MFTExtractor
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
MFTExtractor
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
MFTExtractor Description
A Parser of Master File Table NTFS file system. Using this tool you can explore $MFT NTFS and its file system attributes. You can selectively extract filesystem information of record or for a range of records. In addition, you can export the contents of files. Exporting files can be achieved either by mounting the evidence and providing its physical drive order and partition number or by using the acquired forensic image (Expert Witness Format), or virtual machine disk format. Examples you can now explore NTFS by providing physical drive number and partition number e.g. -physicaldrive 0 -partition 1 translates to \.\
MFTExtractor FAQ
Common questions about MFTExtractor including features, pricing, alternatives, and user reviews.
MFTExtractor is A tool for parsing and extracting information from the Master File Table of NTFS file systems.. It is a Security Operations solution designed to help security teams with NTFS.
ALTERNATIVES
Decrypts EFS-protected files on NTFS volumes across Windows versions.
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.
A suite of console tools for working with timestamps in Windows with 100-nanosecond precision.
POPULAR
TRENDING CATEGORIES
Stay Updated with Mandos Brief
Get strategic cybersecurity insights in your inbox