diff --git a/src/artifacts/NtfsMftArtifactReader.test.ts b/src/artifacts/NtfsMftArtifactReader.test.ts index 64a69f9420..9280691840 100644 --- a/src/artifacts/NtfsMftArtifactReader.test.ts +++ b/src/artifacts/NtfsMftArtifactReader.test.ts @@ -40,7 +40,10 @@ const writeMft = async (name: string, bytes: Buffer): Promise => { it("reports a $MFT stream's record headers as the root occurrence", async () => { const inventory = await scanCanonicalArtifactInventory( - await writeMft("$MFT", Buffer.concat([recordBytes({}), recordBytes({ flags: 0x0003 })])), + await writeMft( + "$MFT", + Buffer.concat([recordBytes({}), recordBytes({ flags: 0x0003 })]), + ), ); expect(inventory.manifest.root_format).toBe("ntfs-mft"); expect(inventory.coverage.status).toBe("complete"); diff --git a/src/artifacts/NtfsMftArtifactReader.ts b/src/artifacts/NtfsMftArtifactReader.ts index 594946cf57..d69df419ec 100644 --- a/src/artifacts/NtfsMftArtifactReader.ts +++ b/src/artifacts/NtfsMftArtifactReader.ts @@ -2,10 +2,7 @@ import type { Readable } from "node:stream"; import type { ArtifactFormatMetadata } from "../domain/artifactFormatMetadata.js"; import type { RegionDecodeFailure } from "../domain/firmware/regionDecoder.js"; -import { - createMftDecoder, - type MftImage, -} from "../domain/windows/ntfsMft.js"; +import { createMftDecoder, type MftImage } from "../domain/windows/ntfsMft.js"; import { ArtifactReaderFailure, type ArtifactEntry, diff --git a/src/domain/windows/ntfsMft.test.ts b/src/domain/windows/ntfsMft.test.ts index 4dd0c2ce6e..13ddf8fa30 100644 --- a/src/domain/windows/ntfsMft.test.ts +++ b/src/domain/windows/ntfsMft.test.ts @@ -112,10 +112,7 @@ describe("parseMftImage", () => { it("keeps a record whose sector trailer is not the sequence number, and reports it", () => { const parsed = parseMftImage( - streamOf( - recordOf(), - recordOf({ sequenceNumber: 9, corruptSector: 1 }), - ), + streamOf(recordOf(), recordOf({ sequenceNumber: 9, corruptSector: 1 })), ); expect(parsed.ok).toBe(true); if (!parsed.ok) return; @@ -234,7 +231,6 @@ describe("parseMftImage", () => { expect(parsed.value.recordBytes).toBe(4096); expect(parsed.value.metadata.record_count).toBe(1); }); - }); describe("parseMftImage refusals and limits", () => { @@ -242,21 +238,28 @@ describe("parseMftImage refusals and limits", () => { const parsed = parseMftImage(new Uint8Array(32)); expect(parsed.ok).toBe(false); if (parsed.ok) return; - expect(parsed.error.message).toMatch(/shorter than one 48-byte record header/u); + expect(parsed.error.message).toMatch( + /shorter than one 48-byte record header/u, + ); }); it("refuses bytes that do not start with the FILE signature", () => { const parsed = parseMftImage(Buffer.alloc(2048, 0x41)); expect(parsed.ok).toBe(false); if (parsed.ok) return; - expect(parsed.error.message).toMatch(/does not begin with the FILE signature/u); + expect(parsed.error.message).toMatch( + /does not begin with the FILE signature/u, + ); }); it("refuses a file above the fixed ceiling", () => { const decoder = createMftDecoder(MFT_MAX_FILE_BYTES + 1); expect(decoder.ok).toBe(false); if (decoder.ok) return; - expect(decoder.error).toMatchObject({ kind: "limit", boundary: "file-size" }); + expect(decoder.error).toMatchObject({ + kind: "limit", + boundary: "file-size", + }); }); it("decodes the same stream through the chunked decoder", () => { diff --git a/src/domain/windows/ntfsMft.ts b/src/domain/windows/ntfsMft.ts index 150c0342a3..fc8d16b26d 100644 --- a/src/domain/windows/ntfsMft.ts +++ b/src/domain/windows/ntfsMft.ts @@ -253,7 +253,11 @@ const readRecord = ( recordBytes: number, ): MftRecord => { const record = bytes.subarray(fileOffset, fileOffset + recordBytes); - const view = new DataView(record.buffer, record.byteOffset, record.byteLength); + const view = new DataView( + record.buffer, + record.byteOffset, + record.byteLength, + ); const flags = view.getUint16(RECORD_HEADER.flags, true); const baseRecordReference = view.getBigUint64( @@ -297,10 +301,7 @@ const readRecord = ( * trailer words. A sector whose trailer is not the sequence number was not * cleanly written, so the record's attributes cannot be trusted. */ -const verifyFixups = ( - record: Uint8Array, - view: DataView, -): MftRecordFixups => { +const verifyFixups = (record: Uint8Array, view: DataView): MftRecordFixups => { const usaOffset = view.getUint16(RECORD_HEADER.updateSequenceOffset, true); const usaCount = view.getUint16(RECORD_HEADER.updateSequenceCount, true); const sectors = Math.floor(record.length / FIXUP_SECTOR_BYTES);