Upload FastSeekWpf/Core/MftReader.cs

FastSeekWpf/Core/MftReader.cs

@@ -3,7 +3,6 @@ using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.IO;
 using System.Runtime.InteropServices;
-using System.Security.Principal;
 using FastSeekWpf.NativeInterop;
 
 namespace FastSeekWpf.Core;
@@ -12,218 +11,148 @@ public class MftReader : IDisposable
 {
     private readonly IntPtr _volumeHandle;
     private readonly NtfsDrive _drive;
-    private readonly int _recordSize;
-    private readonly long _mftByteOffset;
     private bool _disposed;
 
-    private const int FallbackBuf = 4 * 1024 * 1024;
-    private const int DirectBuf = 4 * 1024 * 1024;
+    private const int FALLBACK_BUF = 4 * 1024 * 1024;
+    private const int DIRECT_BUF = 4 * 1024 * 1024;
 
     public NtfsDrive Drive => _drive;
 
     public MftReader(NtfsDrive drive)
     {
         _drive = drive;
-        _volumeHandle = Win32Api.CreateFileW(
-            drive.DevicePath,
-            Win32Api.GENERIC_READ,
-            Win32Api.FILE_SHARE_READ | Win32Api.FILE_SHARE_WRITE | Win32Api.FILE_SHARE_DELETE,
-            IntPtr.Zero,
-            Win32Api.OPEN_EXISTING,
-            Win32Api.FILE_FLAG_BACKUP_SEMANTICS,
-            IntPtr.Zero);
+
+        // Open volume device for boot sector read (matches Rust MftReader::open exactly)
+        var pathBytes = System.Text.Encoding.Unicode.GetBytes(drive.DevicePath + '\0');
+        GCHandle pathHandle = GCHandle.Alloc(pathBytes, GCHandleType.Pinned);
+        try
+        {
+            _volumeHandle = Win32Api.CreateFileW(
+                drive.DevicePath,
+                Win32Api.GENERIC_READ,
+                Win32Api.FILE_SHARE_READ | Win32Api.FILE_SHARE_WRITE | Win32Api.FILE_SHARE_DELETE,
+                IntPtr.Zero,
+                Win32Api.OPEN_EXISTING,
+                Win32Api.FILE_FLAG_BACKUP_SEMANTICS,
+                IntPtr.Zero);
+        }
+        finally
+        {
+            pathHandle.Free();
+        }
 
         if (_volumeHandle == new IntPtr(-1))
         {
             int err = Marshal.GetLastWin32Error();
             throw new IOException($"Failed to open volume {drive.DevicePath}: {Win32Error(err)} (code={err})");
         }
-
-        // Read boot sector once and cache record size + MFT offset
-        var bootInfo = ReadBootSector();
-        if (!bootInfo.HasValue)
-            throw new IOException("Failed to read NTFS boot sector");
-
-        _recordSize = bootInfo.Value.recordSize;
-        _mftByteOffset = bootInfo.Value.mftOffset;
     }
 
     // ------------------------------------------------------------------
-    //  Scan methods — try in order: $MFT file → volume raw → FSCTL
+    //  Primary: direct $MFT file read (matches Rust scan_direct exactly)
     // ------------------------------------------------------------------
 
-    /// <summary>
-    /// Try all scan methods and return the first that works.
-    /// </summary>
-    public ScanResult ScanAny()
+    public ScanResult? ScanDirect()
     {
-        // 1. Try $MFT file (fastest, matches Rust)
-        var direct = ScanDirect();
-        if (direct != null && direct.Records.Count > 0)
-        {
-            Logger.Log($"[{Drive.Letter}] Using direct $MFT file scan: {direct.Records.Count} records");
-            return direct;
-        }
+        int? recordSize = ReadMftRecordSize();
+        if (!recordSize.HasValue) return null;
 
-        // 2. Try reading raw from volume handle
-        var vol = ScanDirectVolume();
-        if (vol != null && vol.Records.Count > 0)
-        {
-            Logger.Log($"[{Drive.Letter}] Using volume raw scan: {vol.Records.Count} records");
-            return vol;
-        }
+        string mftPath = $"{_drive.Root}$MFT";
+        Logger.Log($"[{Drive.Letter}] Opening $MFT: {mftPath}");
 
-        // 3. FSCTL fallback (slowest but most compatible)
-        var fallback = Scan();
-        if (fallback.Records.Count > 0)
+        IntPtr mftHandle = OpenMftFile(mftPath);
+        if (mftHandle == new IntPtr(-1))
         {
-            Logger.Log($"[{Drive.Letter}] Using FSCTL fallback scan: {fallback.Records.Count} records");
-            return fallback;
+            // Try extended-length path prefix as fallback
+            string extendedPath = $"\\\\?\\{mftPath}";
+            Logger.Log($"[{Drive.Letter}] Retrying with extended path: {extendedPath}");
+            mftHandle = OpenMftFile(extendedPath);
         }
 
-        Logger.Log($"[{Drive.Letter}] ALL scan methods returned 0 records");
-        return fallback;
-    }
-
-    /// <summary>
-    /// Direct $MFT file read. Matches Rust scan_direct().
-    /// </summary>
-    public ScanResult? ScanDirect()
-    {
-        string mftPath = $"{_drive.Root}$MFT";
-        Logger.Log($"[{Drive.Letter}] Opening $MFT file: {mftPath}");
-
-        IntPtr mftHandle = Win32Api.CreateFileW(
-            mftPath,
-            Win32Api.GENERIC_READ,
-            Win32Api.FILE_SHARE_READ | Win32Api.FILE_SHARE_WRITE | Win32Api.FILE_SHARE_DELETE,
-            IntPtr.Zero,
-            Win32Api.OPEN_EXISTING,
-            Win32Api.FILE_FLAG_BACKUP_SEMANTICS | Win32Api.FILE_FLAG_SEQUENTIAL_SCAN,
-            IntPtr.Zero);
-
         if (mftHandle == new IntPtr(-1))
         {
             int err = Marshal.GetLastWin32Error();
-            Logger.Log($"[{Drive.Letter}] CreateFileW({mftPath}) failed: {Win32Error(err)} (code={err})");
+            Logger.Log($"[{Drive.Letter}] CreateFileW($MFT) failed: {Win32Error(err)} (code={err})");
             return null;
         }
 
         try
         {
-            var result = ScanFromHandle(mftHandle, "direct-file");
-            return result;
-        }
-        finally
-        {
-            Win32Api.CloseHandle(mftHandle);
-        }
-    }
+            var records = new List<CompactRecord>();
+            var nameData = new List<char>();
+            byte[] buffer = new byte[DIRECT_BUF];
+            ulong mftIndex = 0;
+            int leftover = 0;
 
-    /// <summary>
-    /// Read MFT records directly from the volume handle at the boot-sector offset.
-    /// Fallback when $MFT file is blocked.
-    /// </summary>
-    public ScanResult? ScanDirectVolume()
-    {
-        Logger.Log($"[{Drive.Letter}] Attempting volume raw read at offset {_mftByteOffset}...");
-
-        bool ok = Win32Api.SetFilePointerEx(_volumeHandle, _mftByteOffset, out _, 0);
-        if (!ok)
-        {
-            int err = Marshal.GetLastWin32Error();
-            Logger.Log($"[{Drive.Letter}] Seek to MFT offset failed: {Win32Error(err)} (code={err})");
-            return null;
-        }
+            while (true)
+            {
+                uint bytesRead = 0;
+                bool ok = Win32Api.ReadFile(
+                    mftHandle, buffer, leftover, (uint)(buffer.Length - leftover), out bytesRead, IntPtr.Zero);
 
-        try
-        {
-            var result = ScanFromHandle(_volumeHandle, "direct-volume");
-            return result;
-        }
-        catch (Exception ex)
-        {
-            Logger.Log($"[{Drive.Letter}] Volume raw read failed: {ex.Message}");
-            return null;
-        }
-    }
+                if (!ok || bytesRead == 0)
+                    break;
 
-    /// <summary>
-    /// Common scan loop used by both direct-file and direct-volume.
-    /// </summary>
-    private ScanResult ScanFromHandle(IntPtr handle, string methodName)
-    {
-        var records = new List<CompactRecord>();
-        var nameData = new List<char>();
-        byte[] buffer = new byte[DirectBuf];
-        ulong mftIndex = 0;
-        int leftover = 0;
-        long totalRead = 0;
+                int total = leftover + (int)bytesRead;
+                int offset = 0;
 
-        while (true)
-        {
-            bool ok = Win32Api.ReadFile(
-                handle, buffer, leftover, (uint)(buffer.Length - leftover), out uint bytesRead, IntPtr.Zero);
-            if (!ok)
-            {
-                int err = Marshal.GetLastWin32Error();
-                if (err == 38) // ERROR_HANDLE_EOF
+                while (offset + recordSize.Value <= total)
                 {
-                    Logger.Log($"[{Drive.Letter}] {methodName}: EOF at offset {totalRead}");
-                    break;
+                    bool applied = ApplyFixup(buffer, offset, recordSize.Value);
+                    if (applied)
+                    {
+                        ParseFileRecord(
+                            buffer.AsSpan(offset, recordSize.Value),
+                            mftIndex,
+                            records,
+                            nameData);
+                    }
+
+                    mftIndex += 1;
+                    offset += recordSize.Value;
                 }
-                Logger.Log($"[{Drive.Letter}] {methodName}: ReadFile failed at offset {totalRead}: {Win32Error(err)} (code={err})");
-                break;
-            }
-            if (bytesRead == 0)
-            {
-                Logger.Log($"[{Drive.Letter}] {methodName}: ReadFile returned 0 bytes at offset {totalRead} — EOF");
-                break;
-            }
 
-            totalRead += bytesRead;
-            int total = leftover + (int)bytesRead;
-            int offset = 0;
+                // Align down to record boundary (matches Rust: offset = total - (total % record_size))
+                offset = total - (total % recordSize.Value);
 
-            while (offset + _recordSize <= total)
-            {
-                bool applied = ApplyFixup(buffer, offset, _recordSize);
-                if (applied)
+                leftover = total - offset;
+                if (leftover > 0)
                 {
-                    ParseFileRecord(buffer.AsSpan(offset, _recordSize), mftIndex, records, nameData);
+                    // Copy tail to front of buffer (matches Rust std::ptr::copy)
+                    Buffer.BlockCopy(buffer, offset, buffer, 0, leftover);
                 }
-                mftIndex++;
-                offset += _recordSize;
             }
 
-            offset = total - (total % _recordSize);
-            leftover = total - offset;
-            if (leftover > 0)
-                Array.Copy(buffer, offset, buffer, 0, leftover);
-
-            if (mftIndex % 50000 == 0)
-                Logger.Log($"[{Drive.Letter}] {methodName}: {mftIndex:N0} records parsed, {records.Count:N0} valid");
+            Logger.Log($"[{Drive.Letter}] Direct scan: {records.Count} records from {mftIndex} positions");
+            return new ScanResult(records, nameData);
+        }
+        finally
+        {
+            Win32Api.CloseHandle(mftHandle);
         }
-
-        Logger.Log($"[{Drive.Letter}] {methodName}: {records.Count} records from {mftIndex} positions, {totalRead:N0} bytes read");
-        return new ScanResult(records, nameData);
     }
 
-    /// <summary>
-    /// FSCTL_ENUM_USN_DATA fallback.
-    /// </summary>
-    public ScanResult Scan()
+    private static IntPtr OpenMftFile(string path)
     {
-        Logger.Log($"[{Drive.Letter}] Starting FSCTL_ENUM_USN_DATA fallback...");
-        Logger.Log($"[{Drive.Letter}] MFT_ENUM_DATA_V0 size = {Marshal.SizeOf<MFT_ENUM_DATA_V0>()} bytes");
-        Logger.Log($"[{Drive.Letter}] USN_RECORD_V2 size = {Marshal.SizeOf<USN_RECORD_V2>()} bytes");
+        return Win32Api.CreateFileW(
+            path,
+            Win32Api.GENERIC_READ,
+            Win32Api.FILE_SHARE_READ | Win32Api.FILE_SHARE_WRITE | Win32Api.FILE_SHARE_DELETE,
+            IntPtr.Zero,
+            Win32Api.OPEN_EXISTING,
+            Win32Api.FILE_FLAG_BACKUP_SEMANTICS | Win32Api.FILE_FLAG_SEQUENTIAL_SCAN,
+            IntPtr.Zero);
+    }
 
-        // Diagnostic: test FSCTL_QUERY_USN_JOURNAL
-        TestUsnJournal();
+    // ------------------------------------------------------------------
+    //  Fallback: FSCTL_ENUM_USN_DATA (matches Rust scan exactly)
+    // ------------------------------------------------------------------
 
+    public ScanResult Scan()
+    {
         var records = new List<CompactRecord>();
         var nameData = new List<char>();
-        byte[] buffer = new byte[FallbackBuf];
+        byte[] buffer = new byte[FALLBACK_BUF];
 
         var enumData = new MFT_ENUM_DATA_V0
         {
@@ -245,28 +174,33 @@ public class MftReader : IDisposable
                 IntPtr bufferPtr = Marshal.AllocHGlobal(buffer.Length);
                 try
                 {
+                    uint bytesReturned = 0;
                     bool ok = Win32Api.DeviceIoControl(
-                        _volumeHandle, Win32Api.FSCTL_ENUM_USN_DATA,
-                        enumDataPtr, (uint)enumDataSize,
-                        bufferPtr, (uint)buffer.Length,
-                        out uint bytesReturned,
+                        _volumeHandle,
+                        Win32Api.FSCTL_ENUM_USN_DATA,
+                        enumDataPtr,
+                        (uint)enumDataSize,
+                        bufferPtr,
+                        (uint)buffer.Length,
+                        out bytesReturned,
                         IntPtr.Zero);
 
                     if (!ok)
                     {
                         int error = Marshal.GetLastWin32Error();
-                        if ((uint)error == 0x26) // ERROR_HANDLE_EOF
+                        uint code = (uint)error;
+                        if (code == 0x80070026) // ERROR_HANDLE_EOF
                         {
                             Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: EOF after {iterations} iterations");
                             break;
                         }
                         if (error == 122) // ERROR_INSUFFICIENT_BUFFER
                         {
-                            Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA: buffer too small ({buffer.Length}), retrying");
+                            Logger.Log($"[{Drive.Letter}] FSCTL buffer too small, retrying with {buffer.Length * 2}");
                             buffer = new byte[buffer.Length * 2];
                             continue;
                         }
-                        Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA failed (iter {iterations}): {Win32Error(error)} (code={error})");
+                        Logger.Log($"[{Drive.Letter}] FSCTL_ENUM_USN_DATA failed: {Win32Error(error)} (code={error})");
                         break;
                     }
 
@@ -281,13 +215,15 @@ public class MftReader : IDisposable
                     Marshal.StructureToPtr(enumData, enumDataPtr, false);
 
                     int offset = 8;
-                    while (offset + Marshal.SizeOf<USN_RECORD_V2>() <= (int)bytesReturned)
+                    int usnRecordSize = Marshal.SizeOf<USN_RECORD_V2>();
+                    while (offset + usnRecordSize <= (int)bytesReturned)
                     {
                         IntPtr recordPtr = IntPtr.Add(bufferPtr, offset);
                         var record = Marshal.PtrToStructure<USN_RECORD_V2>(recordPtr);
 
                         int recLen = (int)record.RecordLength;
-                        if (recLen == 0 || offset + recLen > (int)bytesReturned) break;
+                        if (recLen == 0 || offset + recLen > (int)bytesReturned)
+                            break;
 
                         int nameOffset = offset + (int)record.FileNameOffset;
                         int nameLen = record.FileNameLength / 2;
@@ -327,74 +263,38 @@ public class MftReader : IDisposable
     }
 
     // ------------------------------------------------------------------
-    //  Diagnostics
+    //  NTFS helpers (match Rust exactly)
     // ------------------------------------------------------------------
 
-    private void TestUsnJournal()
+    private int? ReadMftRecordSize()
     {
-        Logger.Log($"[{Drive.Letter}] Diagnostic: testing FSCTL_QUERY_USN_JOURNAL...");
-        IntPtr journalBuf = Marshal.AllocHGlobal(Marshal.SizeOf<USN_JOURNAL_DATA_V0>());
-        try
-        {
-            bool ok = Win32Api.DeviceIoControl(
-                _volumeHandle, Win32Api.FSCTL_QUERY_USN_JOURNAL,
-                IntPtr.Zero, 0,
-                journalBuf, (uint)Marshal.SizeOf<USN_JOURNAL_DATA_V0>(),
-                out uint bytesReturned, IntPtr.Zero);
-            if (ok)
-            {
-                var journalData = Marshal.PtrToStructure<USN_JOURNAL_DATA_V0>(journalBuf);
-                Logger.Log($"[{Drive.Letter}] USN journal OK: ID={journalData.UsnJournalID}, NextUsn={journalData.NextUsn}");
-            }
-            else
-            {
-                int err = Marshal.GetLastWin32Error();
-                Logger.Log($"[{Drive.Letter}] FSCTL_QUERY_USN_JOURNAL failed: {Win32Error(err)} (code={err})");
-            }
-        }
-        finally
-        {
-            Marshal.FreeHGlobal(journalBuf);
-        }
-    }
-
-    // ------------------------------------------------------------------
-    //  NTFS helpers
-    // ------------------------------------------------------------------
-
-    private (int recordSize, long mftOffset)? ReadBootSector()
-    {
-        Logger.Log($"[{Drive.Letter}] Reading boot sector from volume...");
+        // Seek to start of volume
         Win32Api.SetFilePointerEx(_volumeHandle, 0, out _, 0);
 
         byte[] boot = new byte[512];
-        bool ok = Win32Api.ReadFile(_volumeHandle, boot, 512, out uint br, IntPtr.Zero);
+        uint br = 0;
+        bool ok = Win32Api.ReadFile(_volumeHandle, boot, 512, out br, IntPtr.Zero);
         if (!ok || br < 512)
-        {
-            int err = Marshal.GetLastWin32Error();
-            Logger.Log($"[{Drive.Letter}] Boot sector read failed: {Win32Error(err)} (code={err})");
             return null;
-        }
 
         if (boot[3] != 'N' || boot[4] != 'T' || boot[5] != 'F' || boot[6] != 'S')
-        {
-            Logger.Log($"[{Drive.Letter}] Not NTFS (missing signature at offset 3)");
             return null;
-        }
 
         ushort bytesPerSector = BinaryPrimitives.ReadUInt16LittleEndian(boot.AsSpan(0x0B, 2));
         byte sectorsPerCluster = boot[0x0D];
         int clusterSize = bytesPerSector * sectorsPerCluster;
 
-        long mftStartLcn = BinaryPrimitives.ReadInt64LittleEndian(boot.AsSpan(0x30, 8));
         sbyte raw = (sbyte)boot[0x40];
         int recordSize = raw > 0 ? raw * clusterSize : 1 << (-raw);
-        long mftOffset = mftStartLcn * clusterSize;
 
-        Logger.Log($"[{Drive.Letter}] Boot OK: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, recordSize={recordSize}, mftLcn={mftStartLcn}, mftOffset={mftOffset}");
-        return (recordSize, mftOffset);
+        Logger.Log($"[{Drive.Letter}] Boot: bps={bytesPerSector}, spc={sectorsPerCluster}, clusterSize={clusterSize}, recordSize={recordSize}");
+        return recordSize;
     }
 
+    /// <summary>
+    /// Apply NTFS multi-sector fixup. Returns false if record is invalid.
+    /// CRITICAL: restores bytes from fixup array back to sector ends (matches Rust exactly).
+    /// </summary>
     private static bool ApplyFixup(byte[] record, int offset, int recordSize)
     {
         if (recordSize < 48 || record[offset] != 'F' || record[offset + 1] != 'I'
@@ -418,6 +318,7 @@ public class MftReader : IDisposable
             if (record[offset + end] != check0 || record[offset + end + 1] != check1)
                 return false;
 
+            // RESTORE real bytes from fixup array (this is what Rust does)
             record[offset + end] = record[offset + fixupOff + i * 2];
             record[offset + end + 1] = record[offset + fixupOff + i * 2 + 1];
         }
@@ -425,6 +326,9 @@ public class MftReader : IDisposable
         return true;
     }
 
+    /// <summary>
+    /// Parse one MFT FILE record (matches Rust parse_file_record exactly).
+    /// </summary>
     private static void ParseFileRecord(
         ReadOnlySpan<byte> record,
         ulong mftIndex,
@@ -432,7 +336,7 @@ public class MftReader : IDisposable
         List<char> nameData)
     {
         ushort flags = BinaryPrimitives.ReadUInt16LittleEndian(record.Slice(0x16, 2));
-        if ((flags & 0x01) == 0) return;
+        if ((flags & 0x01) == 0) return; // Record not in use
 
         bool isDir = (flags & 0x02) != 0;
         ushort seq = BinaryPrimitives.ReadUInt16LittleEndian(record.Slice(0x10, 2));
@@ -452,7 +356,7 @@ public class MftReader : IDisposable
             uint alen = BinaryPrimitives.ReadUInt32LittleEndian(record.Slice(aoff + 4, 4));
             if (alen == 0 || aoff + alen > record.Length) break;
 
-            if (atype == 0x30 && record[aoff + 8] == 0)
+            if (atype == 0x30 && record[aoff + 8] == 0) // $FILE_NAME, resident
             {
                 uint vlen = BinaryPrimitives.ReadUInt32LittleEndian(record.Slice(aoff + 16, 4));
                 ushort voff = BinaryPrimitives.ReadUInt16LittleEndian(record.Slice(aoff + 20, 2));
@@ -466,7 +370,7 @@ public class MftReader : IDisposable
 
                     if (vs + 66 + nlen * 2 <= record.Length)
                     {
-                        if (ns == 2)
+                        if (ns == 2) // DOS 8.3 name — skip
                         {
                             aoff += (int)alen;
                             continue;
@@ -474,9 +378,9 @@ public class MftReader : IDisposable
 
                         byte priority = ns switch
                         {
-                            1 => 0,
-                            3 => 1,
-                            0 => 2,
+                            1 => 0, // Win32
+                            3 => 1, // Win32 + DOS
+                            0 => 2, // POSIX
                             _ => 3,
                         };