dfir_ntfs¶

Category: Files and apps / Disk

Source: Python

Profiles: Full, Basic

File Extensions: .mft, .dd, .raw, .img

Tags: ntfs, filesystem, forensics, disk-forensics

An NTFS/FAT parser for digital forensics & incident response.