Add new comment

fte(FILETIME Extractor) is a tool which gets accurate timestamps of specified files/folders.

[Version]
fte v1.5.1

[License]
GPL (v3)

[Requirement]
Windows XP/2003/Vista/2008/7 (x86/x64) & .NET Framework 2.0 or above

Additionally the following runtime is needed.
# I think you don't need to install if your OS is Windows 7

Microsoft Visual C++ 2008 Redistributable Package (x86)
http://www.microsoft.com/downloads/en/details.aspx?familyid=9b2da534-3e03-4391-8a4d-074b9f2bc1bf&displaylang=en

Please install x86 runtime even if your OS edition is x64.

[Usage]

1. You can export or import in "File" menu. Functions in "Commands" menu are identical to buttons of bottom area (This is for shortcut).
2. Main area. Each columns are as follows.
   • name (File name)
   • id (File ID)
   • type (Timestamp format)
   • crtime (File Created Timestamp)
   • mtime (Last Modified Timestamp)
   • ctime (Entry Modified Timestamp)
   • atime (Last Accessed Timestamp)
   • otime (Object ID Timestamp)
   • botime (BirthObject ID Timestamp)

   The columns are movable and the width of columns are controllable via mouse. When you click header of column, data are sorted by the column. You can also drag & drop files/folders into this area.

3. Input target. You can input in textbox directly(autocomplete), select folder from "Select" button, or drag&drop.
4. Option. Check "Recursive" if you want to process recursively. Check "UTC" if you want to display UTC timezone. (By default, timestamp is based on your local machine's timezone)
5. Click "Run" then get timestamp with specified target. "Run" button appends the results to the existing. Click "Clear" if you would like to clear the results.
6. When you launch fte, it confirms NtfsDisableLastAccessUpdate registry entry and report the value. After that, it displays contents of cell you click.
7. Display count number of processed files/folders

[Feature]

• fte is a simple program that extracts information using WinAPI.
• The greatest character is that fte calculates less than a second.
• Even if target is FAT, exFAT and network share(like SMB), fte gets the value of possible accuracy.
• fte can get timestamp from Internal file like $MFT.
• fte estimates original data type based on combination of timestamps value.
• If file has Object ID, fte parses and shows the timestamps.
• fte also outputs File ID which is controlled by Filesystem.

[Limitation]

• fte tries to open specified file as soon as possible, but error occurred if the fille is in use by another process. Error means File ID 0.
• fte is not able to get timestamps of deleted files.
• It may take a long time if fte processed a lot of objects. The window may get no answer, but you hold the line then it will finish.

[Download]
fte_1.5.1.zip - binary (MD5: c02e0fefda5e3691a72dd0f1828e08fa)
fte_1.5.1_src.zip - source (MD5: 8e983f3b2344877572df880e1970d580)

You can get previous version from fte(cmd).

[Note]
2011/05/15: Fix bugs, change layout, drag&drop compatibility
2011/05/10: First GUI version