jschicht / mft2csv Goto Github PK

Is it possible to use MFT2cv via command line?

while running the mft2csv (64 and 32 bit versiosn) on a live partition i encounterd the following autoit error:
"Array variable has incorrect number of subscripts or subscript dimension range exceeded"
any suggestions ?@jschicht

I've downloaded Mft2Csv to two Win10 machines. I can open the executable but when I click on Start Processing the GUI goes away, a folder is created, but no MFT is parsed. I've tried parsing my MFT on the C drive as well as E01 images.

How to download and install Mft2Csv (OS: Windows 7, 64 bit)?

Hello,

Windows Defender and Mcafee VirusScan don't even let me try to run mft2csv.exe, as soon as I download it, they simply delete the file. Are you aware of this problem ?

Thank you very much,

Al

I get that forensics loves to gather as much data as possible, but for other use cases one may be happy with something far more limited.
And 2MB of a csv rather than 2GB would be pretty neat.

For example, Mft-LOGGED_UTILITY_STREAM_2022-07-25_00-43-58.csv:

MftRef|MftRefSeqNo|StreamName|StreamSize
5;5;$TXF_DATA;56
31;31;$TXF_DATA;56

I specified ; as delimiter, and it was used in the data rows. But not in the header.

From https://github.com/jschicht/Mft2Csv/blob/master/LICENSE.md I'm not 100% sure which license this is. It looks CC-BY-SA-3.0. Please clarify. Also consider adding a text version of the LICENSE file instead, preferably one which github can recognize

It would be useful if you could launch this without the gui

The exe files seem to be generated by https://www.autoitscript.com/autoit3/docs/intro/compiler.htm which are covered by
https://www.autoitscript.com/autoit3/docs/license.htm not by https://github.com/jschicht/Mft2Csv/blob/master/LICENSE.md