Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

$MFT directory tree reconstruction & FILE record info

Parses $MFT from NTFS file systems

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

A full & Open Source compatible Petya Ransomware Executable Placeholder

Ultra Fast File Search

Carve file metadata from NTFS index ($I30) attributes

NTFS Master File Table (MFT) parser for Go.

PoC of a UEFI Petya ransomware

Apache Airavata Managed File Transfer Services

EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.

This version is a major version for all Waarp Modules, previously being split.

A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability

An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

$MFT Record Viewer

NT File System (NTFS) recovery tool

From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.

Everything Search Engine SDK for Delphi

A full rewrite of Red Petya ransomware from 2016 with full MBR and GPT support