Advertisement
sdckey

MFT Date Comparator Code

Nov 27th, 2020
957
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 2.21 KB | None | 0 0
  1. void ReadDateAndValue(FileClass f, ulong &uint_value, DateClass &date, bool &date_is_exact)
  2. {
  3.   f.ReadBinary(uint_value);
  4.   date_is_exact = (uint_value && ((uint_value % 10000000) == 0));
  5.   DebugClass::Assert(!date_is_exact, "Got timestamp without fractional value.");
  6.   f.Skip(-8);
  7.   f.ReadWinDate(date);
  8. }
  9.  
  10. bool Read(EntryFileClass mft, EntryClass entry, uint createdDifference)  {
  11.   Entry = entry;
  12.   bool    gotSIA,
  13.           gotFNA;
  14.   MemoryFileClass t();
  15.   if (t.Open(1024, WRITE))
  16.   {
  17.     mft.Seek(Entry.FileID() * 1024);
  18.     t.WriteBuffer(mft, 1024);
  19.     t.Seek(0x14);
  20.     long attribsStart = t.ReadBinaryInt(2);
  21.     t.Seek(0x18);
  22.     ulong mftActualSize = t.ReadBinaryInt(2);
  23.     t.Seek(attribsStart);
  24.     ulong attrID,
  25.           attrLength,
  26.           attrStartPos;
  27.     while ((!gotSIA || !gotFNA) && (t.GetPos() < mftActualSize))
  28.     {
  29.       attrStartPos = t.GetPos();
  30.       attrID = t.ReadBinaryInt(4);
  31.       attrLength = t.ReadBinaryInt(4);
  32.       if (attrID == 0x10)  {
  33.         gotSIA = true;
  34.         t.Seek(attrStartPos + 0x18);
  35.         ReadDateAndValue(t, SIACreatedAsInt, SIACreated, SIACreatedIsExact);
  36.         ReadDateAndValue(t, SIAWrittenAsInt, SIAWritten, SIAWrittenIsExact);
  37.         ReadDateAndValue(t, SIAModifiedAsInt, SIAModified, SIAModifiedIsExact);
  38.         ReadDateAndValue(t, SIAAccessedAsInt, SIAAccessed, SIAAccessedIsExact);
  39.         t.Seek(attrStartPos + attrLength);
  40.       }
  41.       else if (attrID == 0x30)  {
  42.         gotFNA = true;
  43.         t.Seek(attrStartPos + 0x18 + 0x08);
  44.         ReadDateAndValue(t, FNACreatedAsInt, FNACreated, FNACreatedIsExact);
  45.         ReadDateAndValue(t, FNAWrittenAsInt, FNAWritten, FNAWrittenIsExact);
  46.         ReadDateAndValue(t, FNAModifiedAsInt, FNAModified, FNAModifiedIsExact);
  47.         ReadDateAndValue(t, FNAAccessedAsInt, FNAAccessed, FNAAccessedIsExact);
  48.         t.Seek(attrStartPos + attrLength);
  49.       }
  50.       else if (attrID == 0xffffffff)  {
  51.         break;
  52.       }
  53.       else  {
  54.         t.Seek(attrStartPos + attrLength);
  55.       }
  56.     }
  57.     if (gotSIA && gotFNA)  {
  58.       WarningFlag = CheckValidity(createdDifference);
  59.       return true;
  60.     }
  61.     else  {
  62.       return false;
  63.     }
  64.   }
  65.   else
  66.   {
  67.     return false;
  68.   }
  69. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement