Support LZX and XPRESS compression methods

[mappu]

Hi!

There's good support here for LZNT1 compression (created from Windows Compress contents to save space option or compact.exe /c).

In Windows 10 / Windows Server 2016, some extra compression algorithms XPRESS4K, XPRESS8K, XPRESS16K, and LZX were added (created from compact.exe /c /EXE LZX). These have higher compression ratios but do not support in-place modification.

On disk these files show up as reparse points, with the compressed data stored in a WofCompressedData ADS stream. In real Windows decompression is performed by a filesystem filter driver above ntfs. So it's arguable if it belongs in this project or not. But to correspond to the existing lznt1 support, there should be support for the other compression algorithms too.

Some links:

• In other libraries like ntfs-3g, it's available as an add-on plugin: https://github.com/ebiggers/ntfs-3g-system-compression (GPLv2/LGPLv3)
  • The ntfs-3g version was the basis for the Linux kernel ntfs3 implementation: https://github.com/torvalds/linux/blob/master/fs/ntfs3/lib/xpress_decompress.c
  • And the ntfs-3g version is based on wimlib's version: https://github.com/matchaxnb/wimlib/blob/master/src/xpress-decompress.c
• Sleuthkit doesn't have an implementation
• https://github.com/comaeio/rust-lzxpress Some rust code in MIT
• https://www.swiftforensics.com/2016/10/wofcompressed-streams-in-windows-10.html (2016) discussion about NTFS forensics tools