Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

$MFT directory tree reconstruction & FILE record info

Parses $MFT from NTFS file systems

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

A full & Open Source compatible Petya Ransomware Executable Placeholder

Ultra Fast File Search

Carve file metadata from NTFS index ($I30) attributes

NTFS Master File Table (MFT) parser for Go.

EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.

Apache Airavata Managed File Transfer Services

This version is a major version for all Waarp Modules, previously being split.

An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

Everything Search Engine SDK for Delphi

A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability

NT File System (NTFS) recovery tool

$MFT Record Viewer

A full rewrite of Red Petya ransomware from 2016 with full MBR and GPT support

Detection for CVE-2025-10035

From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.