drop mft csv or ntfs metadata export · detect anomalies in core ntfs metadata files · identify tampered boot sector volume header or mft mirror · surface filesystem-level anti-forensic modifications · runs locally
mft / metadata / boot sector
drop MFT csv · NTFS metadata export · boot sector hex (multi-file)
or click
MFTECmd MFT csv with system entries 0–11 · volume dirty / mirror flags in metadata · VBR hex dump or $Boot copy
drop MFT csv (entries 0–11) · NTFS metadata export · or boot sector hex dump (multi-file)