Permission attributes in MFT record

[gdms04]

From the artifact [Windows.NTFS.MFT], we observed that the columns are set. I would like to include permission attributes of a MFT entry as well (You may refer to below screenshot for reference). May I ask for the column name(s) for this attribute? and where can I find the relevant documentation for my reference? Thanks!

[scudette]

In NTFS parsing permissions involves parsing the $Secure MFT entry. This is not yet implemented but an example of such a thing is here https://github.com/jschicht/Secure2Csv/blob/master/Secure2Csv.au3

It is probably a good idea to implement this.

[gdms04]

i see, thx!

[scudette]

FYI you can use Windows.Triage.SDS to collect this stream.