Module data 

Reconstructing an attribute’s bytes — resident inline, or non-resident by following its runlist across the volume.

Sparse runs yield zeroes without touching the disk; real runs are read at lcn × cluster_size. The output is bounded by the attribute’s real size and by the bytes its runs actually allocate, and every size is checked — a crafted runlist cannot trigger an unbounded allocation or an out-of-range seek.

Functions

attribute_runlist

Decode the data-run list of a non-resident attribute from its (fixed-up) record bytes.

read_attribute_value

Read an attribute’s value, dispatching on resident vs non-resident.

read_runs

Read real_size bytes of a file described by runs, from reader.