From 7712e3185ee15c8cac4ac001a7cc7de89c9fc901 Mon Sep 17 00:00:00 2001 From: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com> Date: Wed, 11 Nov 2026 01:15:46 +0000 Subject: [PATCH] fix(ntfs): retain incomplete coverage alongside fixup mismatches Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com> --- src/domain/windows/ntfsMft.test.ts | 14 ++++++++++++++ src/domain/windows/ntfsMft.ts | 5 ++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/domain/windows/ntfsMft.test.ts b/src/domain/windows/ntfsMft.test.ts index 8706d3fc3c..9ed0712657 100644 --- a/src/domain/windows/ntfsMft.test.ts +++ b/src/domain/windows/ntfsMft.test.ts @@ -239,6 +239,20 @@ describe("MFT fixup coverage", () => { }, ); + it("counts uncovered sectors independently of a mismatched trailer", () => { + const parsed = parseMftImage( + recordOf({ recordBytes: 4096, usaEntries: 3, corruptSector: 0 }), + ); + if (!parsed.ok) throw new Error(parsed.error.message); + expect(parsed.value.metadata).toMatchObject({ + fixup_mismatch_count: 1, + fixup_unverified_record_count: 1, + }); + expect(parsed.value.limitations.join(" ")).toContain( + "invalid or incomplete", + ); + }); + it("reports an array that covers fewer sectors than the record has", () => { // A 4 KiB record holds eight sectors; a three-entry array leaves five unverified. const parsed = parseMftImage( diff --git a/src/domain/windows/ntfsMft.ts b/src/domain/windows/ntfsMft.ts index 8599c671f1..bc901e5e6d 100644 --- a/src/domain/windows/ntfsMft.ts +++ b/src/domain/windows/ntfsMft.ts @@ -284,7 +284,10 @@ const scanMft = ( if (record.directory) directoryCount += 1; if (record.baseRecordReference !== null) extensionCount += 1; if (record.fixups.mismatchSector !== null) mismatchCount += 1; - else if (record.fixups.verifiedSectors < recordBytes / FIXUP_SECTOR_BYTES) + if ( + record.fixups.malformed || + record.fixups.coveredSectors < recordBytes / FIXUP_SECTOR_BYTES + ) unverifiedCount += 1; if (!record.extentValid) { invalidExtents += 1;