NTFS
Jump to navigation
Jump to search
NFTS tricks!
Last Modified
.\mmls.exe \\.\PhysicalDrive1
.\fls.exe -rp -o 0000002048 \\.\PhysicalDrive1 | Select-String -Pattern Imago
.\istat.exe -o 0000002048 \\.\PhysicalDrive0 115472-128-9
from http://learn-powershell.net/2013/03/03/finding-a-files-mft-timestamp-using-powershell/