diff options
| author | matthew seyer <matthew.seyer@gmail.com> | 2017-04-21 08:00:53 +0300 |
|---|---|---|
| committer | matthew seyer <matthew.seyer@gmail.com> | 2017-04-21 08:00:53 +0300 |
| commit | 129b129279c50125f20d2cda276bcb7b5b24b1c7 (patch) | |
| tree | 79bd2bce4ed09f12e806aeab10a9f99fcb0ff5bb | |
| parent | b3c89de9ec4b139f96b9778b9f1c4e2ea6e823b4 (diff) | |
| parent | 913deaba8338c3aacffef4a33fc53638d34b8daf (diff) | |
Merge branch 'master' of https://github.com/forensicmatt/RustyMft
| -rw-r--r-- | README.md | 54 |
1 files changed, 54 insertions, 0 deletions
@@ -1,2 +1,56 @@ # RustyMft MFT to JSON + +## Example output +``` json +{ + "header": { + "signature": 1162627398, + "usa_offset": 48, + "usa_size": 3, + "logfile_sequence_number": "1094958", + "sequence": 1, + "hard_link_count": 1, + "fst_attr_offset": 56, + "flags": "ALLOCATED", + "entry_size_real": 808, + "entry_size_allocated": 1024, + "base_reference": "0", + "next_attribute_id": 7, + "record_number": 47, + "update_sequence_value": 0 + }, + "attr_standard_info": [ + { + "created": "2017-04-20 00:39:37.541", + "modified": "2017-04-20 00:40:33.724", + "mft_modified": "2017-04-20 00:40:33.724", + "accessed": "2017-04-20 00:39:37.541", + "file_flags": 32, + "max_version": 0, + "version": 0, + "class_id": 0, + "owner_id": 0, + "security_id": 268, + "quota": "0", + "usn": "11120" + } + ], + "attr_filename": [ + { + "parent": "281474976710695", + "created": "2017-04-20 00:39:37.541", + "modified": "2017-04-20 00:39:37.541", + "mft_modified": "2017-04-20 00:40:05.118", + "accessed": "2017-04-20 00:39:37.541", + "logical_size": "0", + "physical_size": "0", + "flags": 32, + "reparse_value": 0, + "name_length": 228, + "namespace": 0, + "name": "time_for_a_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super__super_super_super_super_super_super_super_super_longname.txt" + } + ] +} +``` |