View Image

This tool is for parsing, decoding and logging information from the Master File Table ($MFT) to a csv. It is logging a large amount of data and that has been the main purpose from the very start. Having all this data in a csv is convenient for further analysis. It supports getting the $MFT from a variety of sources. The application NTFS File Extracter can export systemfiles (metafiles) off an NTFS volume. In fact, it can extract any file off the volume by traversing the $MFT and resolving all runs (if its record is intact and its sectors not overwritten). It will thus bypass filesystem security.

The mft2csv application will take an $MFT file as input and ripp information from all its records and log it to a csv file. A rather large amount of data is currently decoded. The point is to save all information to a csv (well supported format) for later analysis. The MFTRCRD application is a commandline file information dumper. It will dump all information that mft2csv can decode, and also have the option to dump the $MFT record of target file to the console. Additionally it displayes detailed runs information. SetMACE is a NTFS timestamp manipulating tool. It is nice to run alongside with MFTRCRD when testing stuff on NTFS.