Join Us!

[Tool] The FTK file...
 
Notifications
Clear all

[Tool] The FTK filelist viewer/browser v0.0.0.1alpha  

  RSS
francesco
(@francesco)
Member

Description

A simple filelist viewer/browser for the filelists generated by FTK imager.

Important notes (READ THIS!)

  • Files with alternate data streams will be shown as folders. It's not a bug of the tool but rather the FTK filelist format storing those files in a way identical to folders. Always remember to check the folder names in case they may be actually files.
  • When there are different versions of folders that have the same name (deleted folders) only a single entry for the folder should be shown, containing the files from all the different versions of the folder. That's because filelists generated by FTK imager don't seem to have an entry order that allows matching the correct content of each different folder version.
  • I already reported both issues (ADS should be separated by a '' and folder contents should be printed immediately after the matching folder entry) to AccessData but they wouldn't listen so I gave up. In the future I might support Sleuthkit bodyfiles if there's enough request.
  • This is a test build and may have issues, please report any bug or feature request in this thread.
System requirements

Windows XP and above.

DISCLAIMER

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

LICENSE

The license is GPLv3. Send me a PM if you need the source code.

Download

Filelist viewer/browser v0.0.0.1alpha

Changelog

Filelist viewer/browser v0.0.0.1alpha
- Initial release

Quote
Posted : 15/04/2014 4:56 am
Horking
(@horking)
New Member

D

ReplyQuote
Posted : 15/04/2014 11:31 am
aeiforensics
(@aeiforensics)
Junior Member

Awesome tool; can you PM me your email address? Want to discuss something concerning this tool off list.

ReplyQuote
Posted : 20/04/2014 8:02 am
francesco
(@francesco)
Member

Awesome tool; can you PM me your email address? Want to discuss something concerning this tool off list.

I sent you a PM right now.

ReplyQuote
Posted : 21/04/2014 9:15 am
Share: