drop mft csv · compare si created vs fn created vs indx · detect birth time inconsistencies · reconstruct creation timeline · runs locally
mft / indx csv
drop mft + optional indx csv
or click
mftrcsv / mftecmd · optional indx directory export
drop mft csv · optional indx export