NTFS

From WikiWiki
Jump to navigation Jump to search

NFTS tricks!


Last Modified

.\mmls.exe \\.\PhysicalDrive1

.\fls.exe -rp -o 0000002048 \\.\PhysicalDrive1 | Select-String -Pattern Imago

.\istat.exe -o 0000002048 \\.\PhysicalDrive0 115472-128-9

from http://learn-powershell.net/2013/03/03/finding-a-files-mft-timestamp-using-powershell/