Need $STD_INFO timestamps in bodyfile format
gleeda opened this issue · comments
I would like to request that $STD_INFO timestamps are also added to output in bodyfile format.
Fixed.
rowingdude / analyzeMFT
analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.