fix(ntfs): exclude invalid MFT extents from journal matching

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

src/domain/windows/ntfsJournalCorrelation.test.ts

@@ -7,6 +7,7 @@ const baseRecord = {
   sequenceNumber: 2,
   fileOffset: 7168,
   totalBytes: 1024,
+  extentValid: true,
   baseRecordReference: null,
   declaredRecordNumber: 7,
   fixups: {
@@ -52,6 +53,15 @@ it("keeps duplicates ambiguous and skips extensions and unverified records", ()
       fixups: { ...baseRecord.fixups, verifiedSectors: 1, mismatchSector: 1 },
     },
   ]);
+  const correlateContradictory = createUsnMftCorrelator([
+    { ...baseRecord, extentValid: false },
+  ]);
+  expect(
+    correlateContradictory({
+      fileReference: 0x0002_0000_0000_0007n,
+      parentReference: 0n,
+    }).file,
+  ).toEqual({ kind: "unresolved" });
   expect(
     correlate({
       fileReference: 0x0002_0000_0000_0007n,

src/domain/windows/ntfsJournalCorrelation.ts

@@ -9,7 +9,11 @@ type RecordIdentity = Pick<
 type CorrelatableRecord = RecordIdentity &
   Pick<
     MftRecord,
-    "baseRecordReference" | "declaredRecordNumber" | "fixups" | "totalBytes"
+    | "baseRecordReference"
+    | "declaredRecordNumber"
+    | "fixups"
+    | "totalBytes"
+    | "extentValid"
   >;
 type JournalReferences = Pick<UsnRecordV2, "fileReference" | "parentReference">;
 
@@ -32,6 +36,7 @@ export const createUsnMftCorrelator = (
     // logical MFT stream. Extension records do not identify separate files.
     if (
       record.baseRecordReference !== null ||
+      !record.extentValid ||
       record.fixups.verifiedSectors * FIXUP_SECTOR_BYTES !== record.totalBytes
     )
       continue;