Velocidex / go-ntfs

An NTFS file parser in Go
Apache License 2.0
64 stars 23 forks source link

Added error reporting when reconstructing the path #57

Closed scudette closed 1 year ago

scudette commented 1 year ago

Sometimes when reconstructing MFT paths we hit errors (especially for unallocated entried). The previous code would just stop the path reconstruction at the point of error and since paths are built in reverse it would appear like the last valid directory is actually rooted at the top of the filesystem.

This change creates special "psuedo" directories where these paths can terminate making it clear that they are errors. We also add extra components describing the error of why we were unable to continue processing.