AnalyzeMFT
AnalyzeMFT is a Python script designed to translate the NTFS Master File Table (MFT) into a human-readable and searchable format, such as CSV. This tool is useful for digital forensics, file system analysis, and understanding the structure of NTFS volumes.
Features
- Parse NTFS MFT files
- Generate CSV output of MFT records
- Create timeline in CSV format
- Produce bodyfile output for timeline analysis
- Support for local timezone reporting
- Anomaly detection (optional)
- Debugging output (optional)
Requirements
- Python 3.x
Installation
- Clone this repository or download the script files.
- Ensure you have Python 3.x installed on your system.
Basic usage:
python AnalyzeMFT.py -f <mft_file> -o <output_file>
Versioning
Current version: 3.0
Author
Benjamin Cance (bjc@tdx.li)
License
Copyright Benjamin Cance 2024
Contributing
If you'd like to contribute to this project, please submit a pull request or open an issue on the project's repository.
Disclaimer
This tool is provided as-is, without any warranties. Use at your own risk and ensure you have the necessary permissions before analyzing any file systems or MFT data.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file analyzemft-3.0.tar.gz.
File metadata
- Download URL: analyzemft-3.0.tar.gz
- Upload date:
- Size: 8.2 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/5.1.1 CPython/3.12.5
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
4825d75af7a60b787737a2ff474902731a995ec0a13e0fbf3e1406def724f653
|
|
| MD5 |
5f40f5f86ef545eb16f6d0d0619881b4
|
|
| BLAKE2b-256 |
4155988b027573b094d2aad871f6a00b0935f03d6e99c107e10798dec9ea14ee
|
File details
Details for the file analyzeMFT-3.0-py3-none-any.whl.
File metadata
- Download URL: analyzeMFT-3.0-py3-none-any.whl
- Upload date:
- Size: 10.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
twine/5.1.1 CPython/3.12.5
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
02328715ba7aec4a28bfeff6d3b466d1ab134fbb8cb7c0f33fb3ed19962e1db3
|
|
| MD5 |
cb947d5fd5f254ce9b0afcd7ff9310fb
|
|
| BLAKE2b-256 |
ae78450bab24fbf2edadee0f2431dbae2acdbc82c7b3495fea117bf2559e4a7f
|
