MFT
This is a parser for the MFT (master file table) format.
MSRV is latest stable rust.
Python bindings are available as well at https://github.com/omerbenamram/pymft-rs (and at PyPi https://pypi.org/project/mft/)
Features
- Implemented using 100% safe rust - and works on all platforms supported by rust (that have stdlib).
- Supports JSON and CSV outputs.
- Supports extracting resident data streams.
Installation (associated binary utility):
- Download latest executable release from https://github.com/omerbenamram/mft/releases
- Releases are automatically built for for Windows, macOS, and Linux. (64-bit executables only)
- Build from sources using
cargo install mft
mft_dump
(Binary utility):
The main binary utility provided with this crate is mft_dump
, and it provides a quick way to convert mft snapshots to different output formats.
Some examples
mft_dump <input_file>
will dump contents of mft entries as JSON.mft_dump -o csv <input_file>
will dump contents of mft entries as CSV.mft_dump --extract-resident-streams <output_directory> -o json <input_file>
will extract all resident streams in MFT to files in <output_directory>.
Library usage:
use MftParser;
use MftAttributeContent;
use PathBuf;