diff --git a/src/artifacts/NtfsMftArtifactReader.test.ts b/src/artifacts/NtfsMftArtifactReader.test.ts
index a5990944d2..6e0cba06f4 100644
--- a/src/artifacts/NtfsMftArtifactReader.test.ts
+++ b/src/artifacts/NtfsMftArtifactReader.test.ts
@@ -28,7 +28,8 @@ const recordBytes = (options: {
   record.writeUInt16LE(1, 18);
   record.writeUInt16LE(56, 20);
   record.writeUInt16LE(options.flags ?? 0x0001, 22);
-  record.writeUInt32LE(56, 24);
+  record.writeUInt32LE(64, 24);
+  record.writeUInt32LE(0xffff_ffff, 56);
   record.writeUInt32LE(MFT_DEFAULT_RECORD_BYTES, 28);
   record.writeUInt16LE(sequenceNumber, 510);
   record.writeUInt16LE(sequenceNumber, 1022);
diff --git a/src/domain/windows/ntfsMft.test.ts b/src/domain/windows/ntfsMft.test.ts
index 9439cec8ff..fa72a2de27 100644
--- a/src/domain/windows/ntfsMft.test.ts
+++ b/src/domain/windows/ntfsMft.test.ts
@@ -60,7 +60,8 @@ const recordOf = (options: RecordOptions = {}): Uint8Array => {
     Math.ceil((48 + Math.max(0, usaEntries) * 2) / 8) * 8;
   view.setUint16(20, firstAttributeOffset, true);
   view.setUint16(22, options.flags ?? 0x0001, true);
-  view.setUint32(24, firstAttributeOffset, true);
+  view.setUint32(24, firstAttributeOffset + 8, true);
+  view.setUint32(firstAttributeOffset, 0xffff_ffff, true);
   view.setUint32(28, recordBytes, true);
   view.setBigUint64(32, options.baseRecordReference ?? 0n, true);
   view.setUint16(40, 0, true);
@@ -123,7 +124,7 @@ describe("MFT header facts", () => {
     });
   });
 
-  it.each([0, 49, 64])(
+  it.each([0, 49, 64, 72])(
     "reports an invalid first attribute offset %i",
     (offset) => {
       const record = recordOf();
diff --git a/src/domain/windows/ntfsMft.ts b/src/domain/windows/ntfsMft.ts
index 3ecfc5d89e..b24d1067df 100644
--- a/src/domain/windows/ntfsMft.ts
+++ b/src/domain/windows/ntfsMft.ts
@@ -381,7 +381,7 @@ const readRecord = (
       usedBytes <= totalBytes &&
       firstAttributeOffset % 8 === 0 &&
       firstAttributeOffset >= NTFS_MFT_MIN_RECORD_BYTES &&
-      firstAttributeOffset <= usedBytes &&
+      firstAttributeOffset + 4 <= usedBytes &&
       (fixups.malformed ||
         firstAttributeOffset >= usaOffset + fixups.entries * 2),
     baseRecordReference:
diff --git a/tests/boundary/mcp/ntfsMftAdmission.test.ts b/tests/boundary/mcp/ntfsMftAdmission.test.ts
index 61e2ff4b16..ebe108a3bc 100644
--- a/tests/boundary/mcp/ntfsMftAdmission.test.ts
+++ b/tests/boundary/mcp/ntfsMftAdmission.test.ts
@@ -47,7 +47,9 @@ mcpTest(
     record.writeUInt16LE(42, 4);
     record.writeUInt16LE(3, 6);
     record.writeUInt16LE(1, 16);
-    record.writeUInt32LE(56, 24);
+    record.writeUInt16LE(56, 20);
+    record.writeUInt32LE(64, 24);
+    record.writeUInt32LE(0xffff_ffff, 56);
     record.writeUInt32LE(1024, 28);
     record.writeUInt16LE(5, 42);
     record.writeUInt16LE(5, 510);