drop directory entry export or mft csv with slack · extract artifacts from directory entry slack space · recover historical filenames and timestamps from directory index slack · surface evidence of deleted files from NTFS index slack · runs locally
indx / mft csv
drop $I30 / indx slack csv and optional mft csv
or click
INDX slack export with FileName + INDX_Created · optional MFT CSV for cross-reference and timestomp detection
drop $I30 / indx slack csv and optional mft csv (multi-file)