data variables of non-resident of normal file are corrupted about ntfsprogs-plus HOT 4 OPEN

how about that cluster run is base line of other data variables. and if cluster runs is corrupted (how we know that?), ...
Hmm, I suggest that verify cluster runs at first, if it is verified, then make it base line of other metadata.

from ntfsprogs-plus.

I tried to do that too at first. But I was shocked after checking that windows handle it. When I force to change data_size of non resident attribute, windows set to zero sizes(data, allocated, init) and remove all cluster runs and changed to resident. I have to experiment a little more, but windows seems to just reset the entry when the data size related metadata is damaged due to security issues. Because if it is recovered, there seems to be a risk of exposing security data...

from ntfsprogs-plus.

@jaysim I am checking this.

from ntfsprogs-plus.

FIXED. But need to check sizes of non-resident of system metadata. especially, If non-resident of root entry is corrupted, we don't re-create(after removing it) $IA attribute. Maybe, we need to just truncate $IA and $IR with zero or newsize.

from ntfsprogs-plus.