Release v3.3.2

This release improves the accuracy of NTFS metadata analysis, file size filtering, and alternate data stream (ADS) handling.

Improvements

• File size detection: File sizes now prioritize the MFT parser's entry.file_size over potentially outdated $FILE_NAME.logical_size values.
• ADS size handling: Named streams now report their actual resident data size when available. Unknown stream sizes are no longer incorrectly inherited from the base file.
• Attribute classification: Improved identification of $DATA attributes using NTFS attribute type codes.
• Updated dependency: Updated ntfsdump to v3.3.2, incorporating improvements to file extraction, OS volume detection, and virtual disk handling.
• Regression tests: Expanded test coverage for file sizes, named streams, and NTFS attribute classification.

Bug Fixes

• Fixed incorrect file size reporting caused by stale $FILE_NAME metadata.
• Fixed ADS records incorrectly reporting the base file's size.
• Fixed potential misclassification of named NTFS attributes as $DATA streams.

Notes

• Non-resident ADS sizes remain unknown when they cannot be determined from the MFT parser. These records are excluded when using --size.
• Updated the ntfsdump dependency to 3.3.2.

Full Changelog: v3.3.1...v3.3.2