Skip to content

Ntfs read fixes#2106

Open
alexisbalbachan wants to merge 3 commits intofortra:masterfrom
alexisbalbachan:ntfs_read_fixes
Open

Ntfs read fixes#2106
alexisbalbachan wants to merge 3 commits intofortra:masterfrom
alexisbalbachan:ntfs_read_fixes

Conversation

@alexisbalbachan
Copy link
Collaborator

@alexisbalbachan alexisbalbachan commented Jan 29, 2026

This PR is based on #2055, it had some issues when parsing certain kinds of files that were fixed here.

New Features:

  • Sparse files can now be read/extracted correctly.
  • Non-resident $DATA reads work across multiple fragments (data runs) and support negative run deltas.
  • Multi-extent $DATA (runlists split across MFT records) is merged into a single logical stream.
  • Root directory entries that were previously missing are now listed reliably.

How to test:

  • Create problematic files that were breaking the current implementation:

  •  fsutil file createnew C:\temp\sparse.bin 10485760
     fsutil sparse setflag C:\temp\sparse.bin
     fsutil sparse setrange C:\temp\sparse.bin 0 10485760
    
     fsutil file createnew C:\temp\uninit.bin 1
     fsutil file seteof C:\temp\uninit.bin 10485760
    
     fsutil file createnew C:\temp\multiextent.dat 8589934592; 1..50 | ForEach-Object { fsutil file setshortname C:\temp\multiextent.dat "ME$_.TMP" 2>$null }
    
    
    
     fsutil file createnew C:\temp\big.dat 8589934592
    
     fsutil file createnew C:\rootfile1.bin 1024
     fsutil file createnew C:\rootfile2.bin 2048
    
     fsutil file createnew C:\temp\bigfile.bin 2147483648
     for ($i=0; $i -lt 500; $i++) { Add-Content -Path C:\temp\bigfile.bin -Stream ("stream" + $i) -Value ("stream-data-" + $i) }
    
  • Run ntfs-read and cd into the corresponding directories, try ls and hexdump/cat

@anadrianmanrique anadrianmanrique self-assigned this Jan 29, 2026
@anadrianmanrique anadrianmanrique added the medium Medium priority item label Jan 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

medium Medium priority item

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants