diff --git a/src/domain/windows/ntfsMft.test.ts b/src/domain/windows/ntfsMft.test.ts index 8706d3fc3c..9ed0712657 100644 --- a/src/domain/windows/ntfsMft.test.ts +++ b/src/domain/windows/ntfsMft.test.ts @@ -239,6 +239,20 @@ describe("MFT fixup coverage", () => { }, ); + it("counts uncovered sectors independently of a mismatched trailer", () => { + const parsed = parseMftImage( + recordOf({ recordBytes: 4096, usaEntries: 3, corruptSector: 0 }), + ); + if (!parsed.ok) throw new Error(parsed.error.message); + expect(parsed.value.metadata).toMatchObject({ + fixup_mismatch_count: 1, + fixup_unverified_record_count: 1, + }); + expect(parsed.value.limitations.join(" ")).toContain( + "invalid or incomplete", + ); + }); + it("reports an array that covers fewer sectors than the record has", () => { // A 4 KiB record holds eight sectors; a three-entry array leaves five unverified. const parsed = parseMftImage( diff --git a/src/domain/windows/ntfsMft.ts b/src/domain/windows/ntfsMft.ts index 8599c671f1..bc901e5e6d 100644 --- a/src/domain/windows/ntfsMft.ts +++ b/src/domain/windows/ntfsMft.ts @@ -284,7 +284,10 @@ const scanMft = ( if (record.directory) directoryCount += 1; if (record.baseRecordReference !== null) extensionCount += 1; if (record.fixups.mismatchSector !== null) mismatchCount += 1; - else if (record.fixups.verifiedSectors < recordBytes / FIXUP_SECTOR_BYTES) + if ( + record.fixups.malformed || + record.fixups.coveredSectors < recordBytes / FIXUP_SECTOR_BYTES + ) unverifiedCount += 1; if (!record.extentValid) { invalidExtents += 1;