From 58edc316388ca6f11ae99cb834ccafc710da5308 Mon Sep 17 00:00:00 2001
From: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Date: Wed, 11 Nov 2026 02:18:23 +0000
Subject: [PATCH] fix(ntfs): leave unused MFT reference identities unresolved

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
---
 src/domain/windows/ntfsJournalCorrelation.test.ts | 10 ++++++++++
 src/domain/windows/ntfsJournalCorrelation.ts      |  1 +
 2 files changed, 11 insertions(+)

diff --git a/src/domain/windows/ntfsJournalCorrelation.test.ts b/src/domain/windows/ntfsJournalCorrelation.test.ts
index 6dd9368718..701991d807 100644
--- a/src/domain/windows/ntfsJournalCorrelation.test.ts
+++ b/src/domain/windows/ntfsJournalCorrelation.test.ts
@@ -53,6 +53,16 @@ it("uses the MFT decoder's record identity verdict", () => {
   ).toEqual({ kind: "unresolved" });
 });
 
+it("leaves unused zero-sequence records unresolved", () => {
+  const correlate = createUsnMftCorrelator([
+    { ...baseRecord, sequenceNumber: 0 },
+  ]);
+  expect(correlate({ fileReference: 7n, parentReference: 7n })).toEqual({
+    file: { kind: "unresolved" },
+    parent: { kind: "unresolved" },
+  });
+});
+
 it("keeps duplicates ambiguous and skips extensions and unverified records", () => {
   const correlate = createUsnMftCorrelator([
     baseRecord,
diff --git a/src/domain/windows/ntfsJournalCorrelation.ts b/src/domain/windows/ntfsJournalCorrelation.ts
index ac35b31719..767add19e3 100644
--- a/src/domain/windows/ntfsJournalCorrelation.ts
+++ b/src/domain/windows/ntfsJournalCorrelation.ts
@@ -37,6 +37,7 @@ export const createUsnMftCorrelator = (
     // logical MFT stream. Extension records do not identify separate files.
     if (
       record.baseRecordReference !== null ||
+      record.sequenceNumber === 0 ||
       !record.extentValid ||
       record.fixups.verifiedSectors * FIXUP_SECTOR_BYTES !== record.totalBytes
     )