ntfs_recovery.cpp

Go to the documentation of this file.

#include "ntfs_recovery.hpp"
#include "i18n.hpp"
#include "text_utils.hpp"
 
#include <algorithm>
#include <array>
#include <cctype>
#include <cstdint>
#include <cstring>
#include <filesystem>
#include <fstream>
#include <limits>
#include <map>
#include <optional>
#include <set>
#include <sstream>
#include <string>
#include <utility>
#include <vector>
 
namespace fs = std::filesystem;
 
namespace {
uint16_t le16(const unsigned char* p) {
    return static_cast<uint16_t>(p[0]) | (static_cast<uint16_t>(p[1]) << 8);
}
 
uint32_t le32(const unsigned char* p) {
    return static_cast<uint32_t>(p[0]) |
           (static_cast<uint32_t>(p[1]) << 8) |
           (static_cast<uint32_t>(p[2]) << 16) |
           (static_cast<uint32_t>(p[3]) << 24);
}
 
uint64_t le64(const unsigned char* p) {
    return static_cast<uint64_t>(p[0]) |
           (static_cast<uint64_t>(p[1]) << 8) |
           (static_cast<uint64_t>(p[2]) << 16) |
           (static_cast<uint64_t>(p[3]) << 24) |
           (static_cast<uint64_t>(p[4]) << 32) |
           (static_cast<uint64_t>(p[5]) << 40) |
           (static_cast<uint64_t>(p[6]) << 48) |
           (static_cast<uint64_t>(p[7]) << 56);
}
 
// Bug #14, #18 fix: replaced the old broken implementations with the
// shared text_utils helpers. We keep the names here for minimal diff.
inline std::string sanitize_component(const std::string& in) {
    return text_utils::sanitize_component(in);
}
 
inline std::string decode_utf16le_ascii(const unsigned char* data, size_t byte_count) {
    // Function name kept for backwards compatibility, but it now produces
    // proper UTF-8 output (the previous version replaced every non-ASCII
    // character with '_').
    return text_utils::utf16le_to_utf8(data, byte_count);
}
 
struct DiskSpan {
    uint64_t offset {0};
    uint64_t length {0};
    bool sparse {false};
};
 
struct NtfsDataRun {
    uint64_t vcn {0};
    uint64_t offset {0};
    uint64_t length {0};
    bool sparse {false};
};
 
struct NtfsVolumeInfo {
    uint64_t volume_offset {0};
    uint16_t bytes_per_sector {0};
    uint8_t sectors_per_cluster {0};
    uint64_t cluster_size {0};
    uint64_t total_sectors {0};
    uint64_t mft_lcn {0};
    uint64_t mftmirr_lcn {0};
    uint64_t mft_record_size {0};
};
 
struct NtfsAttributeListEntry {
    uint32_t type {0};
    uint16_t record_length {0};
    uint8_t name_length {0};
    uint8_t name_offset {0};
    uint64_t start_vcn {0};
    uint64_t base_reference {0};
    uint16_t instance {0};
    std::string name;
};
 
struct NtfsDataStream {
    std::string name;
    bool resident {false};
    std::vector<unsigned char> resident_data;
    std::vector<NtfsDataRun> runs;
    uint64_t data_size {0};
    uint64_t alloc_size {0};
    uint16_t attr_flags {0};
    bool compressed {false};
    bool encrypted {false};
    bool sparse {false};
    bool unsupported_layout {false};
    uint8_t compression_unit_shift {0};
};
 
struct NtfsFileRecordInfo {
    uint64_t record_number {0};
    uint64_t parent_record_number {0};
    // Sequence number this record had when the parent's $FILE_NAME was
    // written. If it doesn't match the parent's CURRENT sequence
    // number, the parent record was reused for a different file.
    uint16_t parent_sequence_number {0};
    // This record's own sequence number (from the FILE record header
    // at offset 0x10). Incremented every time the slot is freed and
    // reallocated.
    uint16_t own_sequence_number {0};
    bool in_use {false};
    bool is_directory {false};
    std::string name;
    bool deleted_candidate {false};
    bool has_attribute_list {false};
    bool has_reparse_point {false};
    std::vector<unsigned char> reparse_data;
    std::map<std::string, NtfsDataStream> streams;
    // $I30 directory index: when this record is a directory, we collect
    // these so the tree walker can use them as the AUTHORITATIVE source
    // of (filename, child MFT ref) pairs -- bypassing the MFT scan's
    // ambiguous parent inference.
    //
    // - index_root_data: bytes of $INDEX_ROOT (resident attribute,
    //   type 0x90, name "$I30"). Contains the small/initial index.
    // - index_allocation_runs: run list of $INDEX_ALLOCATION (type
    //   0xA0, name "$I30"). Contains the larger INDX node blocks
    //   for big directories.
    // - index_record_size: bytes per INDX block (typically 4096).
    std::vector<unsigned char> index_root_data;
    std::vector<NtfsDataRun>   index_allocation_runs;
    uint32_t index_record_size {0};
};
 
bool lznt1_decompress(const std::vector<unsigned char>& src,
                      size_t expected_size,
                      std::vector<unsigned char>& dst) {
    dst.clear();
    size_t pos = 0;
    while (pos + 2 <= src.size() && dst.size() < expected_size) {
        const uint16_t header = le16(src.data() + pos);
        pos += 2;
        const size_t chunk_size = (header & 0x0FFF) + 1;
        const bool is_compressed = (header & 0x8000) != 0;
        if (pos + chunk_size > src.size()) return false;
 
        if (!is_compressed) {
            const size_t take = std::min(chunk_size, expected_size - dst.size());
            dst.insert(dst.end(), src.begin() + static_cast<long>(pos), src.begin() + static_cast<long>(pos + take));
            pos += chunk_size;
            continue;
        }
 
        const size_t chunk_end = pos + chunk_size;
        std::vector<unsigned char> chunk_out;
        chunk_out.reserve(4096);
        while (pos < chunk_end && chunk_out.size() < 4096) {
            const uint8_t flags = src[pos++];
            for (int bit = 0; bit < 8 && pos < chunk_end; ++bit) {
                if ((flags & (1u << bit)) == 0) {
                    chunk_out.push_back(src[pos++]);
                } else {
                    if (pos + 1 >= chunk_end) return false;
                    const uint16_t token = le16(src.data() + pos);
                    pos += 2;
 
                    int length_bits = 4;
                    while ((1u << (length_bits + 4)) < chunk_out.size() && length_bits < 12) ++length_bits;
                    const size_t length_mask = (1u << length_bits) - 1u;
                    const size_t offset = (token >> length_bits) + 1u;
                    const size_t length = (token & length_mask) + 3u;
                    if (offset == 0 || offset > chunk_out.size()) return false;
                    for (size_t i = 0; i < length && chunk_out.size() < 4096; ++i) {
                        chunk_out.push_back(chunk_out[chunk_out.size() - offset]);
                    }
                }
                if (chunk_out.size() >= 4096) break;
            }
        }
        const size_t take = std::min(chunk_out.size(), expected_size - dst.size());
        dst.insert(dst.end(), chunk_out.begin(), chunk_out.begin() + static_cast<long>(take));
        if (chunk_out.size() < 4096 && dst.size() < expected_size) {
            dst.resize(std::min(expected_size, dst.size() + (4096 - chunk_out.size())), 0);
        }
    }
    if (dst.size() < expected_size) dst.resize(expected_size, 0);
    return true;
}
 
} // namespace
 
class NtfsRecoveryImpl {
public:
    explicit NtfsRecoveryImpl(DiskReader& reader) : reader_(reader) {}
 
    bool recover(uint64_t volume_offset,
                 const std::string& output_dir,
                 std::vector<RecoveredFileRecord>& recovered,
                 std::vector<std::string>& logs,
                 std::string& error) {
        if (!read_boot_sector(volume_offset, error)) return false;
 
        fs::path out_root = fs::path(output_dir) / "filesystem_recovered" / "ntfs" / ("offset_" + std::to_string(volume_offset));
        fs::create_directories(out_root);
        logs.push_back(trs("NTFS recovery started at offset") + std::string(" ") + std::to_string(volume_offset));
 
        std::vector<unsigned char> mft_record;
        if (!read_mft_record(0, mft_record, error)) return false;
 
        NtfsFileRecordInfo mft_meta;
        if (!parse_file_record(0, mft_record, mft_meta, error)) return false;
        auto mft_it = mft_meta.streams.find("");
        if (mft_it == mft_meta.streams.end() || (mft_it->second.runs.empty() && mft_it->second.data_size == 0)) {
            error = trs("Unable to parse NTFS $MFT data runs");
            return false;
        }
 
        mft_ranges_.clear();
        for (const auto& run : mft_it->second.runs) {
            if (!run.sparse) mft_ranges_.push_back({run.offset, run.length});
        }
 
        // ---- Load $MFTMirr (MFT record 1) for fallback ----
        //
        // $MFTMirr is a mirror of the FIRST FOUR MFT records ($MFT,
        // $MFTMirr, $LogFile, $Volume) plus a few more on modern
        // versions. When the primary $MFT is corrupt, we can fall
        // back to the mirror to recover at least these 4 critical
        // records -- which often unblocks recovery of everything else
        // because $MFT itself is among them.
        //
        // We read MFT record 1 from the PRIMARY $MFT, get its runs,
        // and store them. If the primary read fails entirely (very
        // corrupt MFT), we skip the mirror -- by then the volume is
        // probably beyond software recovery.
        mftmirr_ranges_.clear();
        {
            std::vector<unsigned char> mirr_rec;
            std::string mirr_err;
            if (read_mft_record(1, mirr_rec, mirr_err)) {
                NtfsFileRecordInfo mirr_info;
                if (parse_file_record(1, mirr_rec, mirr_info, mirr_err)) {
                    auto it = mirr_info.streams.find("");
                    if (it != mirr_info.streams.end()) {
                        for (const auto& run : it->second.runs) {
                            if (!run.sparse) {
                                mftmirr_ranges_.push_back({run.offset, run.length});
                            }
                        }
                        if (!mftmirr_ranges_.empty()) {
                            logs.push_back(trs("NTFS $MFTMirr loaded as fallback "
                                               "for the first MFT records "
                                               "(typically records 0-3)"));
                        }
                    }
                }
            }
            if (mftmirr_ranges_.empty()) {
                logs.push_back(trs("NTFS $MFTMirr not loadable -- primary MFT "
                                   "must be intact for recovery"));
            }
        }
 
        // Bug #6 fix: 300k was way too low for enterprise volumes (NAS, servers).
        // Cap at 8M records or actual data size, whichever is smaller.
        // Hard upper bound prevents runaway scan on corrupt $MFT data_size.
        constexpr uint64_t MAX_MFT_RECORDS = 8ull * 1000ull * 1000ull;
        const uint64_t record_count = std::min<uint64_t>(
            mft_it->second.data_size / volume_.mft_record_size,
            MAX_MFT_RECORDS);
        std::map<uint64_t, NtfsFileRecordInfo> records;
        for (uint64_t i = 0; i < record_count; ++i) {
            std::vector<unsigned char> rec;
            if (!read_mft_record(i, rec, error)) {
                error.clear();
                continue;
            }
            NtfsFileRecordInfo info;
            if (!parse_file_record(i, rec, info, error)) {
                error.clear();
                continue;
            }
            info.record_number = i;
            info.deleted_candidate = !info.in_use;
            records[i] = std::move(info);
        }
 
        // ---- $I30 directory index pass ----
        //
        // For every record that's a directory and has $I30 data, walk
        // the index and use the resulting (filename, child_ref) pairs
        // to:
        //   1. Recover filenames for child records that lost their
        //      $FILE_NAME (= info.name was empty after parse).
        //   2. Upgrade child records' parent_record_number when the
        //      $I30 entry agrees with a different parent than what
        //      the child's $FILE_NAME claimed -- this happens when
        //      the child's $FILE_NAME is stale (file was renamed or
        //      moved AFTER the dirent was last written; the dirent
        //      is authoritative).
        //   3. Validate sequence numbers against $I30's child_ref:
        //      if the dirent's child_seq matches the record's
        //      own_seq, the (parent, child) link is genuine.
        size_t i30_walks = 0;
        size_t i30_filenames_recovered = 0;
        size_t i30_parent_updates = 0;
        for (auto& [parent_id, parent_info] : records) {
            if (!parent_info.is_directory) continue;
            if (parent_info.index_root_data.empty()) continue;
            std::vector<I30Entry> entries;
            walk_i30(parent_info, entries, logs);
            if (entries.empty()) continue;
            ++i30_walks;
            for (const auto& ie : entries) {
                auto cit = records.find(ie.child_record_number);
                if (cit == records.end()) continue;
                NtfsFileRecordInfo& child = cit->second;
                // Sequence check: if the dirent's recorded child_seq
                // doesn't match the record's actual seq, the dirent
                // is stale (child slot was reused). Skip.
                if (ie.child_sequence_number != 0 &&
                    child.own_sequence_number != 0 &&
                    ie.child_sequence_number != child.own_sequence_number) {
                    continue;
                }
                // Recover lost filename
                if (child.name.empty() && !ie.filename.empty()) {
                    child.name = ie.filename;
                    ++i30_filenames_recovered;
                }
                // Upgrade parent link if we found a valid I30 entry
                // pointing here -- the parent_id here IS authoritative.
                if (child.parent_record_number != parent_id) {
                    child.parent_record_number = parent_id;
                    child.parent_sequence_number = parent_info.own_sequence_number;
                    ++i30_parent_updates;
                }
            }
        }
        if (i30_walks > 0) {
            std::ostringstream m;
            m << "NTFS $I30 indexes walked: " << i30_walks
              << ", filenames recovered: " << i30_filenames_recovered
              << ", parent links updated: " << i30_parent_updates;
            logs.push_back(m.str());
        }
 
        size_t exported_count = 0;
        size_t deleted_exported_count = 0;
        size_t ads_exported_count = 0;
        size_t skipped_count = 0;
        size_t skipped_encrypted = 0;
        size_t skipped_malformed = 0;
        size_t files_with_efs = 0;
 
        for (const auto& [id, info] : records) {
            if (info.is_directory || info.name.empty()) continue;
 
            // Track files that have ANY encrypted stream (EFS = Encrypting
            // File System). These are reported separately so the user
            // understands why content is unrecoverable without keys.
            bool any_encrypted = false;
            for (const auto& [_, stream] : info.streams) {
                if (stream.encrypted) { any_encrypted = true; break; }
            }
            if (any_encrypted) ++files_with_efs;
 
            fs::path rel = build_relative_path(id, records);
            if (rel.empty()) rel = fs::path("orphaned") / sanitize_component(info.name);
            rel = info.deleted_candidate ? (fs::path("deleted") / rel) : (fs::path("live") / rel);
            const fs::path base_path = out_root / rel;
            fs::create_directories(base_path.parent_path());
 
            bool exported_any = false;
            for (const auto& [stream_name, stream] : info.streams) {
                if (!stream_exportable(stream)) {
                    ++skipped_count;
                    if (stream.encrypted) ++skipped_encrypted;
                    else if (stream.unsupported_layout) ++skipped_malformed;
                    continue;
                }
                const fs::path target = output_path_for_stream(base_path, stream_name);
                std::string local_error;
                if (!export_stream(stream, target, local_error)) {
                    logs.push_back(trs("NTFS stream export failed") + std::string(": ") + rel.string() + " - " + local_error);
                    continue;
                }
                recovered.push_back({target.string(), "NTFS", target.lexically_relative(out_root).string(), stream.data_size, "full", stream_name.empty() ? "filesystem export" : "alternate data stream"});
                exported_any = true;
                if (!stream_name.empty()) ++ads_exported_count;
            }
 
            if (exported_any) {
                export_reparse_sidecar(info, base_path, recovered, logs);
                export_usn_summary_if_needed(info, base_path, recovered, logs);
                ++exported_count;
                if (info.deleted_candidate) ++deleted_exported_count;
            } else {
                export_usn_summary_if_needed(info, base_path, recovered, logs);
            }
        }
 
        logs.push_back(trs("NTFS recovery completed.") + std::string(" ") + trs("Files exported") + ": " + std::to_string(exported_count));
        logs.push_back(trs("NTFS deleted files exported") + std::string(": ") + std::to_string(deleted_exported_count));
        logs.push_back(trs("NTFS alternate data streams exported") + std::string(": ") + std::to_string(ads_exported_count));
        logs.push_back(trs("NTFS unsupported streams skipped") + std::string(": ") + std::to_string(skipped_count));
        if (skipped_encrypted > 0) {
            logs.push_back(trs("NTFS streams skipped because EFS-encrypted "
                               "(content cannot be decrypted without "
                               "Windows account keys):") +
                           std::string(" ") + std::to_string(skipped_encrypted));
        }
        if (skipped_malformed > 0) {
            logs.push_back(trs("NTFS streams skipped because runlist "
                               "malformed (likely corrupted records):") +
                           std::string(" ") + std::to_string(skipped_malformed));
        }
        if (files_with_efs > 0) {
            logs.push_back(trs("NTFS files with EFS-encrypted data "
                               "detected (any stream encrypted):") +
                           std::string(" ") + std::to_string(files_with_efs));
        }
 
        // ---- $LogFile pass (MFT record 2) ----
        //
        // The transaction journal can hold "before images" of MFT records
        // that have since been overwritten or freed. We try to recover
        // additional file records from there.
        scan_logfile(out_root, records, recovered, logs);
 
        return true;
    }
 
private:
    DiskReader& reader_;
    NtfsVolumeInfo volume_;
    std::vector<std::pair<uint64_t, uint64_t>> mft_ranges_;
    // $MFTMirr ranges -- a mirror of the first few MFT records (record
    // 0 through ~3 typically). Used as fallback when the primary
    // read returns invalid data. May be empty on volumes where we
    // could not load record 1 from the primary.
    std::vector<std::pair<uint64_t, uint64_t>> mftmirr_ranges_;
 
    bool read_boot_sector(uint64_t volume_offset, std::string& error) {
        std::array<unsigned char, 512> b{};
        if (!reader_.read_at(volume_offset, b.data(), b.size())) {
            error = trs("Unable to read NTFS boot sector");
            return false;
        }
        if (std::string(reinterpret_cast<const char*>(b.data() + 3), 8) != "NTFS    ") {
            error = trs("Invalid NTFS boot sector");
            return false;
        }
        volume_.volume_offset = volume_offset;
        volume_.bytes_per_sector = le16(b.data() + 11);
        volume_.sectors_per_cluster = b[13];
        volume_.cluster_size = static_cast<uint64_t>(volume_.bytes_per_sector) * volume_.sectors_per_cluster;
        volume_.total_sectors = le64(b.data() + 40);
        volume_.mft_lcn = le64(b.data() + 48);
        volume_.mftmirr_lcn = le64(b.data() + 56);
        const int8_t rec_desc = static_cast<int8_t>(b[64]);
        // Bug #3/#4 fix: descriptor 0 invalid; negative descriptor must be in 1..30 range
        if (rec_desc > 0) {
            volume_.mft_record_size = static_cast<uint64_t>(rec_desc) * volume_.cluster_size;
        } else if (rec_desc == 0) {
            error = trs("Invalid NTFS MFT record descriptor (zero)");
            return false;
        } else {
            const int exponent = -static_cast<int>(rec_desc);
            if (exponent < 1 || exponent > 30) {
                error = trs("Invalid NTFS MFT record descriptor (out of range)");
                return false;
            }
            volume_.mft_record_size = 1ull << exponent;
        }
        if (volume_.bytes_per_sector == 0 || volume_.sectors_per_cluster == 0 || volume_.mft_record_size == 0) {
            error = trs("Invalid NTFS geometry");
            return false;
        }
        return true;
    }
 
    uint64_t cluster_to_offset(uint64_t cluster) const {
        return volume_.volume_offset + cluster * volume_.cluster_size;
    }
 
    bool read_raw_record(uint64_t record_number, std::vector<unsigned char>& out, std::string& error) {
        if (mft_ranges_.empty()) {
            const uint64_t off = cluster_to_offset(volume_.mft_lcn) + record_number * volume_.mft_record_size;
            out.resize(static_cast<size_t>(volume_.mft_record_size));
            if (!reader_.read_at(off, out.data(), out.size())) {
                error = trs("Unable to read MFT record");
                return false;
            }
            return true;
        }
 
        uint64_t logical_offset = record_number * volume_.mft_record_size;
        uint64_t remaining = volume_.mft_record_size;
        out.resize(static_cast<size_t>(remaining));
        size_t out_pos = 0;
        uint64_t cursor = 0;
        for (const auto& [phys_off, len] : mft_ranges_) {
            if (logical_offset >= cursor + len) {
                cursor += len;
                continue;
            }
            const uint64_t inner = logical_offset > cursor ? logical_offset - cursor : 0;
            const uint64_t can_read = std::min<uint64_t>(remaining, len - inner);
            if (!reader_.read_at(phys_off + inner, out.data() + out_pos, static_cast<size_t>(can_read))) {
                error = trs("Unable to read MFT record from data runs");
                return false;
            }
            remaining -= can_read;
            out_pos += static_cast<size_t>(can_read);
            logical_offset += can_read;
            cursor += len;
            if (remaining == 0) return true;
        }
        error = trs("Incomplete read of MFT record");
        return false;
    }
 
    bool apply_fixup(std::vector<unsigned char>& record, std::string& error) {
        if (record.size() < 512) {
            error = trs("Invalid MFT record size");
            return false;
        }
        const uint16_t usa_offset = le16(record.data() + 4);
        const uint16_t usa_count = le16(record.data() + 6);
        if (static_cast<size_t>(usa_offset) + static_cast<size_t>(usa_count) * 2 > record.size() || usa_count == 0) {
            error = trs("Invalid NTFS update sequence array");
            return false;
        }
        const uint16_t usn = le16(record.data() + usa_offset);
        // Bug #5 fix: per-sector mismatch is degraded read, not full reject.
        // Apply fixup where it matches; leave bad sectors untouched and set warning flag.
        size_t bad_sectors = 0;
        for (uint16_t i = 1; i < usa_count; ++i) {
            const size_t sector_end = i * 512 - 2;
            if (sector_end + 2 > record.size()) break;
            const uint16_t cur = le16(record.data() + sector_end);
            if (cur != usn) {
                ++bad_sectors;
                continue; // skip this sector but continue with the others
            }
            record[sector_end] = record[usa_offset + i * 2];
            record[sector_end + 1] = record[usa_offset + i * 2 + 1];
        }
        // If ALL sectors fail (record completely garbage) reject; otherwise return ok.
        if (usa_count > 1 && bad_sectors >= static_cast<size_t>(usa_count - 1)) {
            error = trs("NTFS fixup mismatch on all sectors");
            return false;
        }
        return true;
    }
 
    bool read_mft_record(uint64_t record_number, std::vector<unsigned char>& out, std::string& error) {
        if (!read_raw_record(record_number, out, error)) {
            // Try mirror as a fallback for low record numbers
            return read_mft_record_from_mirror(record_number, out, error);
        }
        if (out.size() < 4 || std::string(reinterpret_cast<const char*>(out.data()), 4) != "FILE") {
            // Primary read succeeded but signature is wrong (possibly
            // overwritten or non-MFT data on disk). Try mirror.
            std::string mirror_err;
            if (read_mft_record_from_mirror(record_number, out, mirror_err)) {
                return true;
            }
            error = trs("Invalid MFT record signature");
            return false;
        }
        return apply_fixup(out, error);
    }
 
    // $MFTMirr fallback. Returns true and fills `out` if a valid
    // mirrored copy of the requested MFT record is available.
    // $MFTMirr typically covers only records 0..3 (sometimes a few
    // more). Records beyond the mirror's coverage trivially fail.
    bool read_mft_record_from_mirror(uint64_t record_number,
                                       std::vector<unsigned char>& out,
                                       std::string& error) {
        if (mftmirr_ranges_.empty()) {
            error = trs("NTFS $MFTMirr not available");
            return false;
        }
        // Compute total mirror size
        uint64_t mirror_size = 0;
        for (const auto& [_, len] : mftmirr_ranges_) mirror_size += len;
        const uint64_t logical_offset = record_number * volume_.mft_record_size;
        if (logical_offset + volume_.mft_record_size > mirror_size) {
            error = trs("Record number out of $MFTMirr coverage");
            return false;
        }
        // Walk the mirror ranges to read this record's bytes
        uint64_t logical = logical_offset;
        uint64_t remaining = volume_.mft_record_size;
        out.resize(static_cast<size_t>(remaining));
        size_t out_pos = 0;
        uint64_t cursor = 0;
        for (const auto& [phys_off, len] : mftmirr_ranges_) {
            if (logical >= cursor + len) {
                cursor += len;
                continue;
            }
            const uint64_t inner = logical > cursor ? logical - cursor : 0;
            const uint64_t can_read = std::min<uint64_t>(remaining, len - inner);
            if (!reader_.read_at(phys_off + inner, out.data() + out_pos,
                                  static_cast<size_t>(can_read))) {
                error = trs("Mirror read failed");
                return false;
            }
            remaining -= can_read;
            out_pos += static_cast<size_t>(can_read);
            logical += can_read;
            cursor += len;
            if (remaining == 0) break;
        }
        if (remaining != 0) {
            error = trs("Incomplete mirror read");
            return false;
        }
        // Verify signature + apply fixup
        if (out.size() < 4 ||
            std::string(reinterpret_cast<const char*>(out.data()), 4) != "FILE") {
            error = trs("Mirror MFT record signature mismatch");
            return false;
        }
        return apply_fixup(out, error);
    }
 
    std::vector<NtfsDataRun> parse_runlist(const unsigned char* runlist,
                                           size_t max_len,
                                           uint64_t start_vcn,
                                           bool& has_sparse,
                                           bool& malformed) {
        std::vector<NtfsDataRun> out;
        int64_t current_lcn = 0;
        uint64_t current_vcn = start_vcn;
        size_t pos = 0;
        malformed = false;
        has_sparse = false;
        while (pos < max_len && runlist[pos] != 0x00) {
            const uint8_t header = runlist[pos++];
            const uint8_t len_bytes = header & 0x0F;
            const uint8_t off_bytes = (header >> 4) & 0x0F;
            if (len_bytes == 0 || pos + len_bytes + off_bytes > max_len) {
                malformed = true;
                break;
            }
            uint64_t run_len = 0;
            for (uint8_t i = 0; i < len_bytes; ++i) run_len |= static_cast<uint64_t>(runlist[pos + i]) << (8 * i);
            pos += len_bytes;
            int64_t run_off = 0;
            if (off_bytes > 0) {
                for (uint8_t i = 0; i < off_bytes; ++i) run_off |= static_cast<int64_t>(runlist[pos + i]) << (8 * i);
                if ((runlist[pos + off_bytes - 1] & 0x80) != 0) {
                    run_off |= -((int64_t)1 << (off_bytes * 8));
                }
            }
            pos += off_bytes;
            if (run_len == 0) {
                malformed = true;
                break;
            }
            NtfsDataRun run;
            run.vcn = current_vcn;
            run.length = run_len * volume_.cluster_size;
            if (off_bytes == 0) {
                has_sparse = true;
                run.sparse = true;
            } else {
                current_lcn += run_off;
                if (current_lcn < 0) {
                    malformed = true;
                    break;
                }
                run.offset = cluster_to_offset(static_cast<uint64_t>(current_lcn));
            }
            out.push_back(run);
            current_vcn += run_len;
        }
        return out;
    }
 
    NtfsDataStream& stream_for(NtfsFileRecordInfo& info, const std::string& name) {
        auto [it, inserted] = info.streams.try_emplace(name);
        (void)inserted;
        it->second.name = name;
        return it->second;
    }
 
    static void merge_runs(std::vector<NtfsDataRun>& dst, const std::vector<NtfsDataRun>& src) {
        dst.insert(dst.end(), src.begin(), src.end());
        std::sort(dst.begin(), dst.end(), [](const NtfsDataRun& a, const NtfsDataRun& b) {
            if (a.vcn != b.vcn) return a.vcn < b.vcn;
            // At equal VCN: prefer non-sparse (real data) first
            if (a.sparse != b.sparse) return !a.sparse;
            return a.offset < b.offset;
        });
        // Bug #7 fix: dedup by VCN keeping the BEST candidate (non-sparse > sparse,
        // earliest offset among real runs). The previous code dropped silently and
        // could truncate heavily fragmented files when attribute extensions overlapped.
        std::vector<NtfsDataRun> merged;
        merged.reserve(dst.size());
        for (const auto& run : dst) {
            if (!merged.empty() && merged.back().vcn == run.vcn) {
                // Keep the existing one (already best after sort), unless current is non-sparse
                // and existing is sparse (sort already orders this correctly, but be safe).
                if (merged.back().sparse && !run.sparse) {
                    merged.back() = run;
                }
                continue;
            }
            merged.push_back(run);
        }
        dst.swap(merged);
    }
 
    bool parse_attribute_list_entries(const unsigned char* value,
                                      uint32_t value_len,
                                      std::vector<NtfsAttributeListEntry>& out) {
        uint32_t pos = 0;
        while (pos + 26 <= value_len) {
            const uint32_t type = le32(value + pos);
            if (type == 0xFFFFFFFF) break;
            const uint16_t record_length = le16(value + pos + 4);
            const uint8_t name_length = value[pos + 6];
            const uint8_t name_offset = value[pos + 7];
            if (record_length < 26 || pos + record_length > value_len) break;
            NtfsAttributeListEntry entry;
            entry.type = type;
            entry.record_length = record_length;
            entry.name_length = name_length;
            entry.name_offset = name_offset;
            entry.start_vcn = le64(value + pos + 8);
            entry.base_reference = le64(value + pos + 16) & 0x0000FFFFFFFFFFFFull;
            entry.instance = le16(value + pos + 24);
            if (name_length > 0 && name_offset + static_cast<uint16_t>(name_length) * 2 <= record_length) {
                entry.name = decode_utf16le_ascii(value + pos + name_offset, static_cast<size_t>(name_length) * 2);
            }
            out.push_back(std::move(entry));
            pos += record_length;
        }
        return !out.empty();
    }
 
    bool read_runs_to_buffer(const std::vector<NtfsDataRun>& runs,
                             uint64_t expected_size,
                             std::vector<unsigned char>& out,
                             std::string& error) {
        out.clear();
        out.reserve(static_cast<size_t>(std::min<uint64_t>(expected_size, 64ull * 1024ull * 1024ull)));
        std::vector<unsigned char> buffer(1024 * 1024);
        uint64_t written = 0;
        for (const auto& run : runs) {
            uint64_t remain = std::min<uint64_t>(run.length, expected_size > written ? expected_size - written : 0);
            if (remain == 0) break;
            if (run.sparse) {
                out.insert(out.end(), static_cast<size_t>(remain), 0);
                written += remain;
                continue;
            }
            uint64_t cur = run.offset;
            while (remain > 0) {
                const size_t chunk = static_cast<size_t>(std::min<uint64_t>(buffer.size(), remain));
                if (!reader_.read_at(cur, buffer.data(), chunk)) {
                    error = trs("Read error while exporting recovered file");
                    return false;
                }
                out.insert(out.end(), buffer.begin(), buffer.begin() + static_cast<long>(chunk));
                cur += chunk;
                remain -= chunk;
                written += chunk;
            }
        }
        if (out.size() < expected_size) out.resize(static_cast<size_t>(expected_size), 0);
        return true;
    }
 
    bool decode_compressed_stream(const NtfsDataStream& stream,
                                  std::vector<unsigned char>& out,
                                  std::string& error) {
        out.clear();
        const uint64_t unit_size = volume_.cluster_size * (1ull << stream.compression_unit_shift);
        if (unit_size == 0) {
            error = trs("Invalid NTFS compression unit");
            return false;
        }
 
        const uint64_t total_units = stream.data_size == 0 ? 0 : ((stream.data_size + unit_size - 1) / unit_size);
        size_t run_index = 0;
        std::vector<unsigned char> compressed_bytes;
        for (uint64_t unit = 0; unit < total_units; ++unit) {
            const uint64_t expected = std::min<uint64_t>(unit_size, stream.data_size - unit * unit_size);
            uint64_t unit_bytes = 0;
            bool unit_sparse = false;
            size_t begin = run_index;
            while (run_index < stream.runs.size()) {
                const auto& run = stream.runs[run_index];
                if (run.vcn >= (unit + 1) * (unit_size / volume_.cluster_size)) break;
                unit_bytes += run.length;
                unit_sparse = unit_sparse || run.sparse;
                ++run_index;
                if (unit_bytes >= unit_size) break;
            }
 
            if (unit_sparse && unit_bytes == unit_size) {
                out.insert(out.end(), static_cast<size_t>(expected), 0);
                continue;
            }
 
            if (unit_bytes == unit_size && !unit_sparse) {
                std::vector<NtfsDataRun> unit_runs(stream.runs.begin() + static_cast<long>(begin),
                                                   stream.runs.begin() + static_cast<long>(run_index));
                std::vector<unsigned char> raw;
                if (!read_runs_to_buffer(unit_runs, expected, raw, error)) return false;
                out.insert(out.end(), raw.begin(), raw.begin() + static_cast<long>(expected));
                continue;
            }
 
            std::vector<NtfsDataRun> unit_runs(stream.runs.begin() + static_cast<long>(begin),
                                               stream.runs.begin() + static_cast<long>(run_index));
            compressed_bytes.clear();
            if (!read_runs_to_buffer(unit_runs, unit_bytes, compressed_bytes, error)) return false;
            std::vector<unsigned char> decomp;
            if (!lznt1_decompress(compressed_bytes, static_cast<size_t>(expected), decomp)) {
                error = trs("Unsupported or invalid NTFS compressed stream");
                return false;
            }
            out.insert(out.end(), decomp.begin(), decomp.begin() + static_cast<long>(expected));
        }
        if (out.size() > stream.data_size) out.resize(static_cast<size_t>(stream.data_size));
        return true;
    }
 
    bool process_attributes(uint64_t base_record_number,
                            const std::vector<unsigned char>& record,
                            NtfsFileRecordInfo& info,
                            std::vector<NtfsAttributeListEntry>& attr_list,
                            std::string& error) {
        (void)base_record_number;
        const uint16_t flags = le16(record.data() + 22);
        const uint16_t attrs_offset = le16(record.data() + 20);
        info.in_use = (flags & 0x0001) != 0;
        info.is_directory = (flags & 0x0002) != 0;
        // Sequence number at offset 0x10 of the FILE record header.
        // We read it here so that the caller can later compare it
        // against parent_sequence_number (= what the parent dirent
        // recorded when it linked to this child).
        info.own_sequence_number = le16(record.data() + 0x10);
 
        if (attrs_offset >= record.size()) {
            error = trs("Invalid NTFS attribute offset");
            return false;
        }
 
        int best_name_score = -1;
        size_t pos = attrs_offset;
        while (pos + 8 <= record.size()) {
            const uint32_t attr_type = le32(record.data() + pos);
            if (attr_type == 0xFFFFFFFF) break;
            const uint32_t attr_len = le32(record.data() + pos + 4);
            if (attr_len < 24 || pos + attr_len > record.size()) {
                error = trs("Invalid NTFS attribute length");
                return false;
            }
            const bool nonresident = record[pos + 8] != 0;
            const uint8_t attr_name_len = record[pos + 9];
            const uint16_t attr_name_off = le16(record.data() + pos + 10);
            const uint16_t attr_flags = le16(record.data() + pos + 12);
            std::string attr_name;
            if (attr_name_len > 0 && attr_name_off + static_cast<uint32_t>(attr_name_len) * 2 <= attr_len) {
                attr_name = decode_utf16le_ascii(record.data() + pos + attr_name_off, static_cast<size_t>(attr_name_len) * 2);
            }
 
            if (attr_type == 0x20) {
                info.has_attribute_list = true;
                if (!nonresident) {
                    const uint32_t value_len = le32(record.data() + pos + 16);
                    const uint16_t value_off = le16(record.data() + pos + 20);
                    if (value_off + value_len <= attr_len) {
                        parse_attribute_list_entries(record.data() + pos + value_off, value_len, attr_list);
                    }
                } else {
                    const uint16_t run_off = le16(record.data() + pos + 32);
                    const uint64_t real_size = le64(record.data() + pos + 48);
                    const uint64_t start_vcn = le64(record.data() + pos + 16);
                    if (run_off < attr_len) {
                        bool has_sparse = false;
                        bool malformed = false;
                        auto runs = parse_runlist(record.data() + pos + run_off, attr_len - run_off, start_vcn, has_sparse, malformed);
                        std::vector<unsigned char> buffer;
                        if (!malformed && read_runs_to_buffer(runs, real_size, buffer, error)) {
                            parse_attribute_list_entries(buffer.data(), static_cast<uint32_t>(buffer.size()), attr_list);
                        } else {
                            error.clear();
                        }
                    }
                }
            } else if (attr_type == 0x30) {
                const uint32_t value_len = le32(record.data() + pos + 16);
                const uint16_t value_off = le16(record.data() + pos + 20);
                if (!nonresident && value_off + value_len <= attr_len && value_len >= 66) {
                    const unsigned char* v = record.data() + pos + value_off;
                    const uint64_t parent_ref = le64(v);
                    const uint8_t name_chars = v[64];
                    const uint8_t name_ns = v[65];
                    const unsigned char* name_ptr = v + 66;
                    if (66u + static_cast<uint32_t>(name_chars) * 2 <= value_len) {
                        const std::string candidate_name = decode_utf16le_ascii(name_ptr, static_cast<size_t>(name_chars) * 2);
                        int score = 0;
                        if (name_ns == 1 || name_ns == 3) score = 3;
                        else if (name_ns == 0) score = 2;
                        else score = 1;
                        if (!candidate_name.empty() && score >= best_name_score) {
                            best_name_score = score;
                            info.parent_record_number = parent_ref & 0x0000FFFFFFFFFFFFull;
                            info.parent_sequence_number =
                                static_cast<uint16_t>(parent_ref >> 48);
                            info.name = candidate_name;
                        }
                    }
                }
            } else if (attr_type == 0xC0) {
                const uint32_t value_len = le32(record.data() + pos + 16);
                const uint16_t value_off = le16(record.data() + pos + 20);
                if (!nonresident && value_off + value_len <= attr_len) {
                    info.has_reparse_point = true;
                    info.reparse_data.assign(record.begin() + static_cast<long>(pos + value_off),
                                             record.begin() + static_cast<long>(pos + value_off + value_len));
                }
            } else if (attr_type == 0x90 && attr_name == "$I30") {
                // $INDEX_ROOT for the directory index. Always resident.
                // Layout (within the attribute value):
                //   __le32 attribute_type    (= 0x30 for $FILE_NAME)
                //   __le32 collation_rule
                //   __le32 index_record_size (typically 4096)
                //   __u8   clusters_per_index_record
                //   __u8   reserved[3]
                //   INDEX_HEADER (16 bytes)
                //   INDEX_ENTRY[] entries...
                if (!nonresident) {
                    const uint32_t value_len = le32(record.data() + pos + 16);
                    const uint16_t value_off = le16(record.data() + pos + 20);
                    if (value_off + value_len <= attr_len && value_len >= 16) {
                        info.index_root_data.assign(
                            record.begin() + static_cast<long>(pos + value_off),
                            record.begin() + static_cast<long>(pos + value_off + value_len));
                        // Index record size at offset 8
                        info.index_record_size = le32(info.index_root_data.data() + 8);
                    }
                }
            } else if (attr_type == 0xA0 && attr_name == "$I30") {
                // $INDEX_ALLOCATION: non-resident attribute holding the
                // INDX node blocks for large directories.
                if (nonresident) {
                    const uint16_t run_off = le16(record.data() + pos + 32);
                    const uint64_t start_vcn = le64(record.data() + pos + 16);
                    if (run_off >= 32 && run_off < attr_len) {
                        bool has_sparse = false;
                        bool malformed = false;
                        auto runs = parse_runlist(
                            record.data() + pos + run_off,
                            attr_len - run_off, start_vcn,
                            has_sparse, malformed);
                        if (!malformed) {
                            info.index_allocation_runs = std::move(runs);
                        }
                    }
                }
            } else if (attr_type == 0x80) {
                NtfsDataStream& stream = stream_for(info, attr_name);
                stream.attr_flags |= attr_flags;
                stream.compressed = stream.compressed || ((attr_flags & 0x0001) != 0);
                stream.encrypted = stream.encrypted || ((attr_flags & 0x4000) != 0);
                stream.sparse = stream.sparse || ((attr_flags & 0x8000) != 0);
                if (!nonresident) {
                    const uint32_t value_len = le32(record.data() + pos + 16);
                    const uint16_t value_off = le16(record.data() + pos + 20);
                    if (value_off + value_len <= attr_len) {
                        stream.resident = true;
                        stream.resident_data.assign(record.begin() + static_cast<long>(pos + value_off),
                                                    record.begin() + static_cast<long>(pos + value_off + value_len));
                        stream.data_size = std::max<uint64_t>(stream.data_size, value_len);
                    }
                } else {
                    const uint64_t start_vcn = le64(record.data() + pos + 16);
                    const uint16_t run_off = le16(record.data() + pos + 32);
                    stream.compression_unit_shift = record[pos + 34];
                    stream.alloc_size = std::max<uint64_t>(stream.alloc_size, le64(record.data() + pos + 40));
                    stream.data_size = std::max<uint64_t>(stream.data_size, le64(record.data() + pos + 48));
                    if (run_off < attr_len) {
                        bool has_sparse = false;
                        bool malformed = false;
                        auto runs = parse_runlist(record.data() + pos + run_off, attr_len - run_off, start_vcn, has_sparse, malformed);
                        stream.sparse = stream.sparse || has_sparse;
                        stream.unsupported_layout = stream.unsupported_layout || malformed;
                        merge_runs(stream.runs, runs);
                    }
                }
            }
            pos += attr_len;
        }
        return true;
    }
 
    bool load_attribute_list_extensions(uint64_t base_record_number,
                                        NtfsFileRecordInfo& info,
                                        const std::vector<NtfsAttributeListEntry>& attr_list,
                                        std::string& error) {
        std::set<uint64_t> processed;
        for (const auto& entry : attr_list) {
            if (entry.base_reference == 0 || entry.base_reference == base_record_number) continue;
            if (!processed.insert(entry.base_reference).second) continue;
            std::vector<unsigned char> ext_record;
            if (!read_mft_record(entry.base_reference, ext_record, error)) {
                error.clear();
                continue;
            }
            std::vector<NtfsAttributeListEntry> nested;
            if (!process_attributes(base_record_number, ext_record, info, nested, error)) {
                error.clear();
                continue;
            }
        }
        return true;
    }
 
    bool parse_file_record(uint64_t record_number,
                           const std::vector<unsigned char>& record,
                           NtfsFileRecordInfo& info,
                           std::string& error) {
        if (record.size() < 56 || std::string(reinterpret_cast<const char*>(record.data()), 4) != "FILE") {
            error = trs("Invalid MFT record signature");
            return false;
        }
        std::vector<NtfsAttributeListEntry> attr_list;
        if (!process_attributes(record_number, record, info, attr_list, error)) return false;
        if (!attr_list.empty()) {
            if (!load_attribute_list_extensions(record_number, info, attr_list, error)) return false;
        }
        for (auto& [name, stream] : info.streams) {
            if (stream.resident && stream.data_size == 0) stream.data_size = stream.resident_data.size();
            if (!stream.resident && stream.data_size == 0) {
                for (const auto& run : stream.runs) stream.data_size += run.length;
            }
        }
        return true;
    }
 
    // ============================================================
    // $I30 directory index walker
    // ============================================================
    //
    // Each NTFS directory has a B+tree index keyed by filename. Small
    // directories fit entirely in $INDEX_ROOT (resident attribute, type
    // 0x90, name "$I30"). Larger ones spill into $INDEX_ALLOCATION
    // (non-resident, type 0xA0, name "$I30") which holds INDX node
    // blocks of typically 4 KiB each.
    //
    // Each INDEX_ENTRY contains:
    //   __le64 file_ref           // MFT record number + sequence (high 16)
    //   __le16 entry_size
    //   __le16 name_attr_size     // size of $FILE_NAME content below
    //   __le32 flags              // 0x01 = has child node, 0x02 = last
    //   $FILE_NAME attribute (parent_ref + timestamps + name UTF-16)
    //   [__le64 child_vcn]        // present if flags & 0x01
    //
    // We extract (child_record_number, child_sequence_number, filename)
    // for every leaf entry. The filename here is the AUTHORITATIVE name
    // the parent uses to reference the child -- bypassing any out-of-date
    // $FILE_NAME in the child's MFT record.
 
    struct I30Entry {
        uint64_t child_record_number {0};
        uint16_t child_sequence_number {0};
        std::string filename;
        uint8_t  name_namespace {0};  // 0=POSIX, 1=Win32, 2=DOS, 3=both
    };
 
    // Parse all leaf entries from a buffer of INDEX_ENTRY records.
    // `entries_data` is the byte range starting at the first entry;
    // `total_size` is its length. Walks until it hits an entry with
    // flag 0x02 (= last) or runs out of bytes.
    void parse_index_entries(const unsigned char* entries_data,
                              size_t total_size,
                              std::vector<I30Entry>& out) {
        size_t off = 0;
        while (off + 16 <= total_size) {
            const unsigned char* e = entries_data + off;
            const uint16_t entry_size = le16(e + 8);
            const uint32_t flags = le32(e + 12);
            if (entry_size < 16 || off + entry_size > total_size) break;
 
            // The "last" flag (0x02) marks the end-of-entries sentinel
            // which has NO real data, just the optional child VCN.
            const bool is_last = (flags & 0x02) != 0;
 
            if (!is_last) {
                // file_ref at offset 0..7
                const uint64_t fref = le64(e + 0);
                I30Entry ie;
                ie.child_record_number = fref & 0x0000FFFFFFFFFFFFull;
                ie.child_sequence_number = static_cast<uint16_t>(fref >> 48);
                // $FILE_NAME starts at offset 16 (after the 16-byte
                // INDEX_ENTRY header). Layout:
                //   parent_ref (8) + 4*timestamp (32) + alloc_size (8)
                //   + real_size (8) + flags (4) + reparse_or_eas (4)
                //   + name_length (1) + name_namespace (1)
                //   + name UTF-16LE [name_length]
                const uint16_t name_attr_size = le16(e + 10);
                if (name_attr_size >= 66 && 16 + name_attr_size <= entry_size) {
                    const unsigned char* fn = e + 16;
                    const uint8_t name_chars = fn[64];
                    const uint8_t name_ns = fn[65];
                    if (66 + name_chars * 2u <= name_attr_size) {
                        ie.filename = decode_utf16le_ascii(fn + 66,
                            static_cast<size_t>(name_chars) * 2);
                        ie.name_namespace = name_ns;
                    }
                }
                if (!ie.filename.empty()) {
                    out.push_back(ie);
                }
            }
 
            off += entry_size;
            if (is_last) break;
        }
    }
 
    // Read one INDX block from $INDEX_ALLOCATION runs at logical
    // VCN `vcn`. `irs` is the index record size in bytes.
    bool read_indx_block(const std::vector<NtfsDataRun>& runs,
                          uint64_t vcn,
                          uint32_t irs,
                          std::vector<unsigned char>& out,
                          std::string& error) {
        if (irs == 0) return false;
        out.clear();
        out.resize(irs);
        // VCN-to-LCN translation: walk runs, find which run covers
        // the byte offset = vcn * irs.
        const uint64_t logical_off = vcn * irs;
        uint64_t cursor = 0;
        for (const auto& run : runs) {
            const uint64_t run_bytes = run.length;
            if (logical_off < cursor + run_bytes) {
                if (run.sparse) {
                    error = "indx block in sparse run";
                    return false;
                }
                const uint64_t inner = logical_off - cursor;
                const uint64_t phys = run.offset + inner;
                if (!reader_.read_at(phys, out.data(), irs)) {
                    error = "read failure on INDX block";
                    return false;
                }
                // Validate magic
                if (out.size() < 4 || std::memcmp(out.data(), "INDX", 4) != 0) {
                    error = "INDX magic mismatch";
                    return false;
                }
                // Apply USN/USA fixup (same algorithm as MFT)
                if (!apply_fixup(out, error)) return false;
                return true;
            }
            cursor += run_bytes;
        }
        error = "VCN out of allocation range";
        return false;
    }
 
    // Walks $INDEX_ROOT + (recursively) $INDEX_ALLOCATION blocks for a
    // directory record, collecting all (filename, child_ref) pairs.
    void walk_i30(const NtfsFileRecordInfo& dir_info,
                  std::vector<I30Entry>& out_entries,
                  std::vector<std::string>& logs) {
        if (dir_info.index_root_data.size() < 32) return;
        const unsigned char* root = dir_info.index_root_data.data();
        // After the 16-byte index attribute header (type+collation+
        // size+clusters_per_record+reserved), the INDEX_HEADER starts:
        //   __le32 first_entry_offset (relative to INDEX_HEADER start)
        //   __le32 used_size
        //   __le32 total_size
        //   __u8   flags          (bit 0 = "has child VCN" entries)
        //   __u8   reserved[3]
        const unsigned char* ihdr = root + 16;
        const uint32_t first_off = le32(ihdr + 0);
        const uint32_t used_sz   = le32(ihdr + 4);
        if (16 + first_off > dir_info.index_root_data.size() ||
            16 + used_sz > dir_info.index_root_data.size()) return;
        const unsigned char* root_entries = ihdr + first_off;
        const size_t root_entries_size = used_sz > first_off
                                          ? used_sz - first_off : 0;
        parse_index_entries(root_entries, root_entries_size, out_entries);
 
        // Recurse into INDEX_ALLOCATION blocks. For simplicity we
        // walk the runlist linearly and parse every block whose magic
        // is "INDX" (we don't follow the B+tree pointer structure;
        // we just enumerate all leaves). This works because each
        // INDX block is self-describing.
        if (dir_info.index_allocation_runs.empty() ||
            dir_info.index_record_size == 0) return;
        const uint32_t irs = dir_info.index_record_size;
        // Total size = sum of run lengths. Walk every irs-sized block.
        uint64_t total = 0;
        for (const auto& r : dir_info.index_allocation_runs) total += r.length;
        const uint64_t num_blocks = total / irs;
        constexpr uint64_t kMaxBlocksPerDir = 100000;  // sanity cap
        const uint64_t cap = std::min<uint64_t>(num_blocks, kMaxBlocksPerDir);
        for (uint64_t vcn = 0; vcn < cap; ++vcn) {
            std::vector<unsigned char> block;
            std::string err;
            if (!read_indx_block(dir_info.index_allocation_runs,
                                  vcn, irs, block, err)) {
                // Not all VCNs in the allocation range are necessarily
                // valid INDX blocks (they may be unallocated). The
                // $BITMAP would tell us which are; we just skip on
                // failure here.
                continue;
            }
            // INDX block layout (after the 24-byte header):
            //   __le32 first_entry_offset (relative to INDEX_HEADER)
            //   __le32 used_size
            //   __le32 total_size
            //   __u8   flags
            //   __u8   reserved[3]
            // INDEX_HEADER starts at offset 24 of the INDX block.
            if (block.size() < 24 + 16) continue;
            const unsigned char* h = block.data() + 24;
            const uint32_t fo = le32(h + 0);
            const uint32_t us = le32(h + 4);
            if (24 + fo > block.size() || 24 + us > block.size()) continue;
            const unsigned char* ents = h + fo;
            const size_t ents_sz = us > fo ? us - fo : 0;
            parse_index_entries(ents, ents_sz, out_entries);
        }
        if (!out_entries.empty()) {
            std::ostringstream m;
            m << "NTFS $I30 walker: directory MFT#"
              << dir_info.record_number << " yielded "
              << out_entries.size() << " index entries";
            logs.push_back(m.str());
        }
    }
 
 
    fs::path build_relative_path(uint64_t record_number, const std::map<uint64_t, NtfsFileRecordInfo>& records) {
        std::vector<std::string> parts;
        std::set<uint64_t> seen;
        uint64_t current = record_number;
        bool sequence_mismatch = false;
        while (seen.insert(current).second) {
            auto it = records.find(current);
            if (it == records.end()) break;
            const auto& info = it->second;
            if (!info.name.empty() && info.name != ".") parts.push_back(sanitize_component(info.name));
            if (current == 5 || info.parent_record_number == current || info.parent_record_number == 0) break;
            // Sequence number check: the child claims its parent had
            // sequence `parent_sequence_number` when the dirent was
            // written. If the parent's CURRENT own_sequence_number
            // differs, the parent record was reused for a different
            // file/directory; our path is mythical.
            const uint16_t expected_parent_seq = info.parent_sequence_number;
            auto pit = records.find(info.parent_record_number);
            if (pit != records.end() && expected_parent_seq != 0 &&
                pit->second.own_sequence_number != 0 &&
                pit->second.own_sequence_number != expected_parent_seq) {
                sequence_mismatch = true;
                break;
            }
            current = info.parent_record_number;
            if (current == 5) break;
        }
        if (parts.empty()) return {};
        fs::path out;
        for (auto it = parts.rbegin(); it != parts.rend(); ++it) out /= *it;
        // Mark seq-mismatched paths so the caller can route them to
        // a separate "orphaned-seq-mismatch" subdir if desired.
        if (sequence_mismatch) {
            out = fs::path("orphaned-seq-mismatch") / out;
        }
        return out;
    }
 
    bool stream_exportable(const NtfsDataStream& stream) const {
        return !stream.encrypted && !stream.unsupported_layout && (stream.resident || !stream.runs.empty() || stream.data_size == 0);
    }
 
    fs::path output_path_for_stream(const fs::path& base, const std::string& stream_name) {
        if (stream_name.empty()) return unique_path(base);
        const std::string marker = "__ADS_" + sanitize_component(stream_name);
        fs::path named = base.parent_path() /
                         fs::path(base.stem().string() + marker + base.extension().string());
        return unique_path(named);
    }
 
    fs::path unique_path(const fs::path& candidate) {
        fs::path unique = candidate;
        int suffix = 1;
        while (fs::exists(unique)) {
            unique = candidate.parent_path() /
                     fs::path(candidate.stem().string() + "_" + std::to_string(suffix++) + candidate.extension().string());
        }
        return unique;
    }
 
 
    void export_reparse_sidecar(const NtfsFileRecordInfo& info,
                                const fs::path& base_path,
                                std::vector<RecoveredFileRecord>& recovered,
                                std::vector<std::string>& logs) {
        if (!info.has_reparse_point || info.reparse_data.size() < 8) return;
 
        const uint32_t tag = le32(info.reparse_data.data());
        const uint16_t data_len = le16(info.reparse_data.data() + 4);
 
        // Common reparse tags:
        constexpr uint32_t IO_REPARSE_TAG_MOUNT_POINT = 0xA0000003;  // junction
        constexpr uint32_t IO_REPARSE_TAG_SYMLINK     = 0xA000000C;
 
        // Try to extract a target path string from the reparse data
        // and create a real symlink at base_path.
        std::string target_str;
        bool target_extracted = false;
        if (tag == IO_REPARSE_TAG_SYMLINK && info.reparse_data.size() >= 20) {
            // Layout (after the 8-byte common header):
            //   __le16 substitute_name_offset
            //   __le16 substitute_name_length
            //   __le16 print_name_offset
            //   __le16 print_name_length
            //   __le32 flags
            //   path_buffer[...]
            const uint16_t sub_off = le16(info.reparse_data.data() + 8);
            const uint16_t sub_len = le16(info.reparse_data.data() + 10);
            const uint16_t print_off = le16(info.reparse_data.data() + 12);
            const uint16_t print_len = le16(info.reparse_data.data() + 14);
            // Path buffer is at +20 (after flags). Prefer "print name"
            // (= what the user sees, no \??\ prefix).
            const size_t buf_start = 20;
            if (print_len > 0 &&
                buf_start + print_off + print_len <= info.reparse_data.size()) {
                target_str = decode_utf16le_ascii(
                    info.reparse_data.data() + buf_start + print_off,
                    print_len);
                target_extracted = !target_str.empty();
            } else if (sub_len > 0 &&
                       buf_start + sub_off + sub_len <= info.reparse_data.size()) {
                target_str = decode_utf16le_ascii(
                    info.reparse_data.data() + buf_start + sub_off,
                    sub_len);
                // Strip leading "\??\" or "\\?\" prefix (Windows
                // namespace artefacts)
                if (target_str.rfind("\\??\\", 0) == 0 ||
                    target_str.rfind("\\\\?\\", 0) == 0) {
                    target_str = target_str.substr(4);
                }
                target_extracted = !target_str.empty();
            }
        } else if (tag == IO_REPARSE_TAG_MOUNT_POINT &&
                   info.reparse_data.size() >= 16) {
            // Junction layout (no flags field):
            //   __le16 substitute_name_offset
            //   __le16 substitute_name_length
            //   __le16 print_name_offset
            //   __le16 print_name_length
            //   path_buffer[...]
            const uint16_t print_off = le16(info.reparse_data.data() + 12);
            const uint16_t print_len = le16(info.reparse_data.data() + 14);
            const size_t buf_start = 16;
            if (print_len > 0 &&
                buf_start + print_off + print_len <= info.reparse_data.size()) {
                target_str = decode_utf16le_ascii(
                    info.reparse_data.data() + buf_start + print_off,
                    print_len);
                target_extracted = !target_str.empty();
            }
        }
 
        if (target_extracted) {
            // Convert backslashes to forward slashes for POSIX
            std::replace(target_str.begin(), target_str.end(), '\\', '/');
            // Try to create a real symlink at base_path
            std::error_code ec;
            const fs::path link_path = unique_path(base_path);
            fs::create_symlink(target_str, link_path, ec);
            if (!ec) {
                recovered.push_back({
                    link_path.string(), "NTFS",
                    link_path.filename().string(),
                    static_cast<uint64_t>(target_str.size()),
                    "full", tag == IO_REPARSE_TAG_SYMLINK
                            ? "symlink (recreated)"
                            : "junction (recreated)"});
                logs.push_back(trs("Recovered NTFS reparse as symlink:") +
                               std::string(" ") + link_path.string() +
                               " -> " + target_str);
                return;
            }
            // If symlink creation failed (filesystem doesn't support
            // it, permission denied, or target name has illegal chars),
            // fall through to sidecar.
        }
 
        // Sidecar fallback: write the metadata as a text file
        const fs::path sidecar = unique_path(base_path.parent_path() /
                                             fs::path(base_path.stem().string() + "__reparse.txt"));
        std::ofstream out(sidecar, std::ios::binary);
        if (!out) return;
        out << "reparse_tag=" << tag << "\n";
        out << "reparse_data_length=" << data_len << "\n";
        if (target_extracted) {
            out << "extracted_target=" << target_str << "\n";
        }
        out << "raw_bytes=";
        static const char* hex = "0123456789ABCDEF";
        for (unsigned char c : info.reparse_data) {
            out << hex[(c >> 4) & 0xF] << hex[c & 0xF];
        }
        out << "\n";
        recovered.push_back({sidecar.string(), "NTFS", sidecar.filename().string(), static_cast<uint64_t>(info.reparse_data.size()), "metadata", "reparse metadata"});
        logs.push_back(trs("Recovered NTFS reparse metadata:") + std::string(" ") + sidecar.string());
    }
 
    void export_usn_summary_if_needed(const NtfsFileRecordInfo& info,
                                      const fs::path& base_path,
                                      std::vector<RecoveredFileRecord>& recovered,
                                      std::vector<std::string>& logs) {
        if (info.name != "$UsnJrnl") return;
        auto it = info.streams.find("$J");
        if (it == info.streams.end()) return;
        const fs::path summary = unique_path(base_path.parent_path() /
                                             fs::path(base_path.stem().string() + "__usn_summary.txt"));
        std::ofstream out(summary, std::ios::binary);
        if (!out) return;
        out << "stream=$J\n";
        out << "size=" << it->second.data_size << "\n";
        out << "resident=" << (it->second.resident ? 1 : 0) << "\n";
        out << "compressed=" << (it->second.compressed ? 1 : 0) << "\n";
        out << "sparse=" << (it->second.sparse ? 1 : 0) << "\n";
        recovered.push_back({summary.string(), "NTFS", summary.filename().string(), 0, "metadata", "USN summary"});
        logs.push_back(trs("Recovered NTFS USN summary:") + std::string(" ") + summary.string());
    }
 
 
    bool read_stream_data(const NtfsDataStream& stream,
                          std::vector<unsigned char>& data,
                          std::string& error) {
        data.clear();
        if (stream.resident) {
            data = stream.resident_data;
            if (data.size() > stream.data_size) data.resize(static_cast<size_t>(stream.data_size));
            if (data.size() < stream.data_size) data.resize(static_cast<size_t>(stream.data_size), 0);
            return true;
        }
        if (stream.compressed) return decode_compressed_stream(stream, data, error);
        return read_runs_to_buffer(stream.runs, stream.data_size, data, error);
    }
 
    void write_usn_reason_flags(std::ostream& out, uint32_t reason) {
        struct FlagName { uint32_t flag; const char* name; };
        static constexpr FlagName names[] = {
            {0x00000001u, "DATA_OVERWRITE"},
            {0x00000002u, "DATA_EXTEND"},
            {0x00000004u, "DATA_TRUNCATION"},
            {0x00000010u, "NAMED_DATA_OVERWRITE"},
            {0x00000020u, "NAMED_DATA_EXTEND"},
            {0x00000040u, "NAMED_DATA_TRUNCATION"},
            {0x00000100u, "FILE_CREATE"},
            {0x00000200u, "FILE_DELETE"},
            {0x00000400u, "EA_CHANGE"},
            {0x00000800u, "SECURITY_CHANGE"},
            {0x00001000u, "RENAME_OLD_NAME"},
            {0x00002000u, "RENAME_NEW_NAME"},
            {0x00004000u, "INDEXABLE_CHANGE"},
            {0x00008000u, "BASIC_INFO_CHANGE"},
            {0x00010000u, "HARD_LINK_CHANGE"},
            {0x00020000u, "COMPRESSION_CHANGE"},
            {0x00040000u, "ENCRYPTION_CHANGE"},
            {0x00080000u, "OBJECT_ID_CHANGE"},
            {0x00100000u, "REPARSE_POINT_CHANGE"},
            {0x00200000u, "STREAM_CHANGE"},
            {0x00400000u, "TRANSACTED_CHANGE"},
            {0x00800000u, "INTEGRITY_CHANGE"},
            {0x80000000u, "CLOSE"},
        };
        bool first = true;
        for (const auto& entry : names) {
            if ((reason & entry.flag) == 0) continue;
            if (!first) out << '|';
            out << entry.name;
            first = false;
        }
        if (first) out << '0';
    }
 
    bool export_stream(const NtfsDataStream& stream, const fs::path& out_path, std::string& error) {
        std::vector<unsigned char> data;
        if (stream.resident) {
            data = stream.resident_data;
        } else if (stream.compressed) {
            if (!decode_compressed_stream(stream, data, error)) return false;
        } else {
            if (!read_runs_to_buffer(stream.runs, stream.data_size, data, error)) return false;
        }
        if (data.size() > stream.data_size) data.resize(static_cast<size_t>(stream.data_size));
        std::ofstream out(out_path, std::ios::binary);
        if (!out) {
            error = trs("Unable to create output file") + std::string(": ") + out_path.string();
            return false;
        }
        if (!data.empty()) out.write(reinterpret_cast<const char*>(data.data()), static_cast<std::streamsize>(data.size()));
        return static_cast<bool>(out);
    }
 
    // ============================================================
    // $LogFile transaction journal pass (NTFS log records recovery)
    // ============================================================
    //
    // The $LogFile (MFT record 2) is NTFS's WAL transaction journal.
    // Its layout (from the Linux NTFS-3G/Tuxera driver source and
    // [Russinovich, Solomon, "Windows Internals"]):
    //
    //   First 8 KiB: two RESTART AREAS (4 KiB each, alternating).
    //     Each starts with "RSTR" magic (0x52 0x53 0x54 0x52),
    //     followed by a fixup, then RESTART_AREA + LOG_CLIENT_RECORD.
    //
    //   Rest of the file (= 64 MiB typically): RCRD pages of 4 KiB,
    //     each starting with "RCRD" magic (0x52 0x43 0x52 0x44).
    //     Each page contains a 64-byte header + a sequence of LSN
    //     records (LOG_RECORD_HEADER + redo/undo data).
    //
    // We do NOT do a real transaction replay -- that would require
    // tracking Open Attribute Tables, dirty pages, transaction
    // commit/abort state, and is hundreds more lines. Instead we do
    // a SIMPLE-AND-USEFUL pass:
    //
    //   For each LSN record whose redo_op is InitializeFileRecordSegment
    //   (== 0x10), the redo_data IS a complete MFT file record. If that
    //   record number is now FREE in the live MFT (= file was deleted)
    //   OR the live record has a different sequence number (= MFT slot
    //   was reused for another file), we save the journal copy as a
    //   recovered file. This catches recently-deleted files that didn't
    //   make it to a checkpoint flush yet.
    //
    // Scope limits:
    //   - We only handle the InitializeFileRecordSegment opcode.
    //   - We do not follow redo/undo chains (= no rollback semantics).
    //   - LZNT1-compressed log records are not decompressed (rare).
 
    static constexpr uint32_t kLogPageMagicRSTR = 0x52545352u; // "RSTR" little-endian
    static constexpr uint32_t kLogPageMagicRCRD = 0x44524352u; // "RCRD" little-endian
    static constexpr uint16_t kRedoOpInitFileRecord = 0x0010;
 
    void scan_logfile(const fs::path& out_root,
                      const std::map<uint64_t, NtfsFileRecordInfo>& live_records,
                      std::vector<RecoveredFileRecord>& recovered,
                      std::vector<std::string>& logs) {
        // Step 1: read $LogFile (MFT record 2)
        std::vector<unsigned char> logrec;
        std::string err;
        if (!read_mft_record(2, logrec, err)) {
            logs.push_back(trs("NTFS $LogFile: cannot read MFT record 2 (skipping)"));
            return;
        }
        NtfsFileRecordInfo loginfo;
        if (!parse_file_record(2, logrec, loginfo, err)) {
            logs.push_back(trs("NTFS $LogFile: parse failed (skipping)"));
            return;
        }
        auto data_it = loginfo.streams.find("");
        if (data_it == loginfo.streams.end()) {
            logs.push_back(trs("NTFS $LogFile: no $DATA stream"));
            return;
        }
        const NtfsDataStream& logdata = data_it->second;
 
        // Cap LogFile size we read at 256 MB (typical is 64 MB). This
        // protects us from runaway corrupt sizes.
        constexpr uint64_t kLogFileMaxBytes = 256ull * 1024 * 1024;
        const uint64_t to_read = std::min<uint64_t>(logdata.data_size,
                                                     kLogFileMaxBytes);
        if (to_read < 8192) {
            logs.push_back(trs("NTFS $LogFile: too small (<8 KiB)"));
            return;
        }
        std::vector<unsigned char> logbuf;
        logbuf.reserve(static_cast<size_t>(to_read));
        std::string rs_err;
        if (!read_runs_to_buffer(logdata.runs, to_read, logbuf, rs_err)) {
            logs.push_back(trs("NTFS $LogFile: cannot read content: ") + rs_err);
            return;
        }
        logs.push_back(trs("NTFS $LogFile: loaded ") +
                       std::to_string(logbuf.size()) +
                       trs(" bytes; scanning for recoverable file records"));
 
        // Step 2: iterate RCRD pages (4 KiB each), starting after the
        // restart area (= first 8 KiB).
        constexpr size_t kPageSize = 4096;
        size_t init_redo_records_seen = 0;
        size_t recovered_from_log = 0;
        size_t pages_scanned = 0;
 
        fs::path log_out = out_root / "logfile_recovered";
        bool log_out_created = false;
 
        for (size_t page_off = 8 * 1024; page_off + kPageSize <= logbuf.size();
             page_off += kPageSize) {
            const unsigned char* page = logbuf.data() + page_off;
            const uint32_t magic = le32(page);
            if (magic != kLogPageMagicRCRD) continue;
            ++pages_scanned;
 
            // RCRD page header is 64 bytes. After fixup, the rest is
            // a sequence of LSN records. Layout (per ntfs-3g logfile.h):
            //   0x00  __le32  magic ('RCRD')
            //   0x04  __le16  usa_ofs  (update sequence array offset)
            //   0x06  __le16  usa_count
            //   0x08  __le64  lsn (chkdsk lsn)
            //   0x10  __le32  flags
            //   0x14  __le16  page_count
            //   0x16  __le16  page_position
            //   0x18  __le16  next_record_offset (relative to page start)
            //   0x1A  ... unused
            //
            // We don't apply fixup to the WHOLE page -- the LogFile
            // fixup logic is more complex (per-record). We rely on
            // best-effort scanning instead.
 
            const uint16_t next_rec_off = le16(page + 0x18);
            if (next_rec_off < 0x40 || next_rec_off >= kPageSize) continue;
 
            // Walk LOG_RECORD_HEADER entries within the page.
            // Each header is 0x30 bytes:
            //   0x00  __le64  this_lsn
            //   0x08  __le64  client_previous_lsn
            //   0x10  __le64  client_undo_next_lsn
            //   0x18  __le32  client_data_length (= length AFTER header)
            //   0x1C  __le16  client_id (seq + index)
            //   0x1E  __le16  reserved
            //   0x20  __le32  record_type   (1=normal, 2=checkpoint)
            //   0x24  __le32  transaction_id
            //   0x28  __le16  flags         (LOG_RECORD_MULTI_PAGE etc.)
            //   0x2A  __le16  reserved x3
            //   0x30  __le16  redo_op
            //   0x32  __le16  undo_op
            //   0x34  __le16  redo_offset   (= offset of redo_data
            //                                   within this entry)
            //   0x36  __le16  redo_length
            //   0x38  __le16  undo_offset
            //   0x3A  __le16  undo_length
            //   0x3C  __le16  target_attribute
            //   0x3E  __le16  lcns_to_follow
            //   0x40  __le16  record_offset
            //   0x42  __le16  attribute_offset
            //   0x44  __le16  cluster_block_offset
            //   0x46  __le16  reserved
            //   0x48  __le64  target_vcn
            //   0x50  __le64  lcn_list[lcns_to_follow]
            // Then redo_data and undo_data at the offsets given.
            //
            // Total log-record header = 0x30 bytes BEFORE LCN list.
            // For our purposes (find redo_op = InitFileRecord) we only
            // need the first ~0x40 bytes.
 
            size_t pos = 0x40;  // first LSN record after page header
            const size_t page_end = next_rec_off;
            while (pos + 0x40 <= page_end) {
                const unsigned char* lr = page + pos;
                // client_data_length includes the body but NOT the
                // 0x30-byte header. Sanity-check it.
                const uint32_t client_data_length = le32(lr + 0x18);
                const uint16_t redo_op   = le16(lr + 0x30);
                const uint16_t redo_off  = le16(lr + 0x34);
                const uint16_t redo_len  = le16(lr + 0x36);
                const uint16_t target_attr = le16(lr + 0x3C);
 
                // Plausibility: the entry must fit within the page
                if (client_data_length > 65536) break;
                const size_t entry_total =
                    0x30 + static_cast<size_t>(client_data_length);
                if (entry_total > 65536 || pos + entry_total > kPageSize) break;
 
                if (redo_op == kRedoOpInitFileRecord &&
                    redo_len >= 1024 && redo_len <= 4096) {
                    ++init_redo_records_seen;
                    // The redo_data IS a complete MFT file record.
                    // Locate it within the LSN entry.
                    if (redo_off + redo_len > entry_total) {
                        pos += entry_total > 0x30 ? entry_total : 0x30;
                        continue;
                    }
                    const unsigned char* mftrec_raw = lr + redo_off;
                    std::vector<unsigned char> mftrec(
                        mftrec_raw, mftrec_raw + redo_len);
 
                    // Apply fixup (USN/USA) to recover original sectors
                    std::string fix_err;
                    if (!apply_fixup(mftrec, fix_err)) continue;
 
                    // Parse it as a regular MFT record
                    NtfsFileRecordInfo info;
                    if (!parse_file_record(0, mftrec, info, fix_err)) continue;
                    if (info.is_directory || info.name.empty()) continue;
 
                    // target_attribute is the MFT record number this log
                    // entry refers to. Use it as our "record number".
                    const uint64_t mft_no = target_attr;
                    info.record_number = mft_no;
 
                    // Skip if the live MFT already has this record
                    // (with same seq number). We just check presence
                    // here -- the seq comparison would require parsing
                    // the seq field in both records, which we skip for
                    // simplicity.
                    if (live_records.count(mft_no) > 0) continue;
 
                    // Try to export every $DATA stream we find
                    bool exported_any = false;
                    for (const auto& [stream_name, stream] : info.streams) {
                        if (!stream_exportable(stream)) continue;
                        if (!log_out_created) {
                            std::error_code ec;
                            fs::create_directories(log_out, ec);
                            log_out_created = true;
                        }
                        std::string fname = sanitize_component(info.name);
                        if (!stream_name.empty()) fname += "_" + sanitize_component(stream_name);
                        fname = "mft" + std::to_string(mft_no) + "_" + fname;
                        const fs::path target = log_out / fname;
                        std::string ex_err;
                        if (export_stream(stream, target, ex_err)) {
                            recovered.push_back({
                                target.string(), "NTFS",
                                ("logfile_recovered/" + fname),
                                stream.data_size, "partial",
                                "$LogFile-redo"});
                            exported_any = true;
                        }
                    }
                    if (exported_any) ++recovered_from_log;
                }
 
                pos += entry_total > 0x30 ? entry_total : 0x30;
                // Round to 8-byte alignment (LSN records are 8-aligned)
                pos = (pos + 7u) & ~size_t{7u};
            }
        }
 
        std::ostringstream m;
        m << trs("NTFS $LogFile: ") << pages_scanned
          << trs(" RCRD pages scanned, ") << init_redo_records_seen
          << trs(" InitFileRecord redo entries found, ") << recovered_from_log
          << trs(" file records recovered to logfile_recovered/");
        logs.push_back(m.str());
    }
};
 
NtfsRecovery::NtfsRecovery(DiskReader& reader) : reader_(reader) {}
 
bool NtfsRecovery::recover(uint64_t volume_offset,
                           const std::string& output_dir,
                           std::vector<RecoveredFileRecord>& recovered,
                           std::vector<std::string>& logs,
                           std::string& error) {
    NtfsRecoveryImpl impl(reader_);
    return impl.recover(volume_offset, output_dir, recovered, logs, error);
}