::
NTFS(Need Administrator) suport functions:
- stat
- deleted_files
- search_usn
- search_full_disk_usn
Search deleted files
Argument:
- path:directory
.\meta_reader.exe ntfs --function deleted_files -d \\.\C: --options "path=C:\"
count: 15
1723627 Some("Windows.old") 2
Search binary data in disk
.\meta_reader.exe ntfs -f search_disk -d \\.\C: -o encode=regex,to_search=123
File stat
.\meta_reader.exe ntfs --function stat -d \\.\C: --options "path=C:\Windows"
filename: Some("Windows")
index: 1724114
fullpath: Some("Windows")
creation: Some(2022-05-07T13:17:22+08:00)
access: Some(2024-12-23T13:49:45+08:00)
modify: Some(2024-12-19T11:29:01+08:00)
creation real(from filename): Some(2022-05-07T13:17:22+08:00)
stream list: None
EXT4(Need privilege to read disk file. like /dev/sdb)
Support function
- list_deleted_files
- journal_recover_file
- list_files
- read_file
- list_recoverable
- search_deleted_files
- search_recoverable_files