Lnk.ShellItems.ShellBag0X00.ProcessMtpType1 C# (CSharp) Method

ProcessMtpType1() private method

private ProcessMtpType1 ( byte rawBytes ) : void
rawBytes byte
return void
        private void ProcessMtpType1(byte[] rawBytes)
        {
            FriendlyName = "Variable: MTP type 1";

            //if (rawBytes.Length == 732)
            //{
            //    Debug.WriteLine("Pausing for documented info from http://nicoleibrahim.com/part-5-usb-device-research-directory-traversal-artifacts-shell-bagmru-entries/");
            //}

            var index = 0x1a;

            var modified = DateTimeOffset.FromFileTime((long) BitConverter.ToUInt64(rawBytes, index));

            LastModificationTime = modified.ToUniversalTime();

            index += 8;

            var created = DateTimeOffset.FromFileTime((long) BitConverter.ToUInt64(rawBytes, index));

            CreatedOnTime = created.ToUniversalTime();

            index += 8;

            var rawGuid = rawBytes.Skip(index).Take(16).ToArray();
            var guidString = Utils.ExtractGuidFromShellItem(rawGuid);
            _mtpType1GuidName = Utils.GetFolderNameFromGuid(guidString);

            index = 0x3e;

            var storageStringNameLen = BitConverter.ToInt32(rawBytes, index);

            index += 4;

            var storageIdStringLen = BitConverter.ToInt32(rawBytes, index);

            index += 4;

            var fileSystemNameLen = BitConverter.ToInt32(rawBytes, index);

            index += 4;

            var storageName = Encoding.Unicode.GetString(rawBytes, index, storageStringNameLen*2 - 2);

            index += storageStringNameLen*2;

            _storageIdName = Encoding.Unicode.GetString(rawBytes, index, storageIdStringLen*2 - 2);

            index += storageIdStringLen*2;

            _fileSystemName = Encoding.Unicode.GetString(rawBytes, index, fileSystemNameLen*2 - 2);

            index += fileSystemNameLen*2;

            //TODO pull out modified time/created for OLE?

            if (storageName.Length > 0)
            {
                if (storageName == _storageIdName)
                {
                    Value = storageName;
                }
                else
                {
                    Value = $"{storageName} ({_storageIdName})";
                }
            }
            else
            {
                Value = _storageIdName;
            }
        }