-
Notifications
You must be signed in to change notification settings - Fork 274
FileRecord Class
Jared Atkinson edited this page Nov 5, 2015
·
5 revisions
public class FileRecord
{
// Properties
public readonly string VolumePath;
public readonly ulong LogFileSequenceNumber;
public readonly ushort SequenceNumber;
public readonly ushort Hardlinks;
public readonly bool Deleted;
public readonly bool Directory;
public readonly uint RealSize;
public readonly uint AllocatedSize;
public readonly ulong ReferenceToBase;
public readonly uint RecordNumber;
public readonly Attr[] Attribute;
public readonly DateTime ModifiedTime;
public readonly DateTime AccessedTime;
public readonly DateTime ChangedTime;
public readonly DateTime BornTime;
public readonly StandardInformation.ATTR_STDINFO_PERMISSION Permission;
public readonly string FullName;
public readonly string Name;
public readonly ushort ParentSequenceNumber;
public readonly ulong ParentRecordNumber;
public readonly DateTime FNModifiedTime;
public readonly DateTime FNAccessedTime;
public readonly DateTime FNChangedTime;
public readonly DateTime FNBornTime;
// Static Methods
public static FileRecord Get(string path, bool fast)
public static FileRecord Get(string volume, int index, bool fast)
public static FileRecord[] GetInstances(string volume)
public static FileRecord[] GetInstancesByPath(string path)
public static byte[] GetRecordBytes(string path)
public static byte[] GetRecordBytes(string volume, int index)
// Instance Methods
public byte[] GetContent()
public byte[] GetContent(string StreamName)
public void CopyFile(string Destination)
public void CopyFile(string Destination, string StreamName)
public IndexEntry[] GetChild()
public FileRecord GetParent()
public UsnJrnl GetUsnJrnl()
public byte[] GetSlack()
public byte[] GetMftSlack()
public string GetHash(string algorithm)
public string GetHash(string algorithm, string stream)
// Override Methods
public override string ToString()
}
VolumePath - LogFileSequenceNumber - SequenceNumber - Hardlinks - Deleted - Directory - RealSize - AllocatedSize - ReferenceToBase - RecordNumber - Attribute - ModifiedTime - AccessedTime - ChangedTime - BornTime - Permission - FullName - Name - ParentSequenceNumber - ParentRecordNumber - FNModifiedTime - FNAccessedTime - FNChangedTime - FNBornTime -
Name | Description |
---|---|
Get(string, bool) | |
Get(string, int, bool) | |
GetInstances(string) | |
GetInstancesByPath(string) | |
GetRecordBytes(string) | |
GetRecordBytes(string, int) | |
GetContent() | |
GetContent(string) | |
CopyFile(string) | |
CopyFile(string, string) | |
GetChild() | |
GetParent() | |
GetUsnJrnl() | |
GetSlack() | |
GetMftSlack() | |
GetHash(string) | |
GetHash(string, string) | |
ToString() |
Getting Started
- PowerForensics
- PowerForensics.Artifacts
- PowerForensics.Ntfs
- PowerForensics.Formats
- PowerForensics.Registry
- PowerForensics.Utilities
Cmdlets
- ConvertTo-ForensicTimeline
- Copy-ForensicFile
- Get-ForensicAlternateDataStream
- Get-ForensicAmcache
- Get-ForensicAttrDef
- Get-ForensicBitmap
- Get-ForensicBootSector
- Get-ForensicChildItem
- Get-ForensicContent
- Get-ForensicEventLog
- Get-ForensicFileRecord
- Get-ForensicFileRecordIndex
- Get-ForensicFileSlack
- Get-ForensicGuidPartitionTable
- Get-ForensicMasterBootRecord
- Get-ForensicMftSlack
- Get-ForensicNetworkList
- Get-ForensicPartitionTable
- Get-ForensicPrefetch
- Get-ForensicRegistryKey
- Get-ForensicRegistryValue
- Get-ForensicScheduledJob
- Get-ForensicSid
- Get-ForensicTimeline
- Get-ForensicTimezone
- Get-ForensicUnallocatedSpace
- Get-ForensicUserAssist
- Get-ForensicUsnJrnl
- Get-ForensicUsnJrnlInformation
- Get-ForensicVolumeBootRecord
- Get-ForensicVolumeInformation
- Get-ForensicVolumeName
- Invoke-ForensicDD