NTFS-Linker is a tool developed by Stroz Friedberg for parsing NTFS journal files, $Logfile, and $MFT from a directory of input or a disk image, automatically extracting relevant NTFS files and organizing them into a structured output directory.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
A digital forensics tool that provides read-only access to file-system objects from various storage media types and file formats.
A library to access FileVault Drive Encryption (FVDE) encrypted volumes on Mac OS X systems.
A comprehensive incident response tool for Windows computers, providing advanced memory forensics and access to locked systems.
A library for read-only access to QEMU Copy-On-Write (QCOW) image files, supporting multiple versions and compression formats for digital forensics analysis.
A library for accessing and parsing Microsoft Internet Explorer cache files (index.dat) to extract URLs, timestamps, and cached content for digital forensic analysis.
A digital artifact extraction framework for extracting data from volatile memory (RAM) samples, providing visibility into the runtime state of a system.
A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.
A library and set of tools for accessing and analyzing storage media devices and partitions for forensic analysis and investigation.