16,550
社区成员
发帖
与我相关
我的任务
分享
typedef struct _MFT_FILE_HEADER
{
union
{
DWORD dwMagic; //00 "FILE"
CHAR szMagic[4];
};
WORD wOffsetOfUS; //04 Offset of Update Sequence 更新序列号的偏移
WORD wSizeOfUS; //06 Size in words of Update Sequence Number & Array 更新序列号的大小与数组
ULONGLONG uuLSN; //08 $LogFile Sequence Number 日志文件序列号
WORD wSeqNo; //10 Sequence number The increment is done when the file is deleted.
WORD wHardlinks; //12 Hard link count 硬连接数,即有多少目录指向该文件
WORD wOffsetOfAttr; //14 Offset of the first Attribute 第一个属性的偏移
WORD wFlags; //16 Flags 文件被删除后FLAG=0
DWORD dwRealSize; //18 Real size of the FILE record 这个文件记录中已用的大小
DWORD dwAllocSize; //1C Allocated size of the FILE record
ULONGLONG uuRefToBase; //20 File reference to the base FILE record 基本文件记录中的文件索引号
WORD wNextAttrId; //28 Next Attribute Id 下一属性ID
WORD wAlign; //2A Align to 4 byte boundary
DWORD dwRecordNo; //2C Number of this MFT Record
}MFT_FILE_HEADER; // size:0x30
BOOL CNtfsMFT::ReadMft(CHAR cVolume, ULONGLONG uuMftIndex)
{
BOOL bRetVal;
DWORD dwSectors;
WORD wUSNCheck;
WORD * pUSNTable;
AllocMftHead(cVolume);
bRetVal = m_pDiMgr->ReadMtf(cVolume, uuMftIndex, m_pHead);
if(bRetVal == FALSE)
{
assert(0);
return FALSE;
}
m_uuMftIndex = uuMftIndex;
dwSectors = m_pCurVolume->m_dwBytePreMtf / m_pCurVolume->m_BootDat.NtfsBoot.BytesPerSector;
pUSNTable = (WORD*)((BYTE*)m_pHead + m_pHead->wOffsetOfUS);
wUSNCheck = *pUSNTable;
pUSNTable ++;
bRetVal = UpdateByUSN(m_pHead, dwSectors, wUSNCheck, pUSNTable);
if(bRetVal == FALSE)
{
assert(0);
return FALSE;
}
return bRetVal;
}
BOOL CNtfsMFT::UpdateByUSN(VOID *pData, DWORD dwSectors, WORD wUSNCheck, WORD *pUSNTable)
{
BYTE * pDatWrite;
DWORD i;
DWORD dwSectorSize;
dwSectorSize = m_pCurVolume->m_BootDat.NtfsBoot.BytesPerSector;
pDatWrite = (BYTE *)pData;
pDatWrite += dwSectorSize - 2;
for(i=0; i<dwSectors; i++)
{
if(*(WORD *)pDatWrite != wUSNCheck)
{
assert(0);
return FALSE;
}
*(WORD *)pDatWrite = pUSNTable[i];
pDatWrite += dwSectorSize;
}
return TRUE;
}
wchar_t szText[] = L"越玩越聪明全集-全世界聪明人都在玩的1001个全脑思维游戏.pdf";
char* buf = NULL;
int len = WideCharToMultiByte(CP_ACP, 0, szText, -1, buf, 0, NULL, NULL);
buf = new char[len];
WideCharToMultiByte(CP_ACP, 0, szText, -1, buf, len, NULL, NULL);
AfxMessageBox(CString(buf));
delete[] buf;
buf = NULL;