Extract of attribute $OBJECT_ID from files of MicrosoftWord

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Eugene_777 9 years ago

3 Posts

2 Users

0 Reactions

1,065 Views

RSS

Eugene_777

(@eugene_777)

Eminent Member

Joined: 9 years ago

Posts: 22

Topic starter 14/06/2017 4:50 pm [#15539]

Hello.
I have the image that consists 100 of files of MicrosoftWord. I need to know parameter ObjectId each of files. I can do it manually with help program NTFS Stream Explorer but it will be too long. I tried to do it through FTK but I haven't found necessary columns for it.
Help me, please.

Quote

joakims

(@joakims)

Estimable Member

Joined: 16 years ago

Posts: 224

14/06/2017 10:31 pm

There are several ways

You can parse $MFT directly (either by file, image, physical device or live volume) with https://github.com/jschicht/Mft2Csv

You can also parse the individual files directly (mounted volume) with https://github.com/jschicht/MftRcrd

You can extract the index itself $O in the $ObjId file with https://github.com/jschicht/RawCopy and then parse the extracted INDX dump with https://github.com/jschicht/Indx2Csv

ReplyQuote

Eugene_777

(@eugene_777)

Eminent Member

Joined: 9 years ago

Posts: 22