MFTECmd Versions Save

get the latest from

https://ericzimmerman.github.io/#!index.md

binaries will not be posted here any more.

ReparsePoint fix

fix displaying of Reparse point data

• Timestomp checks only the Created timestamps
• dropped last access from usec0 check
• new option to always include all timestamps (false by default) via --at

https://binaryforay.blogspot.com/2018/06/mftecmd-v0260-released.html

body file output (NOTE: INDEX_ROOT entries are not included (yet? maybe never))
Remove msg about -d switch in -f switch
Added --dd and --do switches
Added auto decoding of resident data to ASCII (1252) and Unicode when using --de
Cleaned up output of --de so its easier to read
Added --cs option to allow for tab delimited results

https://binaryforay.blogspot.com/2018/06/introducing-mftecmd.html