NTFS: fstat (and fls) characters missing from file name

[joachimmetz]

This might be an edge case but fstat (and fls) fail to represent an unpaired surrogate in an NTFS file name

Test file generated with https://github.com/dfirlabs/ntfs-specimens/blob/main/generate-specimens-unicode-linux.sh

Tested with 820b185

istat ntfs_unicode_files.raw 15316-128-2 

MFT Entry Header Values:
Entry: 15316        Sequence: 1
$LogFile Sequence Number: 0
Allocated File
Links: 1

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 0  ()
Created:	2023-07-03 08:41:46.861097900 (CEST)
File Modified:	2023-07-03 08:41:46.861097900 (CEST)
MFT Modified:	2023-07-03 08:41:46.861097900 (CEST)
Accessed:	2023-07-03 08:41:46.861097900 (CEST)

$FILE_NAME Attribute Values:
Flags: Archive
Name: unicode_U+0000d800_
Parent MFT Entry: 64 	Sequence: 1
Allocated Size: 0   	Actual Size: 0
Created:	2023-07-03 08:41:46.861097900 (CEST)
File Modified:	2023-07-03 08:41:46.861097900 (CEST)
MFT Modified:	2023-07-03 08:41:46.861097900 (CEST)
Accessed:	2023-07-03 08:41:46.861097900 (CEST)

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 48
Type: $FILE_NAME (48-3)   Name: N/A   Resident   size: 106
Type: $SECURITY_DESCRIPTOR (80-1)   Name: N/A   Resident   size: 80
Type: $DATA (128-2)   Name: N/A   Resident   size: 0

Name unicode_U+0000d800_ appears to silently remove U+0000d800

Expected (or something similar) using ls on a file system mount:

testdir1/unicode_U+0000d800_'$'\355\240\200

[joachimmetz]

Related issue: #2837