDate(date);
- }
- bool Read(EntryFileClass mft, EntryClass entry, uint createdDifference) {
- Entry = entry;
- bool gotSIA,
- gotFNA;
- MemoryFileClass t();
- if (t.Open(1024, WRITE))
- {
- mft.Seek(Entry.FileID() * 1024);
- t.WriteBuffer(mft, 1024);
- t.Seek(0x14);
- long attribsStart = t.ReadBinaryInt(2);
- t.Seek(0x18);
- ulong mftActualSize = t.ReadBinaryInt(2);
- t.Seek(attribsStart);
- ulong attrID,
- attrLength,
- attrStartPos;
- while ((!gotSIA || !gotFNA) && (t.GetPos() < mftActualSize))
- {
- attrStartPos = t.GetPos();
- attrID = t.ReadBinaryInt(4);
- attrLength = t.ReadBinaryInt(4);
- if (attrID == 0x10) {
- gotSIA = true;
- t.Seek(attrStartPos + 0x18);
- ReadDateAndValue(t, SIACreatedAsInt, SIACreated, SIACreatedIsExact);
- ReadDateAndValue(t, SIAWrittenAsInt, SIAWritten, SIAWrittenIsExact);
- ReadDateAndValue(t, SIAModifiedAsInt, SIAModified, SIAModifiedIsExact);
- ReadDateAndValue(t, SIAAccessedAsInt, SIAAccessed, SIAAccessedIsExact);
- t.Seek(attrStartPos + attrLength);
- }
- else if (attrID == 0x30) {
- gotFNA = true;
- t.Seek(attrStartPos + 0x18 + 0x08);
- ReadDateAndValue(t, FNACreatedAsInt, FNACreated, FNACreatedIsExact);
- ReadDateAndValue(t, FNAWrittenAsInt, FNAWritten, FNAWrittenIsExact);
- ReadDateAndValue(t, FNAModifiedAsInt, FNAModified, FNAModifiedIsExact);
- ReadDateAndValue(t, FNAAccessedAsInt, FNAAccessed, FNAAccessedIsExact);
- t.Seek(attrStartPos + attrLength);
- }
- else if (attrID == 0xffffffff) {
- break;
- }
- else {
- t.Seek(attrStartPos + attrLength);
- }
- }
- if (gotSIA && gotFNA) {
- WarningFlag = CheckValidity(createdDifference);
- return true;
- }
- else {
- return false;
- }
- }
- else
- {
- return false;
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement