drop mft csv · usn journal csv · logfile operation export · indx csv · correlate all four timestamp sources for every file · produce consensus born-time with confidence score · expose disagreements that prove tampering · runs locally
artifact csvs
drop mft / usn / logfile / indx csv
multiple files · MFTECmd exports
drop mft · usn · logfile · indx csv exports