Aurora-Incident-Response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

MFTEntryCarver

Carve files for MFT entries (eg. blkls output or memory dumps). Recovers filenames (long & short), timestamps ($STD & $FN) and data if resident. It will also parse half broken entries as long as at least one $FN entry is ok.

ftptimeliner