pytsk/libtsk does not correctly/fully handle NTFS

[joachimmetz]

libtsk (and therefore pytsk) does not correctly handle NTFS.

Issues reported to upstream:

• incorrect link count for NTFS short/long file name pairs NTFS link count implementation details missing from NTFS Implementation Notes sleuthkit/sleuthkit#1881
• incorrect date and time conversion istat: incorrect NTFS date and time conversion sleuthkit/sleuthkit#2575
• ntfs: unable to read lznt1 compressed file sleuthkit/sleuthkit#3289

Issues not yet reported to upstream:

• lack of support of cluster sizes: 256, 128k, 256k, 512k, 1m, 2m

[joachimmetz]

Possibly a pytsk3 specific edge case:

• get file entry by path
• file entry has a base reference that is non 0
• Linux NTFS implementation refuses to read the data stream

Does pytsk behave similar?