jschicht / mft2csv Goto Github PK

The exe files seem to be generated by https://www.autoitscript.com/autoit3/docs/intro/compiler.htm which are covered by
https://www.autoitscript.com/autoit3/docs/license.htm not by https://github.com/jschicht/Mft2Csv/blob/master/LICENSE.md

For example, Mft-LOGGED_UTILITY_STREAM_2022-07-25_00-43-58.csv:

MftRef|MftRefSeqNo|StreamName|StreamSize
5;5;$TXF_DATA;56
31;31;$TXF_DATA;56

I specified ; as delimiter, and it was used in the data rows. But not in the header.

Hello,

Windows Defender and Mcafee VirusScan don't even let me try to run mft2csv.exe, as soon as I download it, they simply delete the file. Are you aware of this problem ?

Thank you very much,

Al

Hi

I tried to use Mft2Csv in admin cmd but I alwayes get access denied

From https://github.com/jschicht/Mft2Csv/blob/master/LICENSE.md I'm not 100% sure which license this is. It looks CC-BY-SA-3.0. Please clarify. Also consider adding a text version of the LICENSE file instead, preferably one which github can recognize

How to download and install Mft2Csv (OS: Windows 7, 64 bit)?

It would be useful if you could launch this without the gui

Is it possible to use MFT2cv via command line?

I've downloaded Mft2Csv to two Win10 machines. I can open the executable but when I click on Start Processing the GUI goes away, a folder is created, but no MFT is parsed. I've tried parsing my MFT on the C drive as well as E01 images.

while running the mft2csv (64 and 32 bit versiosn) on a live partition i encounterd the following autoit error:
"Array variable has incorrect number of subscripts or subscript dimension range exceeded"
any suggestions ?@jschicht

I get that forensics loves to gather as much data as possible, but for other use cases one may be happy with something far more limited.
And 2MB of a csv rather than 2GB would be pretty neat.