MFT_Browser

A DFVFS backed viewer project with a WxPython GUI, aiming to enhance file extraction and viewing capabilities.

This tool recreates the file and directory tree structure from an extracted $MFT file. It supports both 1024-byte and 4096-byte long records. The tool can carve FILE records and recreate a directory tree from a Raw Image (version 60 or higher). Additionally, it is capable of extracting the $MFT and recreating the directory tree from a mounted NTFS volume (note: the volume must have a drive letter) (version 60 or higher). **Latest Version:** [Dependencies] .NET Framework 4.8, Powershell Version: 5.1. To access full MFT details for any file or directory entry, use the 'Node Properties' right-click option or double-click on the entry. Clicking on any detail of the record will display the source of that detail in the Hex view grid. All timestamps are recorded in UTC. For standalone GUI calculations of Dataruns, use: => MFT_dataruns. **Note:** Recreating the directory tree from large MFT files may take a significant amount of time (potentially hours), as it requires mapping each child record to its parent node. As the structure increases in size, the time required grows exponentially. You can find additional resources such as $MFT Structures (pdf), Using MFTbrowser (pdf), How to view a single record from a large MFT file (pdf), Reparse point examples (pdf), and small test $MFT files to experiment with at the provided links.