Query NTFS MFT for a file

I'm working on a file forensics tool. Trying to figure out how to retrieve the $FILE_NAME dates of a specific file from NTFS MFT.

Hoping someone can either point me to a crate I can't find or get me started on how to do it directly with Rust.

I did find the "mft" crate but that looks to be only useful for interrogating snapshots of the MFT.


This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.