Notifications
Clear all
Topic starter
19/06/2021 7:11 am
https://github.com/harelsegev/INDXRipper
Find index entries in NTFS $I30 attributes and easily integrate the data into a timeline
This started as an experimental project, but turned out to be useful enough to share
20/06/2021 9:39 am
Nice.
Another little tool that goes in the toolbox, just in case.Â
jaclaz
Topic starter
20/06/2021 7:06 pm
@jaclaz Ideally, it should always be used when making a file system timeline. It finds files other tools don't, and it does it fairly quickly.
Topic starter
21/06/2021 6:23 am
@thefuf I've never tried it. It looks great, honestly. It seems like it carves $FILE_NAME attributes from the slack space of $INDEX_ALLOCATION attributes, which is similar to what INDXRipper is doing. I guess you can use either of them for this purpose.
