Release v3.3.2

This release improves the reliability of NTFS file extraction, Windows volume detection, and VMware disk image handling.

Improvements

• Streaming extraction: Files and alternate data streams (ADS) are now extracted in chunks, significantly reducing memory usage for large files.
• Safer file extraction: Incomplete reads and unexpected EOFs now raise errors. Temporary files are cleaned up on failure, preserving existing output files.
• OS volume detection: Improved automatic selection of Windows OS volumes on disks containing multiple NTFS partitions, including recovery partitions.
• VMware current state: The current virtual disk is now resolved from VMX metadata instead of relying on snapshot.current.
• VMDK handling: Improved parent-chain and extent resolution, with safeguards against references outside the image directory and symlink-based redirection.
• ADS extraction: Stream names are converted into filesystem-safe output filenames, with collision handling.
• Output options: Added --output-file to save an extracted file under a custom filename.
• Flat output: --flat now incorporates directory paths into filenames to reduce name collisions.

Bug Fixes

• Fixed silent truncation when file reads terminate unexpectedly.
• Fixed extraction failures being incorrectly reported as successful.
• Fixed potential overwriting of files with conflicting output names.
• Fixed wildcard prefix matching during file extraction.
• Improved error reporting for missing paths and read failures.
• Improved NTFS volume identification and selection messages.

Notes

• The filename convention for --flat output has changed.
• When multiple NTFS volumes are detected and the OS volume cannot be identified reliably, use --volume to select the intended partition.
• An existing output file can be used as the destination for a single-file extraction. Use --output-file to specify a new filename explicitly.

Full Changelog: v3.3.1...v3.3.2