[sleuthkit-users] export all mft entries
Brought to you by:
carrier
|
From: frman3 <amu...@ai...> - 2006-07-11 18:20:18
|
I am looking for a way to either: 1) list MFT entries based on the "Last MFT modification Time field" or 2) export all of a disks MFT entries to a file that I can import into a database program and manipulate myself (So I can sort by MFT modification time). At worst I suppose I could write a script to run istat for each entry, export the results to a file which I could then parse the results. But the output does not seem to lend itself to easy importing to a database. Is there an easier way, or has someone else done this? Forgive me if the answer was easily available if I just knew which keywords to google. I am experienced with disk editing tools, but trying to make the plunge to the more powerful features in The Sleuthkit and still learning where to look for answers. -- View this message in context: http://www.nabble.com/export-all-mft-entries-tf1926132.html#a5274661 Sent from the sleuthkit-users forum at Nabble.com. |