drop mft csv or file listing · map all ntfs reparse points · symlinks · junctions · mount points · detect symlink attacks · data redirection · path traversal setups · runs locally
reparse artifacts
drop mft csv / dir /al
or click
MFTECmd MFT export · dir /al reparse listing
drop mft csv or dir /al symlink listing