Skip to content

$MFT directory tree reconstruction & FILE record info

License

Notifications You must be signed in to change notification settings

kacos2000/MFT_Browser

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

MFTbrowser Video

  • Recreates the File/Directory tree structure from an (extracted) $MFT file.
  • Supports both 1024 & 4096 byte long records
  • Able to carve FILE records & recreate a Directory tree from a Raw Image (v.60+)
  • Able to extract the $MFT & recreate the Directory tree from a mounted NTFS volume (Volume must have a drive letter) (v.60+)

-----------------

==> Latest Version <==

[Dependencies]


  • 'Node Properties' right click option or Double clicking on any file/directory entry gets the full MFT details for that record
  • Clicking on any detail of the record, shows the source of the detail in the Hex view grid.
  • All timestamps are in UTC

Standalone GUI Calc for Dataruns:
=> MFT_dataruns


Note:

Recreating the directory tree from large MFT files might take a lot of time, (possibly hour(s)), as it needs to map each child record to it's parent node, and as the structure grows, the time needed grows exponentially.