11 Commits

Include renames

Author	SHA1	Message	Date
N0zoM1z0andgensokyo-dev	bae4ec0cda	docs(ntfs): record metadata page ownership and review verification ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:13:09 +08:00
N0zoM1z0andgensokyo-dev	1f20c57627	docs(ntfs): record verification with Windows 11 metadata samples ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:13:09 +08:00
N0zoM1z0andgensokyo-dev	e5a92d1848	docs(ntfs): explain acquisition paging and metadata coverage ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:13:09 +08:00
N0zoM1z0andgensokyo-dev	411804afbf	feat(ntfs): expose source file names and lossless metadata ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:13:09 +08:00
N0zoM1z0andgensokyo-dev	40239b31e7	docs(ntfs): record scoped page reuse and complete MCP measurements ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:03:32 +08:00
N0zoM1z0andgensokyo-dev	55f344a77b	docs(ntfs): describe paired acquisition and timeline paging ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:03:32 +08:00
N0zoM1z0andgensokyo-dev	73bc95d23f	feat(ntfs): decode resident MFT file names after fixups ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 13:03:32 +08:00
N0zoM1z0andgensokyo-dev	5d10337709	feat(artifacts): expose a bounded sample of MFT record headers ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 10:03:35 +08:00
N0zoM1z0andgensokyo-dev	da1f029c2f	fix(artifacts): admit MFT captures through CLI and MCP ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 10:03:35 +08:00
N0zoM1z0andgensokyo-dev	9df3f7174f	fix(ntfs): keep record identity across invalid MFT slots ... Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>	2026-11-11 10:03:35 +08:00
2SinceJuly	d9d2641981	feat(artifacts): inventory NTFS $MFT record headers offline ... An acquired $MFT stream had no reader, so an analyst holding one could only treat it as an opaque file. Recognize the FILE signature of the first record and inventory every record's header: sequence number, flags, used and total bytes, base record reference and update-sequence array. Each record's update-sequence fixups are verified against its sector trailers. A mismatch keeps the header facts, is reported on the record and is counted in the metadata, so a record that was not cleanly written is visible rather than silently accepted. A missing or short array is reported as unverified, a wrong signature stops the scan at its offset, and a trailing partial record is reported as a byte count. Attributes, filenames and the $UsnJrnl:$J journal are not decoded, so no path or change history is claimed. Part of #9867 (cherry picked from commit ccb45f5712)	2026-11-11 10:03:35 +08:00