MFTECmd

Usage

MFTECmd version 0.4.4.6
 
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
 
        f               File to process ($MFT | $J | $LogFile | $Boot | $SDS). Required
 
        json            Directory to save JSON formatted results to. This or --csv required unless --de or --body is specified
        jsonf           File name to save JSON formatted results to. When present, overrides default name
        csv             Directory to save CSV formatted results to. This or --json required unless --de or --body is specified
        csvf            File name to save CSV formatted results to. When present, overrides default name
 
        body            Directory to save bodyfile formatted results to. --bdl is also required when using this option
        bodyf           File name to save body formatted results to. When present, overrides default name
        bdl             Drive letter (C, D, etc.) to use with bodyfile. Only the drive letter itself should be provided
        blf             When true, use LF vs CRLF for newlines. Default is FALSE
 
        dd              Directory to save exported FILE record. --do is also required when using this option
        do              Offset of the FILE record to dump as decimal or hex. Ex: 5120 or 0x1400 Use --de or --vl 1 to see offsets
 
        de              Dump full details for entry/sequence #. Format is 'Entry' or 'Entry-Seq' as decimal or hex. Example: 5, 624-5 or 0x270-0x5.
        fls             When true, displays contents of directory specified by --de. Ignored when --de points to a file.
        ds              Dump full details for Security Id as decimal or hex. Example: 624 or 0x270
 
        dt              The custom date/time format to use when displaying time stamps. Default is: yyyy-MM-dd HH:mm:ss.fffffff
        sn              Include DOS file name types. Default is FALSE
        at              When true, include all timestamps from 0x30 attribute vs only when they differ from 0x10. Default is FALSE
 
        vss             Process all Volume Shadow Copies that exist on drive specified by -f . Default is FALSE
        dedupe          Deduplicate -f & VSCs based on SHA-1. First file found wins. Default is FALSE
 
        debug           Show debug information during processing
        trace           Show trace information during processing
 
 
Examples: MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out" --csvf MyOutputFile.csv
          MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out"
          MFTECmd.exe -f "C:\Temp\SomeMFT" --json "c:\temp\jsonout"
          MFTECmd.exe -f "C:\Temp\SomeMFT" --body "c:\temp\bout" --bdl c
          MFTECmd.exe -f "C:\Temp\SomeMFT" --de 5-5
 
          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

Examples

mftecmd -f $j –csv <folder>

The following command will parse a UsnJournal and save the results in a CSV file:

G:\>mftecmd -f "C:\Users\SANSDFIR\Desktop\netwars\$J" --csv "C:\Users\SANSDFIR\Desktop\netwars"
MFTECmd version 0.4.4.6
 
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
 
Command line: -f C:\Users\SANSDFIR\Desktop\netwars\$J --csv C:\Users\SANSDFIR\Desktop\netwars
 
File type: UsnJournal
 
 
Processed 'C:\Users\SANSDFIR\Desktop\netwars\$J' in 1.4809 seconds
 
Usn entries found in 'C:\Users\SANSDFIR\Desktop\netwars\$J': 458,051
        CSV output will be saved to 'C:\Users\SANSDFIR\Desktop\netwars\20210803162237_MFTECmd_$J_Output.csv'

The following is a sample from the output file:

Blog Posts