search

harelsegev / INDXRipper

Carve file metadata from NTFS index ($I30) attributes
MIT License
58 stars 4 forks source link

Extension records of $MFT are not handled #5

Closed harelsegev closed 2 years ago

harelsegev commented 2 years ago

If MFT records in range 12 - 15 or 16 - 23 are used to expand the MFT, use all the extra $DATA attributes to find all of the MFT data.