NTFS Data Tracker

NTFS Data Tracker v1.0

This tool generates the file data history.

The input of this tool are sample files($LogFile, $MFT) extracted by another tool like Encase, Winhex. 

A default time information is local time(system's time) and timezone is adjustable. 

The Events of File Data History

• Create File

• Initial DataRuns

• Update DataRuns

• Create DataStream

• Update Resident Data

• Delete Resident Data

• Delete File

User Interface

Update History

• v1.0 (2021.12.10)

  • Initial Version 

  • Related Paper : https://www.sciencedirect.com/science/article/abs/pii/S2666281721002341

Created by Junghoon Oh(blueangel)

Email : blueangel1275@gmail.com