drop mft csv · detect files with unusual numbers of hard links · identify hard link creation patterns used to complicate forensic analysis · surface files accessible from multiple paths to hide their true location · runs locally
mft csv
drop mft csv (multi-file)
or click
LinkCount / ReferenceCount · multi-path FN records · sensitive SAM/NTDS/evtx links · AppLocker / DLL hijack paths
drop mft csv — multiple files ok