README

The following command line options are valid:

--drive=<string> selected drive/partition to dump mft for - if offline, only used to build paths (default: c:)

--filter=<string> optional, pattern to filter files

--mft_filename=<string> optional, will use an offline mft dump

--first_record=<int> optional, first mft record to start enumerating (default: 16)

--last_record=<int> optional, last mft record to stop enumerating

--record=<int> optional, specific record (default: -1)

--db3 optional, will dump records to mft.db3 sqlite DB

--encoding=<string> optional, will set the sqlite encoding (default=utf-8)

--csv optional, will dump records to mft.csv

--separator=<string> optional, will replace | by another separator in the csv file

--dr optional, will display dataruns i.e clusters used by a file - needs filter flag

--dr_backup optional, will dump dataruns i.e clusters used by a file - needs dr flag

--dt optional, will display deleted files only

--mft_backup optional, will backup the mft to mft.dmp - not supported in offline mode or if mft is

fragmented

Here below some powershell examples to play with the sqlite DB:

-select.ps1 is a powershell example to query the mft.db3.

-select-BIG25.ps1 will output top 25 biggest files.

-select-OLD25.ps1 will output top 25 oldest files.

-select-SIZEBEFORE2020.ps1 will output the sum of filesizes changed prior to 2020.

-select-SIZEPERYEAR.ps1 will output the sum of filesizes per year.

-select-COMPRESSED.ps1 will display files with flag=compressed.

-select-CSV.ps1 will create a CSV file listing all files prior to 2020 out of the DB3.

-select-delete-file.ps1 will deleted all files prior to 1996 out of the DB3.

you can download system.data.sqlite for powershell (recommended : sqlite-netFx46-binary-bundle-x64-2015-1.0.119.0) here : https://www.sqlite.org/download.html

Some notes/thoughts:

If the MFT is fragmented, you will need to backup it with extents-win64 like this:

extents-win64.exe f:\$mft c:\temp\mft.dmp

Although I recommend the use of extents-win64.exe, you can also backup a fragmented mft the followong way ( a file named _$mft will be created on your folder) :

mft-win32.exe --drive=f: --filter=$mft --first_record=0 --last_record=15 --dr --dr_backup

or

mft-win32.exe --drive=f: --record=0 --dr --dr_backup (since $mft is always at record=0)

Then dump the mft like this (skip --db3 if you want to dump to the console) : mft-win32.exe --drive=f: --mft_filename=c:\temp\mft.dmp --db3

If the MFT is not fragmented, then this is as simple as run the following command : mft-win32.exe --drive=f:

Both MBR and GPT partitions are supported.

About dataruns, you can restore a file (deleted or not) with the following command : mft-win32.exe --drive=f: --record=26375 --dr --dr_backup

Some notes about the retrieved filerecords fields:

FileCreationTime is the time that the file was created on a disk partition.

It will be updated if you move a file to a different partition/disk on your computer, but because the content hasn't changed, the LastWriteTime won't be.

So you can end up in a situation where your FileCreationTime is later than your FileChangeTime.

FileChangeTime is the time that the file content was updated. Actually the only field you can really trust.

LastWriteTime is the same as FileChangeTime except that it will also be updated when metadata is changed (r/w, acl, etc).

This date and time refers to when the MFT record itself was last changed. This date and time field is not displayed to a user.

LastAccessTime cannot be trusted as it can be disabled and not all windows OS's have the same settings here.

Simply cannot be trusted...

Beware, datetime is stored as text in db3 using your regional settings : do not use date/time functions against that stored data but use string functions. Alternative in a future version would be to store dates in ISO8601 format YYYY-MM-DD HH:MM:SS.SSS.

Default encoding is UTF-8 however you can use --encoding=UTF-16 if you are struggling with ascii characters > 127 (which will be stored as blob in UTF-8 mode and possibly troublesome on a UTF-16 console).

FileAttributes is also stored - below the possible values

Value Description

0x0001 Read only

0x0002 Hidden

0x0004 System

0x0020 Archive

0x0040 Device

0x0080 Normal

0x0100 Temporary

0x0200 Sparse file

0x0400 Reparse point

0x0800 Compressed

0x1000 Offline

0x2000 Content not indexed

0x4000 Encrypted

Flags is also stored - below the possible values (1 is a file, 3 is a directory...)

Flag Description

0x00 Record is not in use (i.e deleted)

0x01 Record is in use

0x02 Record is a directory (FileName index present)

0x04 Record is an exension (Set for records in the $Extend directory)

0x08 Special index present (Set for non-directory records containing an index: $Secure, $ObjID, $Quota, $Reparse)