Skip to content

MrRooten/meta_reader

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

22 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

::⚠️ ntfs usn dump has some bugs, maybe the data run problem

NTFS(Need Administrator) suport functions:

  • stat
  • deleted_files
  • search_usn
  • search_full_disk_usn

Search deleted files
Argument:

  • path:directory
.\meta_reader.exe ntfs --function deleted_files -d \\.\C: --options "path=C:\"
count: 15
1723627 Some("Windows.old") 2

Search binary data in disk

.\meta_reader.exe ntfs -f search_disk -d \\.\C: -o encode=regex,to_search=123

File stat

 .\meta_reader.exe ntfs --function stat -d \\.\C: --options "path=C:\Windows"
filename: Some("Windows")
        index: 1724114
        fullpath: Some("Windows")
        creation: Some(2022-05-07T13:17:22+08:00)
        access: Some(2024-12-23T13:49:45+08:00)
        modify: Some(2024-12-19T11:29:01+08:00)
        creation real(from filename): Some(2022-05-07T13:17:22+08:00)
        stream list: None

EXT4(Need privilege to read disk file. like /dev/sdb)
Support function

  • list_deleted_files
  • journal_recover_file
  • list_files
  • read_file
  • list_recoverable
  • search_deleted_files
  • search_recoverable_files

About

File parser for multiple types

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Contributors 3

  •  
  •  
  •