diff --git a/src/domain/windows/ntfsJournalCorrelation.test.ts b/src/domain/windows/ntfsJournalCorrelation.test.ts index eb45dac66d..73ebb91ce4 100644 --- a/src/domain/windows/ntfsJournalCorrelation.test.ts +++ b/src/domain/windows/ntfsJournalCorrelation.test.ts @@ -7,6 +7,7 @@ const baseRecord = { sequenceNumber: 2, fileOffset: 7168, totalBytes: 1024, + extentValid: true, baseRecordReference: null, declaredRecordNumber: 7, fixups: { @@ -52,6 +53,15 @@ it("keeps duplicates ambiguous and skips extensions and unverified records", () fixups: { ...baseRecord.fixups, verifiedSectors: 1, mismatchSector: 1 }, }, ]); + const correlateContradictory = createUsnMftCorrelator([ + { ...baseRecord, extentValid: false }, + ]); + expect( + correlateContradictory({ + fileReference: 0x0002_0000_0000_0007n, + parentReference: 0n, + }).file, + ).toEqual({ kind: "unresolved" }); expect( correlate({ fileReference: 0x0002_0000_0000_0007n, diff --git a/src/domain/windows/ntfsJournalCorrelation.ts b/src/domain/windows/ntfsJournalCorrelation.ts index 9664a7b50e..f9aa1e28ba 100644 --- a/src/domain/windows/ntfsJournalCorrelation.ts +++ b/src/domain/windows/ntfsJournalCorrelation.ts @@ -9,7 +9,11 @@ type RecordIdentity = Pick< type CorrelatableRecord = RecordIdentity & Pick< MftRecord, - "baseRecordReference" | "declaredRecordNumber" | "fixups" | "totalBytes" + | "baseRecordReference" + | "declaredRecordNumber" + | "fixups" + | "totalBytes" + | "extentValid" >; type JournalReferences = Pick; @@ -32,6 +36,7 @@ export const createUsnMftCorrelator = ( // logical MFT stream. Extension records do not identify separate files. if ( record.baseRecordReference !== null || + !record.extentValid || record.fixups.verifiedSectors * FIXUP_SECTOR_BYTES !== record.totalBytes ) continue;