by Dr. Radut

fte

fte(FILETIME Extractor) gets accurate timestamps and several information on NTFS.

fte 1.8

Feature

  • calculates accurate timestamp value in accordance with provided resolution.
  • estimates original data type based on combination of timestamps value.
  • parses NTFS internal file like $MFT file, $ObjID file, $INDX_ALLOCATION attribute.
  • gets timestamp of $FILE_NAME attribute in NTFS.
  • shows timestamps with maximal accuracy on network share.

Download

fte_1.8.2.zip (MD5: 7fb35b5e1d6b72304b62fa4dacd6962c)
fte_1.8.1.zip (MD5: bc815fbb87d8b4ced19a5e6603493916)
fte_1.8.zip (MD5: e4688bdc1ed244224619354760f688fb)

Document

Refer to the links.

License

You may use the SOFTWARE freely for personal or commercial and NO WARRANTIES.

History

2015/01/24

Version 1.8.2 released.

  • Parsing MFT FILE record as file (File > Open > MFT)
  • Parsing INDX record as fil (File > Open > INDX)
  • Enhancement of Error handling for FILE record
  • Unlock available memory limit to migrate out of memory

2012/09/02

Version 1.8.1 released. Implemented strict condition for estimation of INDX record.

changed from 1.7 are:

  • Added support for parsing $ObjID
  • Added support for parsing $INDEX_ALLOCATION attribute(INDX tab)
  • Added type column for detection of timestamp style(MFT/INDX tab)

2012/08/09

Addition to parse INDX record (1.8)

2012/07/02

Addition to parse ObjID (1.7)

2011/07/10

Addition to parse NTFS (1.6)

2011/05/15

Fix bugs, change layout, drag&drop compatibility (1.5.1)

2011/05/10

First GUI version (1.5)