MFTECmd icon indicating copy to clipboard operation
MFTECmd copied to clipboard

Add Source File to Report for $MFT

Open stark4n6 opened this issue 5 months ago • 3 comments

Would it be possible to add the source file path to the end of the $MFT report? Similar to how the $J one has it?

I'm having issues determining which MFT file I'm looking at after grabbing multiple from VSC.

This would help also when using usnjrnl_rewind to properly match the MFT with the $J.

stark4n6 avatar Aug 28 '24 16:08 stark4n6