Thewhiteninja Ntfstool Versions Save

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

v1.7

9 months ago

Full Changelog: https://github.com/thewhiteninja/ntfstool/commits/v1.7

v1.6

2 years ago

New features!

  • MFT to csv/json with Zone.Identifier (see mft.dump)
  • USN journal analysis using custom rules (see usn.analyze)
  • And some fixes!

Full Changelog: https://github.com/thewhiteninja/ntfstool/compare/v1.5...v1.6

v1.5

2 years ago

Many fixes from the last release!

Full Changelog: https://github.com/thewhiteninja/ntfstool/compare/v1.4...v1.5

v1.4

2 years ago

latest

2 years ago

Release updated from the latest commit.

v1.3

3 years ago
  • Add "image" command to dump a disk or volume to a file
  • Add "shadow" command to list volume shadow snapshots
  • Add "smart" command to show S.M.A.R.T data
  • Fix some typos, bugs in table class ... again

v1.2

3 years ago
  • Add support for $INDEXROOT with $R type
  • Display $R reparse points in mft command
  • Add a "reparse" command to list \$Extend\$Reparse
  • Fix some typos, bugs in table class, ...

v1.1

3 years ago

Many fixes and new features were added. Support for non-resident attribute lists, extract command, fix $INDEX, $DATA and $FILENAME parsing.

v1.0

4 years ago