-
Notifications
You must be signed in to change notification settings - Fork 274
VolumeBootRecord Class
Jared Atkinson edited this page Nov 5, 2015
·
5 revisions
public class VolumeBootRecord
{
// Properties
public readonly string Signature;
public readonly MEDIA_DESCRIPTOR MediaDescriptor;
public readonly ushort BytesPerSector;
public readonly uint BytesPerCluster;
public readonly double BytesPerFileRecord;
public readonly double BytesPerIndexBlock;
public readonly ushort ReservedSectors;
public readonly ushort SectorsPerTrack;
public readonly ushort NumberOfHeads;
public readonly uint HiddenSectors;
public readonly ulong TotalSectors;
public readonly ulong MFTStartIndex;
public readonly ulong MFTMirrStartIndex;
public readonly string VolumeSerialNumber;
public readonly byte[] CodeSection;
// Static Methods
public static VolumeBootRecord Get(string volume)
public static VolumeBootRecord GetByPath(string path)
public static byte[] GetBytes(string volume)
public static byte[] GetBytesByPath(string path)
}
Signature -
MediaDescriptor -
BytesPerSector -
BytesPerCluster -
BytesPerFileRecord -
BytesPerIndexBlock -
ReservedSectors -
SectorsPerTrack -
NumberOfHeads -
HiddenSectors -
TotalSectors -
MFTStartIndex -
MFTMirrStartIndex -
VolumeSerialNumber -
CodeSection -
Name | Description |
---|---|
Get(string) | |
GetByPath(string) | |
GetBytes(string) | |
GetBytesByPath(string) |
Getting Started
- PowerForensics
- PowerForensics.Artifacts
- PowerForensics.Ntfs
- PowerForensics.Formats
- PowerForensics.Registry
- PowerForensics.Utilities
Cmdlets
- ConvertTo-ForensicTimeline
- Copy-ForensicFile
- Get-ForensicAlternateDataStream
- Get-ForensicAmcache
- Get-ForensicAttrDef
- Get-ForensicBitmap
- Get-ForensicBootSector
- Get-ForensicChildItem
- Get-ForensicContent
- Get-ForensicEventLog
- Get-ForensicFileRecord
- Get-ForensicFileRecordIndex
- Get-ForensicFileSlack
- Get-ForensicGuidPartitionTable
- Get-ForensicMasterBootRecord
- Get-ForensicMftSlack
- Get-ForensicNetworkList
- Get-ForensicPartitionTable
- Get-ForensicPrefetch
- Get-ForensicRegistryKey
- Get-ForensicRegistryValue
- Get-ForensicScheduledJob
- Get-ForensicSid
- Get-ForensicTimeline
- Get-ForensicTimezone
- Get-ForensicUnallocatedSpace
- Get-ForensicUserAssist
- Get-ForensicUsnJrnl
- Get-ForensicUsnJrnlInformation
- Get-ForensicVolumeBootRecord
- Get-ForensicVolumeInformation
- Get-ForensicVolumeName
- Invoke-ForensicDD