Query NTFS MFT for a file

1

I'm working on a file forensics tool. Trying to figure out how to retrieve the $FILE_NAME dates of a specific file from NTFS MFT.

Hoping someone can either point me to a crate I can't find or get me started on how to do it directly with Rust.

I did find the "mft" crate but that looks to be only useful for interrogating snapshots of the MFT.

thanks

2

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.