analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

Windows forensics Engine

Carve file metadata from NTFS index ($I30) attributes

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

基于Python构建的磁盘空间可视化分析软件，可利用MFT主文件表进行分析，旨在将磁盘内各文件夹所占空间以直观的方式展示出来，帮助使用者更好地了解磁盘空间的使用情况。

A command-line tool and Python library for parsing Windows Master File Table ($MFT) and importing the results into Elasticsearch.

MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.

Data recovery utilities

Lists the files on a drive insanely fast (43 seconds for 1,800,000 files - 600 GB) by converting the $MFT to a pandas DataFrame

parse MBR and Partition Table to extract MFT Entries

MFT/HFT & Market Making suite for Hyperliquid. Features SAC/PPO agent that optimizes Avellaneda-Stoikov inventory control, VPIN & Kyle's Lambda toxicity classification, FIFO queue warfare estimation, spoofing counter, predatory liquidity hunting, and tactical funding arbitrage. Simulation & Live WS runner.

Portal for Apache Airavata Managed File Transfer Services

Local-first DFIR investigation platform for centralizing artifacts, reducing noise, and reconstructing incidents.

⚡ Lightning-fast file search MCP server using NTFS Master File Table - WizFile performance for Claude Desktop

From Shadows to Sun: A high-resolution forensics suite for absolute coordinate determination, from triage to testimony.

A lightweight digital forensics tool for extracting and analyzing NTFS $MFT data using CSV-based workflows. MFT Analyzer offers a fast, stable GUI with powerful filters to investigate millions of file records without heavy databases, making forensic triage simple and efficient.

This package implements multiples libraries and tools to parse, analyze and extract informations from disk on the live system.

Live Windows forensic triage tool that rapidly detects anti-forensics, suspicious execution, and post-compromise activity.

An unofficial Python Web API wrapper for SolarWinds Serv-U Managed File Transfer.

mft to parquet (pyarrow dtypes)