private void ProcessMtpType1(byte[] rawBytes)
{
FriendlyName = "Variable: MTP type 1";
//if (rawBytes.Length == 732)
//{
// Debug.WriteLine("Pausing for documented info from http://nicoleibrahim.com/part-5-usb-device-research-directory-traversal-artifacts-shell-bagmru-entries/");
//}
var index = 0x1a;
var modified = DateTimeOffset.FromFileTime((long) BitConverter.ToUInt64(rawBytes, index));
LastModificationTime = modified.ToUniversalTime();
index += 8;
var created = DateTimeOffset.FromFileTime((long) BitConverter.ToUInt64(rawBytes, index));
CreatedOnTime = created.ToUniversalTime();
index += 8;
var rawGuid = rawBytes.Skip(index).Take(16).ToArray();
var guidString = Utils.ExtractGuidFromShellItem(rawGuid);
_mtpType1GuidName = Utils.GetFolderNameFromGuid(guidString);
index = 0x3e;
var storageStringNameLen = BitConverter.ToInt32(rawBytes, index);
index += 4;
var storageIdStringLen = BitConverter.ToInt32(rawBytes, index);
index += 4;
var fileSystemNameLen = BitConverter.ToInt32(rawBytes, index);
index += 4;
var storageName = Encoding.Unicode.GetString(rawBytes, index, storageStringNameLen*2 - 2);
index += storageStringNameLen*2;
_storageIdName = Encoding.Unicode.GetString(rawBytes, index, storageIdStringLen*2 - 2);
index += storageIdStringLen*2;
_fileSystemName = Encoding.Unicode.GetString(rawBytes, index, fileSystemNameLen*2 - 2);
index += fileSystemNameLen*2;
//TODO pull out modified time/created for OLE?
if (storageName.Length > 0)
{
if (storageName == _storageIdName)
{
Value = storageName;
}
else
{
Value = $"{storageName} ({_storageIdName})";
}
}
else
{
Value = _storageIdName;
}
}