Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

Forensic Software: mft2csv - NTFS systemfile extracter and $MFT decoder

$
0
0
Quote:: The tool (correctly) asks for a $MFT, I was perfectly aware that feeding it "something else" I would have probably got an error (though I prefer "aggressive" interfaces, like "You dumb@§§, I want a §@ç#ing $MFT, the file you gave me is not a $MFT!" a "Cannot decode file" would have been preferrable to the "Variable not declared" error). The reason is because we can have invalid records, and I wanted it to continue regardless of those. But, still it's kind of flawed, as it assumes there is exactly 1024 bytes between each record. Alternatively you could have evaluated byte for byte forward whenever an invalid record hits you (which would fix that). New version has option to specify separator and optional surrounding quotes, plus bugfixes. Also added this code to satisfy most people: Code:: If @Username = "jaclaz" And $input <> $ValidMFT Then MsgBox(0,"Hey!", You dumb ass fool! what on earth are you trying? Read documentation next time. Bye. Exit EndIf (that was a joke)

Viewing all articles
Browse latest Browse all 20107

Trending Articles