Extract of attribute $OBJECT_ID from files of MicrosoftWord

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Eugene_777 8 years ago

3 Posts

2 Users

0 Reactions

869 Views

RSS

Eugene_777

(@eugene_777)

Eminent Member

Joined: 8 years ago

Posts: 22

Topic starter 14/06/2017 4:50 pm

Hello.
I have the image that consists 100 of files of MicrosoftWord. I need to know parameter ObjectId each of files. I can do it manually with help program NTFS Stream Explorer but it will be too long. I tried to do it through FTK but I haven't found necessary columns for it.
Help me, please.

Quote

joakims

(@joakims)

Estimable Member

Joined: 15 years ago

Posts: 224

14/06/2017 10:31 pm

There are several ways

You can parse $MFT directly (either by file, image, physical device or live volume) with https://github.com/jschicht/Mft2Csv

You can also parse the individual files directly (mounted volume) with https://github.com/jschicht/MftRcrd

You can extract the index itself $O in the $ObjId file with https://github.com/jschicht/RawCopy and then parse the extracted INDX dump with https://github.com/jschicht/Indx2Csv

ReplyQuote

Eugene_777

(@eugene_777)

Eminent Member

Joined: 8 years ago

Posts: 22

Topic starter 16/06/2017 9:16 pm

Joakims, thank you very much. Very useful program for me.

ReplyQuote

8 Forums
15.7 K Topics
92.3 K Posts
243 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed