dfir_ntfs: an NTFS/FAT parser for digital forensics & incident response
(Python 3 only.)

1. Project goals

- Parse $MFT, $UsnJrnl:$J, $LogFile files, extract as much data as possible.
- Parse volumes, volume images, and volume shadow copies.
- Parse FAT12/16/32, exFAT volumes.

2. Installation

# pip3 install https://github.com/msuhanov/dfir_ntfs/archive/1.1.18.tar.gz

3. Timestamps

All timestamps reported by the tools are in UTC.
(For FAT file systems, all timestamps are local or UTC, returned as is.)

The MACE notation is used:
- modified (M),
- last accessed (A),
- created (C),
- $MFT entry modified (E).

In the WSL set of timestamps (and FAT):
- inode changed (CH).

4. License

This project is made available under the terms of the GNU GPL, version 3.
See the 'License' file.

The first exception is the "nist-hacking-case.mft" file.
This file is from the NIST Hacking Case, which is distributed by NIST. See
the 'Use of NIST Information' section here: <https://www.nist.gov/disclaimer>.

The second exception is boot code embedded in some test data.
This code is not covered by the GNU GPL, version 3.

(All exceptions are in the "test_data" directory, which is not installed.)

---
(c) Maxim Suhanov