search

alphaleonis / AlphaFS

AlphaFS is a .NET library providing more complete Win32 file system functionality to the .NET platform than the standard System.IO classes.
http://alphafs.alphaleonis.com/
MIT License
563 stars 99 forks source link

Does this lib support $I30 files? #435

Open dnides opened 6 years ago

dnides commented 6 years ago

Does this lib support copying/exporting of $I30 files or any time of system files like $MFT, etc.? The $I30 file is hidden system files in every standard windows directory.

For reference:

• http://cyberforensicator.com/2017/09/12/windows-ntfs-index-attributes-i30-files/ • https://www.osforensics.com/faqs-and-tutorials/how-to-scan-ntfs-i30-entries-deleted-files.html • https://digital-forensics.sans.org/blog/2011/09/20/ntfs-i30-index-attributes-evidence-of-deleted-and-overwritten-files

Yomodo commented 6 years ago

Unfortunately no. Thanks for the info though, let's see what can be done.

dnides commented 6 years ago

Thanks for the response. Yes if there is any way to add future support to export/extract system type files that would be great and make this library very useful to the digital forensic and incident response community.