From afed309f0f29b81fdf4ce376fbe57f8e4086fc26 Mon Sep 17 00:00:00 2001
From: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Date: Wed, 11 Nov 2026 00:34:28 +0000
Subject: [PATCH] fix(ntfs): exclude invalid MFT extents from journal matching

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
---
 src/domain/windows/ntfsJournalCorrelation.test.ts | 10 ++++++++++
 src/domain/windows/ntfsJournalCorrelation.ts      |  7 ++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/domain/windows/ntfsJournalCorrelation.test.ts b/src/domain/windows/ntfsJournalCorrelation.test.ts
index eb45dac66d..73ebb91ce4 100644
--- a/src/domain/windows/ntfsJournalCorrelation.test.ts
+++ b/src/domain/windows/ntfsJournalCorrelation.test.ts
@@ -7,6 +7,7 @@ const baseRecord = {
   sequenceNumber: 2,
   fileOffset: 7168,
   totalBytes: 1024,
+  extentValid: true,
   baseRecordReference: null,
   declaredRecordNumber: 7,
   fixups: {
@@ -52,6 +53,15 @@ it("keeps duplicates ambiguous and skips extensions and unverified records", ()
       fixups: { ...baseRecord.fixups, verifiedSectors: 1, mismatchSector: 1 },
     },
   ]);
+  const correlateContradictory = createUsnMftCorrelator([
+    { ...baseRecord, extentValid: false },
+  ]);
+  expect(
+    correlateContradictory({
+      fileReference: 0x0002_0000_0000_0007n,
+      parentReference: 0n,
+    }).file,
+  ).toEqual({ kind: "unresolved" });
   expect(
     correlate({
       fileReference: 0x0002_0000_0000_0007n,
diff --git a/src/domain/windows/ntfsJournalCorrelation.ts b/src/domain/windows/ntfsJournalCorrelation.ts
index 9664a7b50e..f9aa1e28ba 100644
--- a/src/domain/windows/ntfsJournalCorrelation.ts
+++ b/src/domain/windows/ntfsJournalCorrelation.ts
@@ -9,7 +9,11 @@ type RecordIdentity = Pick<
 type CorrelatableRecord = RecordIdentity &
   Pick<
     MftRecord,
-    "baseRecordReference" | "declaredRecordNumber" | "fixups" | "totalBytes"
+    | "baseRecordReference"
+    | "declaredRecordNumber"
+    | "fixups"
+    | "totalBytes"
+    | "extentValid"
   >;
 type JournalReferences = Pick<UsnRecordV2, "fileReference" | "parentReference">;
 
@@ -32,6 +36,7 @@ export const createUsnMftCorrelator = (
     // logical MFT stream. Extension records do not identify separate files.
     if (
       record.baseRecordReference !== null ||
+      !record.extentValid ||
       record.fixups.verifiedSectors * FIXUP_SECTOR_BYTES !== record.totalBytes
     )
       continue;