drop mft binary or slack extraction csv · detect artifacts hidden in mft record slack · identify residual data from previous file occupants · surface hidden data and historical file metadata in unused mft space · runs locally
mft slack csv / binary
drop mft slack csv or raw mft binary (multi-file)
or click
mftecmd / autopsy slack exports with SlackContent + EntryNumber · or raw $MFT (1024-byte records)
drop mft slack csv or raw mft binary (multi-file)