Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/kacos2000/MFT_Browser
$MFT directory tree reconstruction & FILE record info
https://github.com/kacos2000/MFT_Browser
carve carver directory-tree extract file gui gui-application metadata-information mft mft-browser mft-files ntfs powershell record signed winform
Last synced: about 1 month ago
JSON representation
$MFT directory tree reconstruction & FILE record info
- Host: GitHub
- URL: https://github.com/kacos2000/MFT_Browser
- Owner: kacos2000
- License: mit
- Created: 2020-12-26T02:28:52.000Z (almost 4 years ago)
- Default Branch: master
- Last Pushed: 2024-10-07T14:06:10.000Z (2 months ago)
- Last Synced: 2024-11-06T06:16:10.934Z (about 1 month ago)
- Topics: carve, carver, directory-tree, extract, file, gui, gui-application, metadata-information, mft, mft-browser, mft-files, ntfs, powershell, record, signed, winform
- Language: PowerShell
- Homepage: https://kacos2000.github.io/MFT_Browser/
- Size: 28.9 MB
- Stars: 292
- Watchers: 13
- Forks: 32
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
- awesome-starz - kacos2000/MFT_Browser - $MFT directory tree reconstruction & FILE record info (PowerShell)
README
# [MFT_Browser](https://github.com/kacos2000/MFT_Browser/releases/latest)
[](https://vimeo.com/890690247 "$MFT Browser - Click to Watch!")
- Recreates the File/Directory tree structure from an *(extracted)* $MFT file.
- Supports both 1024 & 4096 byte long records
- Able to carve FILE records & recreate a Directory tree from a Raw Image (v.60+)
- Able to extract the $MFT & recreate the Directory tree from a mounted NTFS volume (Volume must have a drive letter) (v.60+)
-----------------
==> **[Latest Version](https://github.com/kacos2000/MFT_Browser/releases/latest)** <==
[Dependencies]
- [.NET Framework 4.8](https://dotnet.microsoft.com/en-us/download/dotnet-framework/net48)
- [Powershell Version: 5.1](https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/install/windows-powershell-system-requirements?view=powershell-5.1)
-----------------
- 'Node Properties' right click option or Double clicking on any file/directory entry gets the full MFT details for that record
- Clicking on any detail of the record, shows the source of the detail in the Hex view grid.
- All timestamps are in UTC
-----------------
Standalone GUI Calc for Dataruns:
=> [MFT_dataruns](https://github.com/kacos2000/MFT_dataruns)
-----------------
### Note:
Recreating the directory tree from large MFT files might take a lot of time, *(possibly hour(s))*, as it needs to map each child record to it's parent node, and as the structure grows, the time needed grows exponentially.
- [$MFT Structures *(pdf)*](https://github.com/kacos2000/MFT_Browser/blob/master/MFT%20Structures.pdf)
- [Using MFTbrowser *(pdf)*](https://github.com/kacos2000/MFT_Browser/blob/master/Using%20MFTBrowser.pdf)
- [How to view a single record from a large MFT file *(pdf)*](https://github.com/kacos2000/MFT_Browser/blob/master/How%20to%20view%20a%20single%20record%20from%20a%20large%20MFT%20file.pdf)
- [Reparse point examples *(pdf)*](https://github.com/kacos2000/MFT_Browser/raw/master/reparse%20point%20examples.pdf)
- Small test $MFT files to play with, can be found [here](https://github.com/EricZimmerman/MFT/tree/3bed2626ee85e9a96a6db70a17407d0c3696056a/MFT.Test/TestFiles) and [here](https://github.com/msuhanov/dfir_ntfs/tree/master/test_data)