Velocidex / go-ntfs

An NTFS file parser in Go
Apache License 2.0
64 stars 23 forks source link

Handle fragmented $MFT with an $ATTRIBUTE_LIST #72

Closed scudette closed 1 year ago

scudette commented 1 year ago

To get the full $MFT we need to construct a reader over all the VCNs of the $DATA attribute