mftmactime
by kero99
MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.
AI summary
NTFS analyzer
Analyzes and processes NTFS file system data to extract timeline information and run YARA rules for malware detection.
- stars
- 12
- forks
- 2
- watching
- 2
- awesome list
- 1
Similar projects
Found by comparing what the projects do, not just their names.
NTFS analyzer
A forensic tool for analyzing NTFS volumes and decrypting encrypted files
File analyzer
Automated file analysis framework with modular design and distributed workflow
File system analyzer
A digital forensics tool for parsing and analyzing NTFS/FAT file systems.
NTFS parser
Tool to parse and extract information from NTFS Master File Table (MFT) files.
NTFS analyzer
A Python library for analyzing and working with NTFS file systems.
File analyzer
A YARA-based library to analyze files and archives for potential maliciousness
Memory analyzer
Automated tool for forensic analysis of Windows memory dumps
Network analyzer
Analyzes network traffic data from captured packets to extract and decode specific protocols and information.
Metadata extractor
A Python script to parse the NTFS USN journal and extract metadata changes for forensic analysis.
File analyzer
A set of Yara rules for forensic file analysis
Memory analyzer
A tool to detect and analyze malicious code in process memory by executing Python scripts on YARA matches
Memory analyzer
A memory analysis toolkit for macOS developed in Python
Malware analyzer
Analyzes files to detect malware and extract embedded content
Forensic analyzer
A digital forensics tool for analyzing macOS and iOS systems
Network analyzer
Provides code and data support for FSCNMF, a network representation technique.
Featured in 1 awesome list
Each link jumps to the spot where the list mentions mftmactime.
