Parse Master File Table (MFT) records using Python
This code was written for the 2011 DC3 challenge. It was originally written using Python2.7. That code is still available in the mft.2.7 directory.
It has since been updated to Python3 in the mft directory.
This code is no longer under active development
About the Master File Table: https://en.wikipedia.org/wiki/NTFS#Master_File_Table The book referenced in the code, Brian Carrier's File System Forensic Analysis: http://www.digital-evidence.org/fsfa/
Copyright 2011 Aaron Hampton
Licensed under the GPLv3: http://www.gnu.org/licenses/gpl-3.0.html