Structsยง
- Complete
MftEntry - Represents the set of all $MFT entries that make up a files metadata. The idea is to store only the minimum required data to generate a bodyfile line, which would be
- Filename
Info - Mft2
Bodyfile Task - Parent
Info - Preprocessed
Mft - Timestamp
Tuple - UsnJrnl