harelsegev / INDXRipper

Carve file metadata from NTFS index ($I30) attributes
MIT License
60 stars 5 forks source link

$INDEX_ALLOCATION attribute chains are not handled correctly #6

Closed harelsegev closed 2 years ago

harelsegev commented 2 years ago

https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#620-attribute-chains