fte(FILETIME Extractor) gets accurate timestamps and several information on NTFS.
- calculates accurate timestamp value in accordance with provided resolution.
- estimates original data type based on combination of timestamps value.
- parses NTFS internal file like $MFT file, $ObjID file, $INDX_ALLOCATION attribute.
- gets timestamp of $FILE_NAME attribute in NTFS.
- shows timestamps with maximal accuracy on network share.
Refer to the links.
You may use the SOFTWARE freely for personal or commercial and NO WARRANTIES.
Version 1.8.2 released.
- Parsing MFT FILE record as file (File > Open > MFT)
- Parsing INDX record as fil (File > Open > INDX)
- Enhancement of Error handling for FILE record
- Unlock available memory limit to migrate out of memory
Version 1.8.1 released. Implemented strict condition for estimation of INDX record.
changed from 1.7 are:
- Added support for parsing $ObjID
- Added support for parsing $INDEX_ALLOCATION attribute(INDX tab)
- Added type column for detection of timestamp style(MFT/INDX tab)
Addition to parse INDX record (1.8)
Addition to parse ObjID (1.7)
Addition to parse NTFS (1.6)
Fix bugs, change layout, drag&drop compatibility (1.5.1)
First GUI version (1.5)