With more thanks to Jamie for the prompting, I’ve improved bodyfile support in the latest version of analyzeMFT.
- You can now specify just a bodyfile for output and do not need to create a normal output file as well.
- The real (not allocated) file size is included
- If you use the –bodypath option, it writes out the full path to the file rather than just the file name
- If you use the –bodystd option, it uses the STD_INFO timestamps rather than just the FN timestamps. I find STD_INFO to be more interesting….
This is a pretty significant fix and I would suggest upgrading if you create timelines with analyzeMFT.
Links:
Git: git clone https://github.com/dkovar/analyzeMFT.git
Code: https://github.com/dkovar/analyzeMFT/blob/master/analyzeMFT.py
