Expand description
ReFS (Resilient File System) aware handling of USN V3 records.
ReFS uses full 128-bit file reference numbers instead of NTFS’s 48-bit entry
- 16-bit sequence format. This module provides types and analysis for ReFS volumes where USN_RECORD_V3 records contain these wider references.
Key differences from NTFS:
- File references are opaque 128-bit IDs, not split into entry+sequence
- No traditional $MFT, so path reconstruction relies solely on journal rewind
- V3 records have
major_version: 3
Structs§
- Refs
Analyzer - Analyzer for ReFS USN journal data.
- Refs
File Id - A full 128-bit ReFS file identifier.
- Refs
Record - A USN V3 record enriched with full 128-bit ReFS file references.