Module deferred 

Deferred $ATTRIBUTE_LIST name resolution (ADR-0011): name-bearing extension records are cached in RAM while the $MFT streams through, so this pass resolves names without disk reads; anything missing (cache cap, torn records) falls back to a targeted read of the live volume.

Structs

LazyRecordReader 🔒

Disk fallback for extension records missing from the streamed cache — opened only when actually needed (expected: never on a healthy scan).

RecordReader 🔒

Random access to single records for the deferred attribute-list pass.

Constants

EXT_NAME_CACHE_CAP 🔒

Upper bound on cached name-bearing extension records (~1KiB each, so ≤128MiB transient). A real C: has tens of thousands; past the cap the deferred pass falls back to disk reads for the remainder.

Functions

resolve_attr_list_name 🔒

Resolve the display name of a record whose $FILE_NAME lives in extension records (resident $ATTRIBUTE_LIST → referenced records). Targets come from the streamed extension-record cache; anything missing (cache cap, torn records) falls back to a targeted disk read. Mirrors ntfs-reader’s get_best_file_name without needing the whole MFT in RAM.

resolve_deferred 🔒

Resolve deferred $ATTRIBUTE_LIST names in parallel — almost entirely from RAM: every target is an extension record and the whole $MFT just streamed through the pipeline, so ext already holds the bytes (ADR-0011). Chunk order is preserved, so EntryId assignment matches a serial loop.