MFTECmd

Structured extraction and timeline analysis of NTFS metadata artifacts.

When to use

• You received an $MFT (or NTFS metadata set) and need forensic timeline answers.
• You must identify deleted, hidden, copied, or modified files quickly.
• You need reproducible metadata export for filtering in Timeline Explorer/CSV tools.

Core workflow