Add support for Windows Overlay Filter compressed files

[Horofic]

This PR adds preliminary support for Windows Overlay Filter (WOF) compressed files. At the moment only LZXPRESS + Huffman (all chunks sizes) compressed files are supported. This is also the default compression method Windows uses, I have not seen other compression methods used in the wild.

Currently some simple tests cases have been added to test this functionality. More test cases are to follow.

Depends on fox-it/dissect.util#76
Closes #41

[Copilot]

Pull Request Overview

This PR introduces preliminary support for Windows Overlay Filter (WOF) compressed files using LZXPRESS + Huffman and updates various modules and tests accordingly. Key changes include:

• Adding new tests for WOF compressed file handling.
• Implementing a new WofCompressedStream class for decompression.
• Updating MFT and attribute parsing to recognize and process WOF compression.

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_wof.py	New tests for verifying WOF decompression using LZXPRESS variants.
tests/test_mft.py	New test cases simulating MFT records with various WOF compression.
tests/test_attr.py	Extended tests to validate the new WOF compression attribute.
dissect/ntfs/stream.py	Added WofCompressedStream for handling WOF compressed data streams.
dissect/ntfs/mft.py	Updated MFT record handling to support WOF compressed records.
dissect/ntfs/c_ntfs.py	Introduced new enum values and a decompressor map for WOF formats.
dissect/ntfs/attr.py	Extended attribute parsing to include WOF compression format extraction.

Comments suppressed due to low confidence (1)

dissect/ntfs/stream.py:168

• The bitwise operation used to compute the uncompressed size relies on implicit precedence assumptions. Consider adding explicit parentheses (e.g. ((self.original_size - 1) & (self.chunk_size - 1)) + 1) for clarity.

uncompressed_size = (((self.original_size - 1) & self.chunk_size - 1) + 1 if offset == self.chunks[-1] else self.chunk_size)

[avizack18]

Any updates?