SQLite Forensics Book, now available on Amazon

More information here

 

  • MFTView (version 1.1.0)

    This software is designed to show and decode the contents of an extracted MFT file.

    It has an inbuilt hex editor (based on RevEnge and the same as that seen in LinkAlyzer and PmExplorer) when you select a file entry from the file list the MFT is displayed raw in the hex view and the decoded fields are displayed in the vertical list to the right of the screen. When a value in the vertical list is selected (say the created date) the relevant bytes in the raw data are highlighted. The data interpreters window to the right of the hex data can be used via the (right click) context menu to display the data at the current offset in the hex view in one of a large number of formats.

    To download please log in to the forum (or create a user account and log in)