search

rowingdude / analyzeMFT

MIT License
423 stars 117 forks source link

List the modified files, sorted by modification date #18

Closed Thorsten-Sick closed 2 months ago

Thorsten-Sick commented 10 years ago

Hi

This commit adds a feature to list files by modification date. I want to use it for forensics of malware infected VMs. When the infection just happened. (See cuckoosandbox.org)

Thanks Thorsten Sick

dkovar commented 10 years ago

Thorsten,

My original thinking was to leave this sort of work to Excel, sort, and other external tools. Is there some reason for building this functionality into analyzeMFT rather than leaving it to an external tool?

-David