analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

Parses $MFT from NTFS file systems

Apache Airavata Managed File Transfer Services

$MFT directory tree reconstruction & FILE record info

A full & Open Source compatible Petya Ransomware Executable Placeholder

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

All Waarp modules have been regrouped in a new repository: https://github.com/waarp/Waarp-All. This repository is outdated and will not be maintained anymore.

NT File System (NTFS) recovery tool

This version is a major version for all Waarp Modules, previously being split.

NTFS Master File Table (MFT) parser for Go.

A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability

PoC of a UEFI Petya ransomware

EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.

Apache Airavata Data Lake

Portal for Apache Airavata Managed File Transfer Services

Ultra Fast File Search

$MFT Record Viewer

A library for fast parse & import of Windows Master File Table($MFT) into Elasticsearch.

Carve file metadata from NTFS index ($I30) attributes