mirror of
https://github.com/morluto/rea.git
synced 2026-11-12 01:41:21 +00:00
2SinceJuly
ccb45f5712
An acquired $MFT stream had no reader, so an analyst holding one could only treat it as an opaque file. Recognize the FILE signature of the first record and inventory every record's header: sequence number, flags, used and total bytes, base record reference and update-sequence array. Each record's update-sequence fixups are verified against its sector trailers. A mismatch keeps the header facts, is reported on the record and is counted in the metadata, so a record that was not cleanly written is visible rather than silently accepted. A missing or short array is reported as unverified, a wrong signature stops the scan at its offset, and a trailing partial record is reported as a byte count. Attributes, filenames and the $UsnJrnl:$J journal are not decoded, so no path or change history is claimed. Fixes #9867