drop mft csv with cluster run data · detect files with unusual fragmentation patterns · identify deliberate fragmentation used to slow forensic analysis · surface files spread across abnormally many clusters · runs locally
mft csv
drop mft csv (multi-file)
or click
MFTECmd / mftrcsv · DataRun / RunCount columns · flags small-file heavy frag · executable anomalies · temporal bursts
drop mft csv with cluster run / data run columns — multiple files ok