Shypd.aiThe largest open index of AI toolsntfstool is an open-source forensic tool for analyzing NTFS volumes. It supports reading partition information, MBR, VBR, Master File Table, BitLocker encrypted volumes, and USN journals, and can recover deleted files.
Trending
About
ntfstool is a comprehensive open-source forensic tool specifically designed for analyzing NTFS volumes. It offers robust capabilities for reading and interpreting various critical disk structures, including the Master Boot Record (MBR), Volume Boot Record (VBR), and partition tables. The tool excels at examining the Master File Table ($MFT), providing options to dump it in CSV, JSON, or raw formats, and parse Zone.Identifier data for quick identification of downloaded files. It also features strong support for BitLocker encrypted volumes, allowing users to display FVE records, check passwords/keys, and extract VMK/FVEK. Additionally, ntfstool can analyze EFS encrypted files, list and decrypt master keys, and export certificates with private keys. Its undelete command helps retrieve files marked as 'not in use,' and it supports input from image files, live disks, or virtual disks. The tool also includes USN journal analysis with custom rules for detecting suspicious activities and a limited shell for command-line operations.
Capabilities
Pricing & Plans
Open Source
Free
FAQs
Trending
