drop mft csv · detect systematic loss of sub-second timestamp precision across file populations · identify files where 100ns ntfs precision was stripped · surface the boundary between natural and tool-written timestamps · runs locally
mft csv
drop mft csv
or click
healthy NTFS sub-second fields are uniformly distributed 0000001–9999999 · tool writes often collapse to 0000000
drop mft csv (mftecmd / mftrcsv)