{"id":13597741,"url":"https://github.com/EricZimmerman/MFTECmd","last_synced_at":"2025-04-10T05:33:14.987Z","repository":{"id":38067912,"uuid":"136507167","full_name":"EricZimmerman/MFTECmd","owner":"EricZimmerman","description":"Parses $MFT from NTFS file systems","archived":false,"fork":false,"pushed_at":"2025-03-05T14:04:46.000Z","size":5287,"stargazers_count":226,"open_issues_count":2,"forks_count":46,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-03-05T15:22:41.064Z","etag":null,"topics":["forensics","mft","ntfs"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EricZimmerman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-06-07T16:58:42.000Z","updated_at":"2025-03-05T14:04:51.000Z","dependencies_parsed_at":"2024-03-07T16:47:43.561Z","dependency_job_id":"ad7cd27e-b359-444a-9a48-8c806f35678e","html_url":"https://github.com/EricZimmerman/MFTECmd","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FMFTECmd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FMFTECmd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FMFTECmd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FMFTECmd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EricZimmerman","download_url":"https://codeload.github.com/EricZimmerman/MFTECmd/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248163360,"owners_count":21057918,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["forensics","mft","ntfs"],"created_at":"2024-08-01T17:00:40.100Z","updated_at":"2025-04-10T05:33:14.942Z","avatar_url":"https://github.com/EricZimmerman.png","language":"C#","funding_links":[],"categories":["Tool-Related GitHub Repos","C\\#"],"sub_categories":["EZ Tools"],"readme":"# MFTECmd\n\n## Command Line Interface\n\n    MFTECmd version 0.5.0.1\n    \n    Author: Eric Zimmerman (saericzimmerman@gmail.com)\n    https://github.com/EricZimmerman/MFTECmd\n    \n            f               File to process ($MFT | $J | $LogFile | $Boot | $SDS). Required\n    \n            json            Directory to save JSON formatted results to. This or --csv required unless --de or --body is specified\n            jsonf           File name to save JSON formatted results to. When present, overrides default name\n            csv             Directory to save CSV formatted results to. This or --json required unless --de or --body is specified\n            csvf            File name to save CSV formatted results to. When present, overrides default name\n    \n            body            Directory to save bodyfile formatted results to. --bdl is also required when using this option\n            bodyf           File name to save body formatted results to. When present, overrides default name\n            bdl             Drive letter (C, D, etc.) to use with bodyfile. Only the drive letter itself should be provided\n            blf             When true, use LF vs CRLF for newlines. Default is FALSE\n    \n            dd              Directory to save exported FILE record. --do is also required when using this option\n            do              Offset of the FILE record to dump as decimal or hex. Ex: 5120 or 0x1400 Use --de or --vl 1 to see offsets\n    \n            de              Dump full details for entry/sequence #. Format is 'Entry' or 'Entry-Seq' as decimal or hex. Example: 5, 624-5 or 0x270-0x5.\n            fls             When true, displays contents of directory specified by --de. Ignored when --de points to a file.\n            ds              Dump full details for Security Id as decimal or hex. Example: 624 or 0x270\n    \n            dt              The custom date/time format to use when displaying time stamps. Default is: yyyy-MM-dd HH:mm:ss.fffffff\n            sn              Include DOS file name types. Default is FALSE\n            fl              Generate condensed file listing. Requires --csv. Default is FALSE\n            at              When true, include all timestamps from 0x30 attribute vs only when they differ from 0x10. Default is FALSE\n    \n            vss             Process all Volume Shadow Copies that exist on drive specified by -f . Default is FALSE\n            dedupe          Deduplicate -f \u0026 VSCs based on SHA-1. First file found wins. Default is FALSE\n    \n            debug           Show debug information during processing\n            trace           Show trace information during processing\n\n\n    Examples: MFTECmd.exe -f \"C:\\Temp\\SomeMFT\" --csv \"c:\\temp\\out\" --csvf MyOutputFile.csv\n              MFTECmd.exe -f \"C:\\Temp\\SomeMFT\" --csv \"c:\\temp\\out\"\n              MFTECmd.exe -f \"C:\\Temp\\SomeMFT\" --json \"c:\\temp\\jsonout\"\n              MFTECmd.exe -f \"C:\\Temp\\SomeMFT\" --body \"c:\\temp\\bout\" --bdl c\n              MFTECmd.exe -f \"C:\\Temp\\SomeMFT\" --de 5-5\n\n              Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes\n\n## Documentation\n\nMFT parser for NTFS file systems.\n\n[Introducing MFTECmd!](https://binaryforay.blogspot.com/2018/06/introducing-mftecmd.html)\n\n[MFTECmd v0.2.6.0 released](https://binaryforay.blogspot.com/2018/06/mftecmd-v0260-released.html)\n\n[MFTECmd 0.3.6.0 released](https://binaryforay.blogspot.com/2018/12/mftecmd-0360-released.html)\n\n[Locked file support added to AmcacheParser, AppCompatCacheParser, MFTECmd, ShellBags Explorer (and SBECmd), and Registry Explorer (and RECmd)](https://binaryforay.blogspot.com/2019/01/locked-file-support-added-to.html)\n\n# Download Eric Zimmerman's Tools\n\nAll of Eric Zimmerman's tools can be downloaded [here](https://ericzimmerman.github.io/#!index.md). \n\n# Special Thanks\n\nOpen Source Development funding and support provided by the following contributors: \n- [SANS Institute](http://sans.org/) and [SANS DFIR](http://dfir.sans.org/).\n- [Tines](https://www.tines.com/?utm_source=oss\u0026utm_medium=sponsorship\u0026utm_campaign=ericzimmerman)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2FMFTECmd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FEricZimmerman%2FMFTECmd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2FMFTECmd/lists"}