Velocidex / go-ntfs

An NTFS file parser in Go
Apache License 2.0
64 stars 23 forks source link

Refactored stream reading code. #62

Closed scudette closed 2 years ago

scudette commented 2 years ago

Fixed bugs in reading compressed and sparse files. Side effect is that now we can read $Boot. We were unable to before because the first run for $Boot starts at offset 0 but previous code mistook it to a sparse run. This change fixed the behavior and ensures that files not marked as sparse are not mistaken to be sparse.

Added more testing for live dumping - check hashes vs OS API for both sparse and compressed data.