Notifications
Clear all
Topic starter
06/05/2023 5:06 pm
Hello Everyone
I'm currently working on a script/tool using powershell to grab artefacts from the running system. I've managed to get everything working apart from locked files like the $MFT. Does anyone know if this can be done using powershell only?
Thanks in advance.Â
11/05/2023 2:49 pm
Yes. Look at Zimmermans tools, he has a parser for $MFT which utilizes Powershell and/or
CLI.
