MftCarver. Carve $MFT records from a chunk of data (for instance a memory dump)

github.com/jschicht/MftCarver
by @jschicht

Problem

Audience

Keep exploring

Updates

No founder updates yet. Check back soon.