Initial commit - WPinternals 2.6

DiscUtils/Ntfs/Internals/AttributeFlags.cs

@@ -0,0 +1,53 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// Flags indicating how an attribute's content is stored on disk.
+    /// </summary>
+    [Flags]
+    public enum AttributeFlags
+    {
+        /// <summary>
+        /// The data is stored in linear form.
+        /// </summary>
+        None = 0x0000,
+
+        /// <summary>
+        /// The data is compressed.
+        /// </summary>
+        Compressed = 0x0001,
+
+        /// <summary>
+        /// The data is encrypted.
+        /// </summary>
+        Encrypted = 0x4000,
+
+        /// <summary>
+        /// The data is stored in sparse form.
+        /// </summary>
+        Sparse = 0x8000
+    }
+}

DiscUtils/Ntfs/Internals/AttributeListAttribute.cs

@@ -0,0 +1,67 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System.Collections.Generic;
+
+    /// <summary>
+    /// List of attributes for files that are split over multiple Master File Table entries.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Files with lots of attribute data (for example that have become very fragmented) contain
+    /// this attribute in their 'base' Master File Table entry.  This attribute acts as an index,
+    /// indicating for each attribute in the file, which Master File Table entry contains the
+    /// attribute.
+    /// </para>
+    /// </remarks>
+    public sealed class AttributeListAttribute : GenericAttribute
+    {
+        private AttributeList _list;
+
+        internal AttributeListAttribute(INtfsContext context, AttributeRecord record)
+            : base(context, record)
+        {
+            byte[] content = Utilities.ReadAll(Content);
+            _list = new AttributeList();
+            _list.ReadFrom(content, 0);
+        }
+
+        /// <summary>
+        /// Gets the entries in this attribute list.
+        /// </summary>
+        public ICollection<AttributeListEntry> Entries
+        {
+            get
+            {
+                List<AttributeListEntry> entries = new List<AttributeListEntry>();
+                foreach (var record in _list)
+                {
+                    entries.Add(new AttributeListEntry(record));
+                }
+
+                return entries;
+            }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/AttributeListEntry.cs

@@ -0,0 +1,93 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    /// <summary>
+    /// Represents an entry in an AttributeList attribute.
+    /// </summary>
+    /// <remarks>Each instance of this class points to the actual Master File Table
+    /// entry that contains the attribute.  It is used for files split over multiple
+    /// Master File Table entries.</remarks>
+    public sealed class AttributeListEntry
+    {
+        private AttributeListRecord _record;
+
+        internal AttributeListEntry(AttributeListRecord record)
+        {
+            _record = record;
+        }
+
+        /// <summary>
+        /// Gets the type of the attribute.
+        /// </summary>
+        public AttributeType AttributeType
+        {
+            get { return _record.Type; }
+        }
+
+        /// <summary>
+        /// Gets the name of the attribute (if any).
+        /// </summary>
+        public string AttributeName
+        {
+            get { return _record.Name; }
+        }
+
+        /// <summary>
+        /// Gets the first cluster represented in this attribute (normally 0).
+        /// </summary>
+        /// <remarks>
+        /// <para>
+        /// For very fragmented files, it can be necessary to split a single attribute
+        /// over multiple Master File Table entries.  This is achieved with multiple attributes
+        /// with the same name and type (one per Master File Table entry), with this field
+        /// determining the logical order of the attributes.
+        /// </para>
+        /// <para>
+        /// The number is the first 'virtual' cluster present (i.e. divide the file's content
+        /// into 'cluster' sized chunks, this is the first of those clusters logically
+        /// represented in the attribute).
+        /// </para>
+        /// </remarks>
+        public long FirstFileCluster
+        {
+            get { return (long)_record.StartVcn; }
+        }
+
+        /// <summary>
+        /// Gets the Master File Table entry that contains the attribute.
+        /// </summary>
+        public MasterFileTableReference MasterFileTableEntry
+        {
+            get { return new MasterFileTableReference(_record.BaseFileReference); }
+        }
+
+        /// <summary>
+        /// Gets the identifier of the attribute.
+        /// </summary>
+        public int AttributeIdentifier
+        {
+            get { return _record.AttributeId; }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/EntryState.cs

@@ -0,0 +1,56 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+using System;
+
+namespace DiscUtils.Ntfs.Internals
+{
+    /// <summary>
+    /// Flags indicating the state of a Master File Table entry.
+    /// </summary>
+    /// <remarks>
+    /// Used to filter entries in the Master File Table.
+    /// </remarks>
+    [Flags]
+    public enum EntryState
+    {
+        /// <summary>
+        /// No entries match.
+        /// </summary>
+        None = 0,
+
+        /// <summary>
+        /// The entry is currently in use.
+        /// </summary>
+        InUse = 1,
+
+        /// <summary>
+        /// The entry is currently not in use.
+        /// </summary>
+        NotInUse = 2,
+
+        /// <summary>
+        /// All entries match.
+        /// </summary>
+        All = 3
+    }
+}

DiscUtils/Ntfs/Internals/EntryStates.cs

@@ -0,0 +1,56 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// Flags indicating the state of a Master File Table entry.
+    /// </summary>
+    /// <remarks>
+    /// Used to filter entries in the Master File Table.
+    /// </remarks>
+    [Flags]
+    public enum EntryStates
+    {
+        /// <summary>
+        /// No entries match.
+        /// </summary>
+        None = 0,
+
+        /// <summary>
+        /// The entry is currently in use.
+        /// </summary>
+        InUse = 1,
+
+        /// <summary>
+        /// The entry is currently not in use.
+        /// </summary>
+        NotInUse = 2,
+
+        /// <summary>
+        /// All entries match.
+        /// </summary>
+        All = 3
+    }
+}

DiscUtils/Ntfs/Internals/FileNameAttribute.cs

@@ -0,0 +1,145 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// Representation of an NTFS File Name attribute.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Each Master File Table entry (MFT Entry) has one of these attributes for each
+    /// hard link.  Files with a long name and a short name will have at least two of
+    /// these attributes.</para>
+    /// <para>
+    /// The details in this attribute may be inconsistent with similar information in
+    /// the StandardInformationAttribute for a file.  The StandardInformation is
+    /// definitive, this attribute holds a 'cache' of the information.
+    /// </para>
+    /// </remarks>
+    public sealed class FileNameAttribute : GenericAttribute
+    {
+        private FileNameRecord _fnr;
+
+        internal FileNameAttribute(INtfsContext context, AttributeRecord record)
+            : base(context, record)
+        {
+            byte[] content = Utilities.ReadAll(Content);
+            _fnr = new FileNameRecord();
+            _fnr.ReadFrom(content, 0);
+        }
+
+        /// <summary>
+        /// Gets the reference to the parent directory.
+        /// </summary>
+        /// <remarks>
+        /// This attribute stores the name of a file within a directory, this field
+        /// provides the link back to the directory.
+        /// </remarks>
+        public MasterFileTableReference ParentDirectory
+        {
+            get { return new MasterFileTableReference(_fnr.ParentDirectory); }
+        }
+
+        /// <summary>
+        /// Gets the creation time of the file.
+        /// </summary>
+        public DateTime CreationTime
+        {
+            get { return _fnr.CreationTime; }
+        }
+
+        /// <summary>
+        /// Gets the modification time of the file.
+        /// </summary>
+        public DateTime ModificationTime
+        {
+            get { return _fnr.ModificationTime; }
+        }
+
+        /// <summary>
+        /// Gets the last time the Master File Table entry for the file was changed.
+        /// </summary>
+        public DateTime MasterFileTableChangedTime
+        {
+            get { return _fnr.MftChangedTime; }
+        }
+
+        /// <summary>
+        /// Gets the last access time of the file.
+        /// </summary>
+        public DateTime LastAccessTime
+        {
+            get { return _fnr.LastAccessTime; }
+        }
+
+        /// <summary>
+        /// Gets the amount of disk space allocated for the file.
+        /// </summary>
+        public long AllocatedSize
+        {
+            get { return (long)_fnr.AllocatedSize; }
+        }
+
+        /// <summary>
+        /// Gets the amount of data stored in the file.
+        /// </summary>
+        public long RealSize
+        {
+            get { return (long)_fnr.RealSize; }
+        }
+
+        /// <summary>
+        /// Gets the attributes of the file, as stored by NTFS.
+        /// </summary>
+        public NtfsFileAttributes FileAttributes
+        {
+            get { return (NtfsFileAttributes)_fnr.Flags; }
+        }
+
+        /// <summary>
+        /// Gets the extended attributes size, or a reparse tag, depending on the nature of the file.
+        /// </summary>
+        public long ExtendedAttributesSizeOrReparsePointTag
+        {
+            get { return (long)_fnr.EASizeOrReparsePointTag; }
+        }
+
+        /// <summary>
+        /// Gets the namespace of the FileName property.
+        /// </summary>
+        public NtfsNamespace FileNameNamespace
+        {
+            get { return (NtfsNamespace)_fnr.FileNameNamespace; }
+        }
+
+        /// <summary>
+        /// Gets the name of the file within the parent directory.
+        /// </summary>
+        public string FileName
+        {
+            get { return _fnr.FileName; }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/GenericAttribute.cs

@@ -0,0 +1,117 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    /// <summary>
+    /// Base class for all attributes within Master File Table entries.
+    /// </summary>
+    /// <remarks>
+    /// More specialized base classes are provided for known attribute types.
+    /// </remarks>
+    public abstract class GenericAttribute
+    {
+        private INtfsContext _context;
+        private AttributeRecord _record;
+
+        internal GenericAttribute(INtfsContext context, AttributeRecord record)
+        {
+            _context = context;
+            _record = record;
+        }
+
+        /// <summary>
+        /// Gets the name of the attribute (if any).
+        /// </summary>
+        public string Name
+        {
+            get { return _record.Name; }
+        }
+
+        /// <summary>
+        /// Gets the type of the attribute.
+        /// </summary>
+        public AttributeType AttributeType
+        {
+            get { return _record.AttributeType; }
+        }
+
+        /// <summary>
+        /// Gets the unique id of the attribute.
+        /// </summary>
+        public int Identifier
+        {
+            get { return _record.AttributeId; }
+        }
+
+        /// <summary>
+        /// Gets a value indicating whether the attribute content is stored in the MFT record itself.
+        /// </summary>
+        public bool IsResident
+        {
+            get { return !_record.IsNonResident; }
+        }
+
+        /// <summary>
+        /// Gets the flags indicating how the content of the attribute is stored.
+        /// </summary>
+        public AttributeFlags Flags
+        {
+            get { return (AttributeFlags)_record.Flags; }
+        }
+
+        /// <summary>
+        /// Gets the amount of valid data in the attribute's content.
+        /// </summary>
+        public long ContentLength
+        {
+            get { return _record.DataLength; }
+        }
+
+        /// <summary>
+        /// Gets a buffer that can access the content of the attribute.
+        /// </summary>
+        public IBuffer Content
+        {
+            get
+            {
+                IBuffer rawBuffer = _record.GetReadOnlyDataBuffer(_context);
+                return new SubBuffer(rawBuffer, 0, _record.DataLength);
+            }
+        }
+
+        internal static GenericAttribute FromAttributeRecord(INtfsContext context, AttributeRecord record)
+        {
+            switch (record.AttributeType)
+            {
+                case AttributeType.AttributeList:
+                    return new AttributeListAttribute(context, record);
+                case AttributeType.FileName:
+                    return new FileNameAttribute(context, record);
+                case AttributeType.StandardInformation:
+                    return new StandardInformationAttribute(context, record);
+                default:
+                    return new UnknownAttribute(context, record);
+            }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTable.cs

@@ -0,0 +1,154 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System.Collections.Generic;
+    using InternalMasterFileTable = DiscUtils.Ntfs.MasterFileTable;
+
+    /// <summary>
+    /// Provides read-only access to the Master File Table of an NTFS file system.
+    /// </summary>
+    public sealed class MasterFileTable
+    {
+        /// <summary>
+        /// Index of the Master File Table itself.
+        /// </summary>
+        public const long MasterFileTableIndex = 0;
+
+        /// <summary>
+        /// Index of the Master File Table Mirror file.
+        /// </summary>
+        public const long MasterFileTableMirrorIndex = 1;
+
+        /// <summary>
+        /// Index of the Log file.
+        /// </summary>
+        public const long LogFileIndex = 2;
+
+        /// <summary>
+        /// Index of the Volume file.
+        /// </summary>
+        public const long VolumeIndex = 3;
+
+        /// <summary>
+        /// Index of the Attribute Definition file.
+        /// </summary>
+        public const long AttributeDefinitionIndex = 4;
+
+        /// <summary>
+        /// Index of the Root Directory.
+        /// </summary>
+        public const long RootDirectoryIndex = 5;
+
+        /// <summary>
+        /// Index of the Bitmap file.
+        /// </summary>
+        public const long BitmapIndex = 6;
+
+        /// <summary>
+        /// Index of the Boot sector(s).
+        /// </summary>
+        public const long BootIndex = 7;
+
+        /// <summary>
+        /// Index of the Bad Cluster file.
+        /// </summary>
+        public const long BadClusterIndex = 8;
+
+        /// <summary>
+        /// Index of the Security Descriptor file.
+        /// </summary>
+        public const long SecureIndex = 9;
+
+        /// <summary>
+        /// Index of the Uppercase mapping file.
+        /// </summary>
+        public const long UppercaseIndex = 10;
+
+        /// <summary>
+        /// Index of the Optional Extensions directory.
+        /// </summary>
+        public const long ExtendDirectoryIndex = 11;
+
+        /// <summary>
+        /// First index available for 'normal' files.
+        /// </summary>
+        private const uint FirstNormalFileIndex = 24;
+
+        private INtfsContext _context;
+        private InternalMasterFileTable _mft;
+
+        internal MasterFileTable(INtfsContext context, InternalMasterFileTable mft)
+        {
+            _context = context;
+            _mft = mft;
+        }
+
+        /// <summary>
+        /// Gets an entry by index.
+        /// </summary>
+        /// <param name="index">The index of the entry.</param>
+        /// <returns>The entry.</returns>
+        public MasterFileTableEntry this[long index]
+        {
+            get
+            {
+                FileRecord mftRecord = _mft.GetRecord(index, true, true);
+                if (mftRecord != null)
+                {
+                    return new MasterFileTableEntry(_context, mftRecord);
+                }
+                else
+                {
+                    return null;
+                }
+            }
+        }
+
+        /// <summary>
+        /// Enumerates all entries.
+        /// </summary>
+        /// <param name="filter">Filter controlling which entries are returned.</param>
+        /// <returns>An enumeration of entries matching the filter.</returns>
+        public IEnumerable<MasterFileTableEntry> GetEntries(EntryStates filter)
+        {
+            foreach (var record in _mft.Records)
+            {
+                EntryStates state;
+                if ((record.Flags & FileRecordFlags.InUse) != 0)
+                {
+                    state = EntryStates.InUse;
+                }
+                else
+                {
+                    state = EntryStates.NotInUse;
+                }
+
+                if ((state & filter) != 0)
+                {
+                    yield return new MasterFileTableEntry(_context, record);
+                }
+            }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableAttribute.cs

@@ -0,0 +1,10 @@
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+    using System.Collections.Generic;
+    using System.Text;
+
+    public sealed class MasterFileTableAttribute
+    {
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableEntry.cs

@@ -0,0 +1,135 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System.Collections.Generic;
+
+    /// <summary>
+    /// An entry within the Master File Table.
+    /// </summary>
+    public sealed class MasterFileTableEntry
+    {
+        private INtfsContext _context;
+        private FileRecord _fileRecord;
+
+        internal MasterFileTableEntry(INtfsContext context, FileRecord fileRecord)
+        {
+            _context = context;
+            _fileRecord = fileRecord;
+        }
+
+        /// <summary>
+        /// Gets the index of this entry in the Master File Table.
+        /// </summary>
+        public long Index
+        {
+            get { return _fileRecord.LoadedIndex; }
+        }
+
+        /// <summary>
+        /// Gets the change identifier that is updated each time the file is modified by Windows, relates to the NTFS log file.
+        /// </summary>
+        /// <remarks>
+        /// The NTFS log file provides journalling, preventing meta-data corruption in the event of a system crash.
+        /// </remarks>
+        public long LogFileSequenceNumber
+        {
+            get { return (long)_fileRecord.LogFileSequenceNumber; }
+        }
+
+        /// <summary>
+        /// Gets the revision number of the entry.
+        /// </summary>
+        /// <remarks>
+        /// Each time an entry is allocated or de-allocated, this number is incremented by one.
+        /// </remarks>
+        public int SequenceNumber
+        {
+            get { return _fileRecord.SequenceNumber; }
+        }
+
+        /// <summary>
+        /// Gets the number of hard links referencing this file.
+        /// </summary>
+        public int HardLinkCount
+        {
+            get { return _fileRecord.HardLinkCount; }
+        }
+
+        /// <summary>
+        /// Gets the flags indicating the nature of the entry.
+        /// </summary>
+        public MasterFileTableEntryFlags Flags
+        {
+            get { return (MasterFileTableEntryFlags)_fileRecord.Flags; }
+        }
+
+        /// <summary>
+        /// Gets the identity of the base entry for files split over multiple entries.
+        /// </summary>
+        /// <remarks>
+        /// All entries that form part of the same file have the same value for
+        /// this property.
+        /// </remarks>
+        public MasterFileTableReference BaseRecordReference
+        {
+            get { return new MasterFileTableReference(_fileRecord.BaseFile); }
+        }
+
+        /// <summary>
+        /// Gets the next attribute identity that will be allocated.
+        /// </summary>
+        public int NextAttributeId
+        {
+            get { return _fileRecord.NextAttributeId; }
+        }
+
+        /// <summary>
+        /// Gets the index of this entry in the Master File Table (as stored in the entry itself).
+        /// </summary>
+        /// <remarks>
+        /// Note - older versions of Windows did not store this value, so it may be Zero.
+        /// </remarks>
+        public long SelfIndex
+        {
+            get { return _fileRecord.MasterFileTableIndex; }
+        }
+
+        /// <summary>
+        /// Gets the attributes contained in this entry.
+        /// </summary>
+        public ICollection<GenericAttribute> Attributes
+        {
+            get
+            {
+                List<GenericAttribute> result = new List<GenericAttribute>();
+                foreach (var attr in _fileRecord.Attributes)
+                {
+                    result.Add(GenericAttribute.FromAttributeRecord(_context, attr));
+                }
+
+                return result;
+            }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableEntryFlags.cs

@@ -0,0 +1,58 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// Flags indicating the nature of a Master File Table entry.
+    /// </summary>
+    [Flags]
+    public enum MasterFileTableEntryFlags : int
+    {
+        /// <summary>
+        /// Default value.
+        /// </summary>
+        None = 0x0000,
+
+        /// <summary>
+        /// The entry is currently in use.
+        /// </summary>
+        InUse = 0x0001,
+
+        /// <summary>
+        /// The entry is for a directory (rather than a file).
+        /// </summary>
+        IsDirectory = 0x0002,
+
+        /// <summary>
+        /// The entry is for a file that forms parts of the NTFS meta-data.
+        /// </summary>
+        IsMetaFile = 0x0004,
+
+        /// <summary>
+        /// The entry contains index attributes.
+        /// </summary>
+        HasViewIndex = 0x0008
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableRecord.cs

@@ -0,0 +1,71 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System.Collections;
+    using System.Collections.Generic;
+    using System.IO;
+
+    public sealed class MasterFileTableRecord
+    {
+        private FileRecord _fileRecord;
+
+        internal MasterFileTableRecord(FileRecord fileRecord)
+        {
+            _fileRecord = fileRecord;
+        }
+
+        /// <summary>
+        /// Changes each time the file is modified by Windows, relates to the NTFS journal.
+        /// </summary>
+        public long JournalSequenceNumber
+        {
+            get { return (long)_fileRecord.LogFileSequenceNumber; }
+        }
+
+        public int SequenceNumber
+        {
+            get { return _fileRecord.SequenceNumber; }
+        }
+
+        public int HardLinkCount
+        {
+            get { return _fileRecord.HardLinkCount; }
+        }
+
+        public MasterFileTableRecordFlags Flags
+        {
+            get { return (MasterFileTableRecordFlags)_fileRecord.Flags; }
+        }
+
+        public MasterFileTableReference BaseRecordReference
+        {
+            get { return new MasterFileTableReference(_fileRecord.BaseFile); }
+        }
+
+        public int NextAttributeId
+        {
+            get { return _fileRecord.NextAttributeId; }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableRecordFlags.cs

@@ -0,0 +1,36 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    [Flags]
+    public enum MasterFileTableRecordFlags : int
+    {
+        None = 0x0000,
+        InUse = 0x0001,
+        IsDirectory = 0x0002,
+        IsMetaFile = 0x0004,
+        HasViewIndex = 0x0008
+    }
+}

DiscUtils/Ntfs/Internals/MasterFileTableReference.cs

@@ -0,0 +1,103 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    /// <summary>
+    /// A reference to a Master File Table entry.
+    /// </summary>
+    public struct MasterFileTableReference
+    {
+        private FileRecordReference _ref;
+
+        internal MasterFileTableReference(FileRecordReference recordRef)
+        {
+            _ref = recordRef;
+        }
+
+        /// <summary>
+        /// Gets the index of the referred entry in the Master File Table.
+        /// </summary>
+        public long RecordIndex
+        {
+            get { return _ref.MftIndex; }
+        }
+
+        /// <summary>
+        /// Gets the revision number of the entry.
+        /// </summary>
+        /// <remarks>
+        /// This value prevents accidental reference to an entry - it will get out
+        /// of sync with the actual entry if the entry is re-allocated or de-allocated.
+        /// </remarks>
+        public int RecordSequenceNumber
+        {
+            get { return _ref.SequenceNumber; }
+        }
+
+        /// <summary>
+        /// Compares to instances for equality.
+        /// </summary>
+        /// <param name="a">The first instance to compare.</param>
+        /// <param name="b">The second instance to compare.</param>
+        /// <returns><code>true</code> if the instances are equivalent, else <code>false</code>.</returns>
+        public static bool operator ==(MasterFileTableReference a, MasterFileTableReference b)
+        {
+            return a._ref == b._ref;
+        }
+
+        /// <summary>
+        /// Compares to instances for equality.
+        /// </summary>
+        /// <param name="a">The first instance to compare.</param>
+        /// <param name="b">The second instance to compare.</param>
+        /// <returns><code>true</code> if the instances are not equivalent, else <code>false</code>.</returns>
+        public static bool operator !=(MasterFileTableReference a, MasterFileTableReference b)
+        {
+            return a._ref != b._ref;
+        }
+
+        /// <summary>
+        /// Compares another object for equality.
+        /// </summary>
+        /// <param name="obj">The object to compare.</param>
+        /// <returns><code>true</code> if the other object is equivalent, else <code>false</code>.</returns>
+        public override bool Equals(object obj)
+        {
+            if (obj == null || !(obj is MasterFileTableReference))
+            {
+                return false;
+            }
+
+            return _ref == ((MasterFileTableReference)obj)._ref;
+        }
+
+        /// <summary>
+        /// Gets a hash code for this instance.
+        /// </summary>
+        /// <returns>The hash code.</returns>
+        public override int GetHashCode()
+        {
+            return _ref.GetHashCode();
+        }
+    }
+}

DiscUtils/Ntfs/Internals/NtfsFileAttributes.cs

@@ -0,0 +1,113 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// File attributes as stored natively by NTFS.
+    /// </summary>
+    [Flags]
+    public enum NtfsFileAttributes
+    {
+        /// <summary>
+        /// No attributes.
+        /// </summary>
+        None = 0x00000000,
+
+        /// <summary>
+        /// The file is read-only.
+        /// </summary>
+        ReadOnly = 0x00000001,
+
+        /// <summary>
+        /// The file is hidden.
+        /// </summary>
+        Hidden = 0x00000002,
+
+        /// <summary>
+        /// The file is part of the Operating System.
+        /// </summary>
+        System = 0x00000004,
+
+        /// <summary>
+        /// The file should be archived.
+        /// </summary>
+        Archive = 0x00000020,
+
+        /// <summary>
+        /// The file is actually a device.
+        /// </summary>
+        Device = 0x00000040,
+
+        /// <summary>
+        /// The file is a 'normal' file.
+        /// </summary>
+        Normal = 0x00000080,
+
+        /// <summary>
+        /// The file is a temporary file.
+        /// </summary>
+        Temporary = 0x00000100,
+
+        /// <summary>
+        /// The file content is stored in sparse form.
+        /// </summary>
+        Sparse = 0x00000200,
+
+        /// <summary>
+        /// The file has a reparse point attached.
+        /// </summary>
+        ReparsePoint = 0x00000400,
+
+        /// <summary>
+        /// The file content is stored compressed.
+        /// </summary>
+        Compressed = 0x00000800,
+
+        /// <summary>
+        /// The file is an 'offline' file.
+        /// </summary>
+        Offline = 0x00001000,
+
+        /// <summary>
+        /// The file is not indexed.
+        /// </summary>
+        NotIndexed = 0x00002000,
+
+        /// <summary>
+        /// The file content is encrypted.
+        /// </summary>
+        Encrypted = 0x00004000,
+
+        /// <summary>
+        /// The file is actually a directory.
+        /// </summary>
+        Directory = 0x10000000,
+
+        /// <summary>
+        /// The file has an index attribute.
+        /// </summary>
+        IndexView = 0x20000000
+    }
+}

DiscUtils/Ntfs/Internals/NtfsNamespace.cs

@@ -0,0 +1,56 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// The known NTFS namespaces.
+    /// </summary>
+    /// <remarks>
+    /// NTFS has multiple namespaces, indicating whether a name is the
+    /// long name for a file, the short name for a file, both, or none.
+    /// </remarks>
+    public enum NtfsNamespace
+    {
+        /// <summary>
+        /// Posix namespace (i.e. long name).
+        /// </summary>
+        Posix = 0,
+
+        /// <summary>
+        /// Windows long file name.
+        /// </summary>
+        Win32 = 1,
+
+        /// <summary>
+        /// DOS (8.3) file name.
+        /// </summary>
+        Dos = 2,
+
+        /// <summary>
+        /// File name that is both the long name and the DOS (8.3) name.
+        /// </summary>
+        Win32AndDos = 3
+    }
+}

DiscUtils/Ntfs/Internals/StandardInformationAttribute.cs

@@ -0,0 +1,146 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    using System;
+
+    /// <summary>
+    /// Representation of an NTFS File Name attribute.
+    /// </summary>
+    /// <para>
+    /// The details in this attribute may be inconsistent with similar information in
+    /// the FileNameAttribute(s) for a file.  This attribute is definitive, the
+    /// FileNameAttribute attribute holds a 'cache' of some of the information.
+    /// </para>
+    public sealed class StandardInformationAttribute : GenericAttribute
+    {
+        private StandardInformation _si;
+
+        internal StandardInformationAttribute(INtfsContext context, AttributeRecord record)
+            : base(context, record)
+        {
+            byte[] content = Utilities.ReadAll(Content);
+            _si = new StandardInformation();
+            _si.ReadFrom(content, 0);
+        }
+
+        /// <summary>
+        /// Gets the creation time of the file.
+        /// </summary>
+        public DateTime CreationTime
+        {
+            get { return _si.CreationTime; }
+        }
+
+        /// <summary>
+        /// Gets the modification time of the file.
+        /// </summary>
+        public DateTime ModificationTime
+        {
+            get { return _si.ModificationTime; }
+        }
+
+        /// <summary>
+        /// Gets the last time the Master File Table entry for the file was changed.
+        /// </summary>
+        public DateTime MasterFileTableChangedTime
+        {
+            get { return _si.MftChangedTime; }
+        }
+
+        /// <summary>
+        /// Gets the last access time of the file.
+        /// </summary>
+        public DateTime LastAccessTime
+        {
+            get { return _si.LastAccessTime; }
+        }
+
+        /// <summary>
+        /// Gets the attributes of the file, as stored by NTFS.
+        /// </summary>
+        public NtfsFileAttributes FileAttributes
+        {
+            get { return (NtfsFileAttributes)_si.FileAttributes; }
+        }
+
+        /// <summary>
+        /// Gets the maximum number of file versions (normally 0).
+        /// </summary>
+        public long MaxVersions
+        {
+            get { return _si.MaxVersions; }
+        }
+
+        /// <summary>
+        /// Gets the version number of the file (normally 0).
+        /// </summary>
+        public long Version
+        {
+            get { return _si.Version; }
+        }
+
+        /// <summary>
+        /// Gets the Unknown.
+        /// </summary>
+        public long ClassId
+        {
+            get { return _si.ClassId; }
+        }
+
+        /// <summary>
+        /// Gets the owner identity, for the purposes of quota allocation.
+        /// </summary>
+        public long OwnerId
+        {
+            get { return _si.OwnerId; }
+        }
+
+        /// <summary>
+        /// Gets the identifier of the Security Descriptor for this file.
+        /// </summary>
+        /// <remarks>
+        /// Security Descriptors are stored in the \$Secure meta-data file.
+        /// </remarks>
+        public long SecurityId
+        {
+            get { return _si.SecurityId; }
+        }
+
+        /// <summary>
+        /// Gets the amount charged to the owners quota for this file.
+        /// </summary>
+        public long QuotaCharged
+        {
+            get { return (long)_si.QuotaCharged; }
+        }
+
+        /// <summary>
+        /// Gets the last update sequence number of the file (relates to the user-readable journal).
+        /// </summary>
+        public long JournalSequenceNumber
+        {
+            get { return (long)_si.UpdateSequenceNumber; }
+        }
+    }
+}

DiscUtils/Ntfs/Internals/UnknownAttribute.cs

@@ -0,0 +1,32 @@
+//
+// Copyright (c) 2008-2011, Kenneth Bell
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+//
+
+namespace DiscUtils.Ntfs.Internals
+{
+    internal sealed class UnknownAttribute : GenericAttribute
+    {
+        public UnknownAttribute(INtfsContext context, AttributeRecord record)
+            : base(context, record)
+        {
+        }
+    }
+}