Skip to main content

Module refs

Module refs 

Source
Expand description

ReFS (Resilient File System) aware handling of USN V3 records.

ReFS uses full 128-bit file reference numbers instead of NTFS’s 48-bit entry

  • 16-bit sequence format. This module provides types and analysis for ReFS volumes where USN_RECORD_V3 records contain these wider references.

Key differences from NTFS:

  • File references are opaque 128-bit IDs, not split into entry+sequence
  • No traditional $MFT, so path reconstruction relies solely on journal rewind
  • V3 records have major_version: 3

Structs§

RefsAnalyzer
Analyzer for ReFS USN journal data.
RefsFileId
A full 128-bit ReFS file identifier.
RefsRecord
A USN V3 record enriched with full 128-bit ReFS file references.