Velocidex / go-ntfs

An NTFS file parser in Go
Apache License 2.0
64 stars 22 forks source link

Resolve USN full path through parent MFTID #36

Closed scudette closed 3 years ago

scudette commented 3 years ago

Often the USN record indicates a file removal or rename so the MFTID of the actual file is less reliable than the parent joined with the filename in the record itself.