#include?“stdafx.h“
#include?“Winuser.h“
#include?“NTFS.h“

//*************************************************類成員函數(shù)的實現(xiàn)****************************************************
//*************************************************類成員函數(shù)的實現(xiàn)****************************************************
//TODO:實現(xiàn)文件恢復的類
//定義小端數(shù)字轉(zhuǎn)換成大端數(shù)字
WORD?CNTFS_Recovery::DiskNumToRealNum（?IN?WORD?wNeedChange?）
{
????WORD?wReturn=0?;

????//截取wNeedChange低8位實際數(shù)高8位
????wReturn?=?wReturn|（?255&wNeedChange?）;
????wReturn=wReturn<<8;
????wReturn=wNeedChange>>8;
????wReturn?=?wReturn|（?255&wNeedChange?）;

????return?wReturn?;
}
DWORD?CNTFS_Recovery::DiskNumToRealNum（IN??DWORD?dwNeedChange?）
{
????DWORD?dwReturn=0?;

????//截取wNeedChange低8位實際數(shù)高8位
????for?（?int?i?=?0?;?i<3?;?i++?）
????{
????????dwReturn?=?dwReturn|（?255&dwNeedChange?）;
????????dwReturn=dwReturn<<8;
????????dwReturn=dwNeedChange>>8;
????}
????dwReturn?=?dwReturn|（?255&dwNeedChange?）;
????return?dwReturn?;
}
QWORD?CNTFS_Recovery::DiskNumToRealNum（IN?QWORD?qwNeedChange?）
{
????QWORD?qwReturn=0?;

????//截取wNeedChange低8位實際數(shù)高8位
????for?（?int?i?=?0?;?i<7?;?i++?）
????{
????????qwReturn?=?qwReturn|（?255&qwNeedChange?）;
????????qwReturn=qwReturn<<8;
????????qwReturn=qwNeedChange>>8;
????}
????qwReturn?=?qwReturn|（?255&qwNeedChange?）;
????return?qwReturn?;
}

//實現(xiàn)讀取磁盤數(shù)據(jù)的函數(shù)一次性最大可讀65535字節(jié)
BOOL?CNTFS_Recovery::ReadDiskData（IN?HANDLE?hFile??IN?QWORD?qwStartByte??IN?DWORD?qwLength?OUT?LPVOID?lpData?）
{
????DWORD?dwCB?;

????//將qwStartByteqwLength用512整倍字節(jié)長度替代
????DWORD?dOffsetBytes?=?qwStartByte%512;???????????????????????????????????????//dOffset為qwStartByte距離qwStartByte所在扇區(qū)的偏移地址
????QWORD?qwOffsetSectors?=?qwStartByte/512?;???????????????????????????????????//dOffsetStartSectors為讀取數(shù)據(jù)的起始扇區(qū)
????DWORD?dLengthAwayEnd?=?（?512?-（qwLength?+?dOffsetBytes?）%512?）%512;?????????//應讀取的數(shù)據(jù)尾距離本扇區(qū)的末尾距離
????LARGE_INTEGER?llOffset?;
????llOffset.QuadPart?=?（QWORD）（?qwOffsetSectors*512?）;?????????????????????????//llOffset.QuadPart為實際讀取的起始字節(jié)位置

????//設置文件句柄位置
????if?（?INVALID_SET_FILE_POINTER?==?SetFilePointer（?hFile??llOffset.LowPart??&llOffset.HighPart??FILE_BEGIN?））
????{
????????return?FALSE?;
????}
????//讀取文件數(shù)據(jù)
????DWORD?dLength?=?（?qwLength?+?dOffsetBytes?+?dLengthAwayEnd?）>65024???65024?:?（?qwLength?+?dOffsetBytes?+?dLengthAwayEnd?）?;
?
????CHAR?*lpBuffer?=?（CHAR?*）malloc（dLength+1）;

????ZeroMemory（?lpBuffer??sizeof（lpBuffer）?）;

????if?（?!ReadFile（?hFile??lpBuffer?dLength??&?dwCB??NULL?）?）
????{
????????return?FALSE?;
????}
????memcpy（?lpData??lpBuffer+dOffsetBytes??qwLength?）;

????free（lpBuffer）;

????return?TRUE?;
}

//實現(xiàn)讀取指定驅(qū)動器盤的函數(shù)
BOOL?CNTFS_Recovery::ReadDriverData（?IN?CHAR?*pcDriver?IN??QWORD?qwStartByte?IN?DWORD?dwLength?OUT?LPVOID?lpData?）?
{
????TCHAR?szFilePath[255]={0};

????wsprintf（?szFilePath??L“\\\\.\\%s:“??pcDriver?）;

????//根據(jù)路徑獲取物理磁盤指針
????HANDLE?hDevice?=?CreateFile（?szFilePathGENERIC_READ|GENERIC_WRITEFILE_SHARE_RE

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件??????61773??2012-05-12?19:35??NTFS.cpp

?????文件??????28336??2012-05-11?16:17??NTFS.h

-----------?---------??----------?-----??----

????????????????90109????????????????????2