mft

There are 3 repositories under mft topic.

• ntfstool

  thewhiteninja / ntfstool

  Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

  diskbitlockermftvbrgptntfsparserusnlogfileundeletefvevmkcompressedsparsereparsevsssmartmbrbtreeefs
  Language:C++ 543

• rowingdude / analyzeMFT

  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

  analysisforensicsmftntfspython
  Language:Python 506
• MFT_Browser

  kacos2000 / MFT_Browser

  $MFT directory tree reconstruction & FILE record info

  mft-browsermftpowershellwinformgui-applicationmft-filesdirectory-treeguisignedmetadata-informationcarverfilentfsrecordcarveextract
  Language:PowerShell 315

• EricZimmerman / MFTECmd

  Parses $MFT from NTFS file systems

  ntfsmftforensics
  Language:C# 274
• Judge-Jury-and-Executable

  AdamWhiteHat / Judge-Jury-and-Executable

  A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

  securitythreat-huntingantivirusscannerquery-languagecsharpforensics-level-scanningforensicsmftthreat-monitorforensic-analysisforensics-investigationsyarayara-scanneryara-rules
  Language:C# 82
• Petya2

  nbs32k / Petya2

  A full & Open Source compatible Petya Ransomware Executable Placeholder

  drugsgoldeneyemalwaremftpc-protectionpetyapetya-greenpetya-ransomwarepetya-redpetyaredransomware
  Language:C 81

• githubrobbi / Ultra-Fast-File-Search

  Ultra Fast File Search

  mftcppclifilesystemdirectoryllvmregexwizfileeverythingfastos-walk
  Language:C++ 80

• harelsegev / INDXRipper

  Carve file metadata from NTFS index ($I30) attributes

  dfirdigital-forensicsntfsincident-responseforensicsindxparsemft
  Language:Python 71

• t9t / gomft

  NTFS Master File Table (MFT) parser for Go.

  mftntfsgogolanggo-librarygolang-library
  Language:Go 44
• EverythingSZ

  yuanrui / EverythingSZ

  EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.

  everythingeverythingszusnmftntfscsharp
  Language:C# 42

• apache / airavata-mft

  Apache Airavata Managed File Transfer Services

  airavataapachemftfile-transfers
  Language:Java 37

• waarp / Waarp-All

  This version is a major version for all Waarp Modules, previously being split.

  mftwaarpr66waarp-ftpprotocolsfiletransfer
  Language:Java 29

• sumeshi / ntfsfind

  An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

  ntfsrawsleuthkitmfte01pythonforensicsvhdvhdxvmdkdfir
  Language:Python 27

• delphilite / EverythingSDK

  Everything Search Engine SDK for Delphi

  delphieverythingeverything-searchfile-searchmftntfspascalsdksearchusnvoidtoolsdelphinuspackage
  Language:Pascal 24

• JonnyBanana / -MFT-Duck-Crasher

  A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability

  rubberduckyscriptmftbugwindowscrashsystemdelayw7vulnerabilitytwinduck-firmarewindows-10system-crashwindows-bugswindows-vulnerability
  24
• MFT_Record_Viewer

  kacos2000 / MFT_Record_Viewer

  $MFT Record Viewer

  mftpowershellwindowswindows10x64viewerwindows-formswinforms-application
  Language:PowerShell 22

• rsa9000 / ntfsheurecovery

  NT File System (NTFS) recovery tool

  ntfsmftfilesystem-recoveryrecoveryfilesystem-analysis
  Language:C 22

• FirstBlood12 / RedPetyaOpenSSL

  A full rewrite of Red Petya ransomware from 2016 with full MBR and GPT support

  gptmbropensslpetyapetya-redransomwareecdhsecp192k1salsa10eccmftmalwarepetya-ransomwarepetyared
  Language:C 21

• farfella / ntfs-cpu-search

  From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.

  ntfsmftmft-parserstring-searchboyer-moore-horspoolwindows
  Language:C++ 19

• rxerium / CVE-2025-10035

  Detection for CVE-2025-10035

  goanywheremftnucleipoc
  19
• community

  logpresso / community

  Logpresso Mini and community contents for incident response

  dfirmftevtxregistry-hive-fileslog-analyzersqliteextensible-storage-engine
  18

• kero99 / mftmactime

  MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.

  forensics-toolsmftntfsntfs-adsntfs-journalpython
  Language:Python 13

• waarp / WaarpR66

  All Waarp modules have been regrouped in a new repository: https://github.com/waarp/Waarp-All. This repository is outdated and will not be maintained anymore.

  mfttransferfile-transfer
  Language:Java 13

• sumeshi / mft2es

  A library for fast parse & import of Windows Master File Table($MFT) into Elasticsearch.

  pythonelasticsearchmftwindowsparserdfirforensics
  Language:Python 11

• wang-bin / mdk-mft

  libmdk codec plugin based on microsoft media foundation transform

  mftmediafoundationav1
  Language:C++ 11

• dkesselman / isftpretry

  IBM i - SFTP file transfer with retries - Bash script

  ibmias400performance-analysisiseriessftpmft
  Language:Shell 10

• apache / airavata-data-lake

  Apache Airavata Data Lake

  airavataapachedatalakemft
  Language:Java 9
• MFT_dataruns

  kacos2000 / MFT_dataruns

  Dataruns calc

  datarunmftntfsparserpowershellrunlistwindows-forms
  Language:PowerShell 7

• gereoffy / drutils

  Data recovery utilities

  data-recoverydatarecoveryjpg-formatmftntfspdf-formatvalidation-tool
  Language:Python 6

• zeroq / ntfsreader

  parse MBR and Partition Table to extract MFT Entries

  pythonforensic-analysisntfsmft
  Language:Python 6

• NikolaMilosa / ntfs-undelete

  rust tool for retrieving deleted files

  file-recoverymftrustundelete
  Language:Rust 5

• hansalemaos / mft2df

  Lists the files on a drive insanely fast (43 seconds for 1,800,000 files - 600 GB) by converting the $MFT to a pandas DataFrame

  dataframefastfilegerenciadormanagermftntfspandaswindowsarquvios
  Language:Python 4

• LorenData / ECGrid-API

  Loren Data ECGrid API Version 4.1 Documentation.

  edi-networkb2b-saasedi-communicationsmailboxestrading-partner-managementedi-apiediedi-messagesnetwork-communicatione-commerceweb-serviceb2bcommunicationsupplychainas2mftmanaged-file-transferb2bib2bgateway
  Language:C# 4

• apache / airavata-mft-portal

  Portal for Apache Airavata Managed File Transfer Services

  airavataapachefile-ransfersmft
  Language:Python 3

• BGPavelAng / MFT

  MFT

  cmftwindows
  Language:C 3

• germanoeich / SearchSharp

  mftenumerationntfssearchjournalntfs-journalindexing
  Language:C# 3