This release has been yanked by its maintainers, and will be ignored by installers, except when explicitly specified.
Consider using release 3.1.1 instead.
Reason given by maintainers: AsyncIO error
AnalyzeMFT
AnalyzeMFT is a Python script designed to translate the NTFS Master File Table (MFT) into a human-readable and searchable format, such as CSV. This tool is useful for digital forensics, file system analysis, and understanding the structure of NTFS volumes.
AnalyzeMFT Derivatives
Rather than clutter up the main project with features people may not want, I will be releasing two sister projects this week:
-
AnalyzeMFT-SQLite which adds SQL tables as an export option. I found that when working with very large MFT files, it's often easier to get them into a database such as SQLite or PostgreSQL and perform queries/searches using those tools. This also lets us cut down on the total size of the eventual export with large MFT files because we can reuse values and attributes.
-
CanalyzeMFT - This is a C/C++ port of the project. The goal is to increase the performance on *nix systems (or Windows if you want to build it there). I'm aiming to leave out system dependent libraries (cough Windows.h) so it's easily built everywhere.
Features
- Parse NTFS MFT files
- Generate CSV output of MFT records
- Create timeline in CSV format
- Produce bodyfile output for timeline analysis
- Support for local timezone reporting
- Many output formats - CSV, Body Files, JSON
- Anomaly detection (optional)
- Debugging output (optional)
Requirements
- Python 3.x
Installation
- Clone this repository or download the script files.
- Ensure you have Python 3.x installed on your system.
Basic usage:
Usage: analyzeMFT.py -f <mft_file> -o <output_file> [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
-f FILE, --file=FILE MFT file to analyze
-o FILE, --output=FILE
Output file
-H, --hash Compute hashes (MD5, SHA256, SHA512, CRC32)
Export Options:
--csv Export as CSV (default)
--json Export as JSON
--xml Export as XML
--excel Export as Excel
--body Export as body file (for mactime)
--timeline Export as TSK timeline
--l2t Export as log2timeline CSV
Verbosity Options:
-v Increase output verbosity (can be used multiple times)
-d Increase debug output (can be used multiple times)
Error: No input file specified. Use -f or --file to specify an MFT file.
Versioning
Current version: 3.0.6
Author
Benjamin Cance (bjc@tdx.li)
License
Copyright Benjamin Cance 2024
Contributing
If you'd like to contribute to this project, please submit a pull request or open an issue on the project's repository.
Disclaimer
This tool is provided as-is, without any warranties. Use at your own risk and ensure you have the necessary permissions before analyzing any file systems or MFT data.
1 maintainer
Metadata
1 maintainer
Release files for analyzeMFT 3.0.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| analyzemft-3.0.6.tar.gz | 23.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| analyzeMFT-3.0.6-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 40.4 kB
Release files / analyzemft-3.0.6.tar.gz
| Download URL | analyzemft-3.0.6.tar.gz |
|---|---|
| Size | 23.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2a60da5d899dcedb9c115332cdc0cd374fbf9cfe0b7e16524a49f00f09ec1f99
|
|
BLAKE2b-256 checksum How to use checksums |
1b19c6e9089ee8747c908b3ef0a480ea5652d16dde8ee3d5c538317c8a681b51
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.12.5
|
Release files / analyzeMFT-3.0.6-py3-none-any.whl
| Download URL | analyzeMFT-3.0.6-py3-none-any.whl |
|---|---|
| Size | 16.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c646ca0112bb263959a730e4248d59a2bac6f1f365dba0f93042e372d1ccf7dd
|
|
BLAKE2b-256 checksum How to use checksums |
3fbf78b49d586a2a21a276368c8eb5fb06498d005b46fd94e8e87a4562c1b6d8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.1 CPython/3.12.5
|
