mft2bodyfile 0.6.4

parses an $MFT file to bodyfile (stdout)
Documentation
FILE0�:8�`H^�8&��^�8&��^�8&��^�8&��0hJ^�8&��^�8&��^�8&��^�8&��@@$MFT�H@_@���1`�N�H@@1�N������1@�N�H@@1�N����FILE0�8X`H^�8&��^�8&��^�8&��^�8&��0pR^�8&��^�8&��^�8&��^�8&��$MFTMirr�H@@1�����    �H@@1�����FILE0�8X`H^�8&��^�8&��^�8&��^�8&��0pR^�8&��^�8&��^�8&��^�8&��  $LogFile�H@�@   2�>����    �H@�@   2�>����FILE0;8�H0^�8&��^�8&��^�8&��^�8&��0hP^�8&��^�8&��^�8&��^�8&��$VolumeP�h�HX4��      `(Controlp(�����FILE0)8�
H0^�8&��^�8&��^�8&��^�8&��0pR^�8&��^�8&��^�8&��^�8&�����$AttrDefP�h�HX4��      �H@


1�N�����

FILE0�s8(
H0^�8&���\qq5���\qq5���\qq5��0`D^�8&��^�8&��^�8&��^�8&��.@(	$�pO������PH@@001	^��X8 $I300((�P@H$I301V��( $I30����FILE0#8P
`H^�8&��^�8&��^�8&��^�8&��0hP^�8&��^�8&��^�8&��^�8&��~�}$Bitmap�H@>@~�}�}1?g�����    �H@>@~�}�}1?g�����

FILE08�
H0^�8&��^�8&��^�8&��^�8&��0hL^�8&��^�8&��^�8&��^�8&��  $BootP�h�HX4��      �H@@   ����

FILE0�8x`H^�8&��^�8&��^�8&��^�8&��0pR^�8&��^�8&��^�8&��^�8&��$BadClus��P@�H��$Bad������P@�H��$Bad�����FILE0�R	8		`H^�8&��^�8&��^�8&��^�8&�� 0hP$Secure�X@H��$SDS2@�!�	���X8 $SDH((�X8 $SII((�P@	H$SDH1'���P@H$SII10���(
 $SDH�(
 $SII�����(�Hqt@�(�@yt���P@	H$SDH1'���(
 $SDH����FILE0l
8P
`H^�8&��^�8&��^�8&��^�8&��0hP^�8&��^�8&��^�8&��^�8&��$UpCase�H@�@2������    �H@�@2������FILE0�8�`H^�8&��^�8&��^�8&��^�8&��0hP^�8&��^�8&��^�8&��^�8&��$Extend�xX $I300HH`N\=8&��\=8&��\=8&��\=8&��& $ObjId`N\=8&��\=8&��\=8&��\=8&��& $QuotahR\=8&��\=8&��\=8&��\=8&��& $Reparse����\=8&��\=8&��\=8&��\=8&��& $Reparse����FILE0�8
p`H\=8&��\=8&��\=8&��\=8&��& 0hN\=8&��\=8&��\=8&��\=8&��& $Quota�xX $OHH (   ��� $Q��0H\=8&������������������@X\=8&������������������  �����yGFILE09W8
�`H\=8&��\=8&��\=8&��\=8&��& 0hN\=8&��\=8&��\=8&��\=8&��& $ObjId��� $Oxx 8X$�pO������$�pO�����������yG����� $�pO�����������yGFILE0�8
``H\=8&��\=8&��\=8&��\=8&��& 0pR\=8&��\=8&��\=8&��\=8&��& $Reparse�P0 $R  �����yGFILE0�H8�G`H6�K8&��6�K8&��6�K8&��6�K8&��0pR6�K8&��6�K8&��6�K8&��6�K8&��SYSTEM~1olu0�t6�K8&��6�K8&��6�K8&��6�K8&��System Volume Information�`@ $I30000��6�K8&��6�K8&�6�K8&��6�K8&��&MountPointManagerRemoteDatabasehR6�K8&��6�K8&��6�K8&��6�K8&��&MOUNTP~1"���'�5���'�5���'�5���'�5��._restore{CFCC8ECC-E5F6-400C-850B-5010155543EC}"hR�'�5���'�5���'�5���'�5��_RESTO~1�����yFILE0�8�`H6�K8&��6�K8&��6�K8&��6�K8&��&0pR6�K8&��6�K8&��6�K8&��6�K8&��&MOUNTP~1ntM0��6�K8&��6�K8&��6�K8&��6�K8&��&MountPointManagerRemoteDatabase������yGFILE03t8�`H��w+���'�w+���\qq5���n�j5�� 0xZ��w+���'�w+���'�w+���n�j5��T�R EXPORT~1.JPGGP0x\��w+���'�w+���'�w+���n�j5��T�R 
Export_me.JPGP�P)@T�R�R1
�N1 j��i������yGFILE0X\8``H^r9,��l�@,��l�@,��L5�� 0pX^r9,����;,����;,����;,�� deleted.JPG�P)@T�R�R1'/�!��i������yGFILE0�B8�`H���,���!�C���t/��6K^{/�� 0xZ���,���!�C����,�����,��dd SCIENT~1.MP3ont0�n���,���!�C����,�����,��dd Scientific control.mp3�H1@ddd12E������yGFILE0PW8� `H�4w/��p �C�ļ€/��T���/�� 0xZ�4w/���4w/���4w/���4w/�� MVC-577V.MPG@($�pO�������H�@`�^�^2�w������yGFILE0�e8`!`H�'�5��.�:5��.�:5��.�:5��0pR�'�5���'�5���'�5���'�5��RECYCLER�P0 $I300  �����yG ��5��.�:5��.�:5��.�:5��,S-1-5-21-3958095517-222395546-2225589205-500�����yG ��5��.�:5��.�:5��.�:5��S-1-5-~1�����yGFILE0�K8p"`H�'�5���'�5���'�5���'�5��0pR�'�5���'�5���'�5���'�5��_RESTO~1{CF0���'�5���'�5���'�5���'�5��._restore{CFCC8ECC-E5F6-400C-850B-5010155543EC}��� $I300xx#XH"�'�5���'�5���'�5���'�5��RP5�����yGFILE0oO8�#`H�'�5���'�5���'�5���'�5��0`H"�'�5���'�5���'�5���'�5��RP5��� $I300��$hV# ��5���>� 5���>� 5���>� 5��
2 
change.log�����yGFILE0%y8X$`H ��5���>� 5���>� 5���>� 5�� 	0pV# ��5�� ��5�� ��5�� ��5�� 
change.log�H@
2219��������yGFILE0�b8%`H ��5��.�:5��.�:5��.�:5��
0pR! ��5�� ��5�� ��5�� ��5��S-1-5-~1-390��! ��5�� ��5�� ��5�� ��5��,S-1-5-21-3958095517-222395546-2225589205-500�P0 $I300  �����yG ��5�� ��5�� ��5�� ��5��"INFO2�����yG% ��5�� ��5�� ��5�� ��5��"INFO2�����yGFILE0Ea8p&`H ��5�� ��5�� ��5�� ��5��0pX% ��5�� ��5�� ��5�� ��5�� desktop.ini�`A[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
�����yGFILE0�a88'`H ��5�� ��5�� ��5�� ��5��"0hL% ��5�� ��5�� ��5�� ��5��"INFO2�0 �����yG