reverse-engineering-anything/docs/specs/native/ntfs-mft/tasks.md

Tasks

• Define the first-step scope, contract and limits.
• Parse FILE record headers and update-sequence fixups with synthesized fixtures and explicit limitations.
• Add the reader, format descriptor and byte classification.
• Decode attribute records, then $FILE_NAME attributes with parent references, names, hard links and timestamps.
• Parse $UsnJrnl:$J V2 records and correlate them by full file reference.
• Return a bounded source-order page through CLI and MCP, preserving both input digests and explicit coverage rows.
• Decode V3/V4 layouts, bound extent samples, and report unknown history coverage.
• Page MFT metadata independently of journal events.
• Decode resident standard information, attribute-list references and nonresident mapping metadata.
• Resolve resident attribute-list graphs into acquired extension metadata with full ownership checks, bounded decoding and explicit partial coverage.
• Verify Windows 11 MFT records through the packaged Linux CLI, with pinned provenance and digests.
• Verify paired logical MFT/journal streams from a public NTFS volume fixture on Linux against an independent parser.
• Verify Windows-host execution.