Skip to content

Commit

Permalink
Add files via upload
Browse files Browse the repository at this point in the history
  • Loading branch information
@kacos2000
kacos2000 authored Jan 11, 2021
1 parent 33457a3 commit 7fe117c
Showing 1 changed file with 42 additions and 43 deletions.
85 changes: 42 additions & 43 deletions MFTbrowser.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
.NOTES
--------------------------------------------------------------------------------
Code generated by: SAPIEN Technologies, Inc., PowerShell Studio 2020 v5.7.182
Generated on: 10/1/2021
Generated on: 11/1/2021
Generated by: Costas Katsavounidis
--------------------------------------------------------------------------------
.DESCRIPTION
Expand Down Expand Up @@ -262,7 +262,7 @@ function Show-MainForm_psf
$NewRecordRange.Enabled = $false

# Hide Treeview & Datagridview etc
$picturebox1.Visible = $true
$picturebox1.Visible = $false
$treeview1.Visible = $false
$datagridview1.Visible = $false
$richtextbox1.Visible = $false
Expand Down Expand Up @@ -923,28 +923,28 @@ Should match the 'File reference number' in fsutil"
$1concreb = [System.Text.Encoding]::getencoding(28591).GetBytes($1concre)
[array]::reverse($1concreb)
$1concrebh = [System.BitConverter]::ToString($1concreb) -replace '-', ''
$File_create1 = [datetime]::FromFileTimeUtc("0x$($1concrebh)")
$File_create1 = [datetime]::FromFileTimeUtc("0x$($1concrebh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Modified time
$1conmod = $data.Substring($Attributeoffset + $contentoffset + 8, 8)
$1conmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($1conmod)
[array]::reverse($1conmodb)
$1conmodbh = [System.BitConverter]::ToString($1conmodb) -replace '-', ''
$File_mod1 = [datetime]::FromFileTimeUtc("0x$($1conmodbh)")
$File_mod1 = [datetime]::FromFileTimeUtc("0x$($1conmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File MFT Modified time
$1conmftmod = $data.Substring($Attributeoffset + $contentoffset + 16, 8)
$1conmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($1conmftmod)
[array]::reverse($1conmftmodb)
$1conmftmodbh = [System.BitConverter]::ToString($1conmftmodb) -replace '-', ''
$File_mftmod1 = [datetime]::FromFileTimeUtc("0x$($1conmftmodbh)")
$File_mftmod1 = [datetime]::FromFileTimeUtc("0x$($1conmftmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Last Accessed time
$1conla = $data.Substring($Attributeoffset + $contentoffset + 24, 8)
$1conlab = [System.Text.Encoding]::getencoding(28591).GetBytes($1conla)
[array]::reverse($1conlab)
$1conlabh = [System.BitConverter]::ToString($1conlab) -replace '-', ''
$File_lastaccess1 = [datetime]::FromFileTimeUtc("0x$($1conlabh)")
$File_lastaccess1 = [datetime]::FromFileTimeUtc("0x$($1conlabh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Type Flags
$1confl = $data.Substring($Attributeoffset + $contentoffset + 32, 4)
Expand Down Expand Up @@ -1299,28 +1299,28 @@ Name: (Variable)"
$2concreb = [System.Text.Encoding]::getencoding(28591).GetBytes($2concre)
[array]::reverse($2concreb)
$2concrebh = [System.BitConverter]::ToString($2concreb) -replace '-', ''
$File_create = [datetime]::FromFileTimeUtc("0x$($2concrebh)")
$File_create = [datetime]::FromFileTimeUtc("0x$($2concrebh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Modified time
$2conmod = $data.Substring($residentcontentoffset + 16, 8)
$2conmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($2conmod)
[array]::reverse($2conmodb)
$2conmodbh = [System.BitConverter]::ToString($2conmodb) -replace '-', ''
$File_mod = [datetime]::FromFileTimeUtc("0x$($2conmodbh)")
$File_mod = [datetime]::FromFileTimeUtc("0x$($2conmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File MFT Modified time
$2conmftmod = $data.Substring($residentcontentoffset + 24, 8)
$2conmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($2conmftmod)
[array]::reverse($2conmftmodb)
$2conmftmodbh = [System.BitConverter]::ToString($2conmftmodb) -replace '-', ''
$File_mftmod = [datetime]::FromFileTimeUtc("0x$($2conmftmodbh)")
$File_mftmod = [datetime]::FromFileTimeUtc("0x$($2conmftmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Last Accessed time
$2conla = $data.Substring($residentcontentoffset + 32, 8)
$2conlab = [System.Text.Encoding]::getencoding(28591).GetBytes($2conla)
[array]::reverse($2conlab)
$2conlabh = [System.BitConverter]::ToString($2conlab) -replace '-', ''
$File_lastaccess = [datetime]::FromFileTimeUtc("0x$($2conlabh)")
$File_lastaccess = [datetime]::FromFileTimeUtc("0x$($2conlabh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Type Flags
$2confl = $data.Substring($residentcontentoffset + 56, 4)
Expand Down Expand Up @@ -1543,7 +1543,7 @@ If the file is a Reparse Point, then the Reparse Field will give its type (repar
$1582offset = (New-Object DateTime(1582, 10, 15, 0, 0, 0)).Ticks
$1601offset = (New-Object DateTime(1601, 1, 1, 0, 0, 0)).Ticks
# Calculate the Date after substracting the two Date offsets
$ObjectIdCreated = [datetime]::FromFileTimeUtc($timedec - ($1601offset - $1582offset))
$ObjectIdCreated = [datetime]::FromFileTimeUtc($timedec - ($1601offset - $1582offset)).ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# Add to tree
$Null = $objectNode.Nodes.Add("GUIDcreated", "GUID created at: $($ObjectIdCreated)")
Expand Down Expand Up @@ -2014,8 +2014,8 @@ The object ID is assigned at file creation time."
$winformatversion = [Convert]::TouInt16($winformvh, 16)

# Add to tree
$Null = $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes.Add("Winformatversion", "[0x$(($Attributeoffset + 24).tostring('X3'))] Win version used to format the volume: $($winformatversion)")
$ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].Tag = @("$($Attributeoffset + 24)", "2")
$Null = $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes.Add("Winformatversion", "[0x$(($residentcontentoffset + 24).tostring('X3'))] Win version used to format the volume: $($winformatversion)")
$ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].Tag = @("$($residentcontentoffset + 24)", "2")
$ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].ToolTipText = "Windows version used to format the source drive
https://twitter.com/errno_fail/status/1258900141479809025?s=20
https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions"
Expand Down Expand Up @@ -2271,28 +2271,28 @@ The object ID is assigned at file creation time."
$idxconcreb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxconcre)
[array]::reverse($idxconcreb)
$idxconcreh = [System.BitConverter]::ToString($idxconcreb) -replace '-', ''
$Idx_File_create = [datetime]::FromFileTimeUtc("0x$($idxconcreh)")
$Idx_File_create = [datetime]::FromFileTimeUtc("0x$($idxconcreh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Modified time
$idxmod = $data.Substring($firstoffset + 32, 8)
$idxmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxmod)
[array]::reverse($idxmodb)
$idxmodh = [System.BitConverter]::ToString($idxmodb) -replace '-', ''
$Idx_File_mod = [datetime]::FromFileTimeUtc("0x$($idxmodh)")
$Idx_File_mod = [datetime]::FromFileTimeUtc("0x$($idxmodh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File MFT Modified time
$idxmftmod = $data.Substring($firstoffset + 40, 8)
$idxmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxmftmod)
[array]::reverse($idxmftmodb)
$idxmftmodh = [System.BitConverter]::ToString($idxmftmodb) -replace '-', ''
$Idx_File_mftmod = [datetime]::FromFileTimeUtc("0x$($idxmftmodh)")
$Idx_File_mftmod = [datetime]::FromFileTimeUtc("0x$($idxmftmodh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Last Accessed time
$idxla = $data.Substring($firstoffset + 48, 8)
$idxlab = [System.Text.Encoding]::getencoding(28591).GetBytes($idxla)
[array]::reverse($idxlab)
$idxlah = [System.BitConverter]::ToString($idxlab) -replace '-', ''
$Idx_File_lastaccess = [datetime]::FromFileTimeUtc("0x$($idxlah)")
$Idx_File_lastaccess = [datetime]::FromFileTimeUtc("0x$($idxlah)").ToString("dd/MM/yyyy HH:mm:ss.fffffff")

# File Allocated Size
$idxfszh = $data.Substring($firstoffset + 56, 8)
Expand Down Expand Up @@ -10226,7 +10226,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAgAEAAAs='))
[void]$splitcontainer1.Panel1.Controls.Add($picturebox1)
[void]$splitcontainer1.Panel2.Controls.Add($splitcontainer2)
$splitcontainer1.Size = New-Object System.Drawing.Size(2390, 1441)
$splitcontainer1.SplitterDistance = 1109
$splitcontainer1.SplitterDistance = 1106
$splitcontainer1.SplitterWidth = 6
$splitcontainer1.TabIndex = 3
$splitcontainer1.TabStop = $False
Expand Down Expand Up @@ -10312,7 +10312,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL'))
$treeview1.Margin = '28, 24, 28, 24'
$treeview1.Name = 'treeview1'
$treeview1.ShowNodeToolTips = $True
$treeview1.Size = New-Object System.Drawing.Size(1105, 1437)
$treeview1.Size = New-Object System.Drawing.Size(1102, 1437)
$treeview1.TabIndex = 0
$treeview1.Visible = $False
$treeview1.add_AfterSelect($treeview1_AfterSelect)
Expand All @@ -10332,7 +10332,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL'))
$richtextbox1.Name = 'richtextbox1'
$richtextbox1.ReadOnly = $True
$richtextbox1.ShowSelectionMargin = $True
$richtextbox1.Size = New-Object System.Drawing.Size(1271, 327)
$richtextbox1.Size = New-Object System.Drawing.Size(1274, 327)
$richtextbox1.TabIndex = 0
$richtextbox1.Text = ''
#
Expand Down Expand Up @@ -10406,7 +10406,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL'))
$datagridview1.ShowCellErrors = $False
$datagridview1.ShowEditingIcon = $False
$datagridview1.ShowRowErrors = $False
$datagridview1.Size = New-Object System.Drawing.Size(1271, 1100)
$datagridview1.Size = New-Object System.Drawing.Size(1274, 1100)
$datagridview1.TabIndex = 1
$datagridview1.Visible = $False
$datagridview1.add_CellMouseEnter($datagridview1_CellMouseEnter)
Expand Down Expand Up @@ -14036,7 +14036,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAgAEAAAs='))
[void]$splitcontainer2.Panel1.Controls.Add($toolstrip1)
[void]$splitcontainer2.Panel1.Controls.Add($richtextbox1)
[void]$splitcontainer2.Panel2.Controls.Add($datagridview1)
$splitcontainer2.Size = New-Object System.Drawing.Size(1275, 1441)
$splitcontainer2.Size = New-Object System.Drawing.Size(1278, 1441)
$splitcontainer2.SplitterDistance = 331
$splitcontainer2.SplitterWidth = 6
$splitcontainer2.TabIndex = 3
Expand Down Expand Up @@ -14388,7 +14388,7 @@ V3r+l7leIiAvDHlrTQXSM4H5tGn/AjkLWg2DRQjrAAAAAElFTkSuQmCCCw=='))
AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAu
MC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAA
ACZTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkD
AAAADwMAAAAoCwAAAk1TRnQBSQFMAgEBBQEAASgBAAEoAQABEAEAARABAAT/AQkBAAj/AUIBTQE2
AAAADwMAAAAoCwAAAk1TRnQBSQFMAgEBBQEAAUABAAFAAQABEAEAARABAAT/AQkBAAj/AUIBTQE2
AQQGAAE2AQQCAAEoAwABQAMAASADAAEBAQABCAYAAQgYAAGAAgABgAMAAoABAAGAAwABgAEAAYAB
AAKAAgADwAEAAcAB3AHAAQAB8AHKAaYBAAEzBQABMwEAATMBAAEzAQACMwIAAxYBAAMcAQADIgEA
AykBAANVAQADTQEAA0IBAAM5AQABgAF8Af8BAAJQAf8BAAGTAQAB1gEAAf8B7AHMAQABxgHWAe8B
Expand Down Expand Up @@ -14555,11 +14555,10 @@ BwIAAfABBwL/AcABDwL/Af4BPws='))
$picturebox1.Location = New-Object System.Drawing.Point(0, 0)
$picturebox1.Margin = '20, 20, 20, 20'
$picturebox1.Name = 'picturebox1'
$picturebox1.Size = New-Object System.Drawing.Size(1105, 1437)
$picturebox1.Size = New-Object System.Drawing.Size(1102, 1437)
$picturebox1.SizeMode = 'CenterImage'
$picturebox1.TabIndex = 1
$picturebox1.TabStop = $False
$picturebox1.Visible = $False
$contextmenustrip5.ResumeLayout()
$toolstrip1.ResumeLayout()
$splitcontainer2.ResumeLayout()
Expand Down Expand Up @@ -18446,8 +18445,8 @@ Main ($CommandLine)
# SIG # Begin signature block
# MIIfcAYJKoZIhvcNAQcCoIIfYTCCH10CAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAD/Ui+mAsKt2zf
# K3nRpywC92Jqhf6GYlLp8d6xSujjiaCCGf4wggQVMIIC/aADAgECAgsEAAAAAAEx
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD/2lxzXSfOX8MB
# iyBpQ4/tACSl//ChaNS9A9WTzlrooaCCGf4wggQVMIIC/aADAgECAgsEAAAAAAEx
# icZQBDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3Qg
# Q0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2ln
# bjAeFw0xMTA4MDIxMDAwMDBaFw0yOTAzMjkxMDAwMDBaMFsxCzAJBgNVBAYTAkJF
Expand Down Expand Up @@ -18590,26 +18589,26 @@ Main ($CommandLine)
# R3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9T
# ZWN0aWdvIExpbWl0ZWQxJDAiBgNVBAMTG1NlY3RpZ28gUlNBIENvZGUgU2lnbmlu
# ZyBDQQIRALjpohQ9sxfPAIfj9za0FgUwDQYJYIZIAWUDBAIBBQCgTDAZBgkqhkiG
# 9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgJ1lsiNL8vsJF8pf6
# 1Ki1GEx2IJlytrQOxGpJX3s6wgUwDQYJKoZIhvcNAQEBBQAEggEAg+QNp0k4KmI8
# qp616ATbW5P5VdsJr1oPfwoP2q0vZPv6+0Te/YIMy+8M2JVlcfWVyijTq2Tiq+VG
# mROQJ005Xw0PaVHQ3U6iANC6E3ktM+x8vZuLS7d7auypWV2eWfn/n+pT29yBDwyZ
# AyCYkZfwthRvP9Tq5J5AhcDJUVmpR7r4oyyI6OcW5N0M9jlItZMbw6FVafueRUl8
# r2OEeUu5jkFyqp9Kp67YlNzKRGpr/REKl36XuaQIkb2mJiEjRPaYVzunZEK1uRCU
# zj2bsxvecs7XCgtOiZLEoUIJy71CMGGN9VkWMkLq4CqI4ULpWulGr3SMwlPphIcK
# 4mR2n7oXrqGCArkwggK1BgkqhkiG9w0BCQYxggKmMIICogIBATBrMFsxCzAJBgNV
# 9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgfn02ESlm7xyb5MlV
# XL6Z0PfBOP4CB3ZgurkU83l1LMAwDQYJKoZIhvcNAQEBBQAEggEABRI+A84L/BoA
# jFkk5Fk1g2s/2uCkkl7bU4lGreSlOHrrDl4bUkch9qbnvZttJ0qoajDPOD+9dPAz
# FTONHJZYLvqBKhLfbW2h1EUk3TRbbaUHmIOXR8z99JlzKt7UJlW8R+JL/TZYG7/e
# nWvwyj8WgZo1c307K++Fr3t6gl7WE8ObPfVmDH8Jo6qSqThxdVg4DPbEsIvRsRf8
# RLp333isCo3IOr/n2FkTqQcBzwnWNeAoLul4CqJfRKXua3RnY8tX3iqQVpSWKCrV
# z1drqeVms+ifKmr8Yv/oDzYkiFQHlejP/V1WJwoUZ/FbSGOqtugjF9+Z87MdJJ4z
# dEgdVF+gVKGCArkwggK1BgkqhkiG9w0BCQYxggKmMIICogIBATBrMFsxCzAJBgNV
# BAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTEwLwYDVQQDEyhHbG9i
# YWxTaWduIFRpbWVzdGFtcGluZyBDQSAtIFNIQTI1NiAtIEcyAgwkVLh/HhRTrTf6
# oXgwDQYJYIZIAWUDBAIBBQCgggEMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
# HAYJKoZIhvcNAQkFMQ8XDTIxMDExMDIxNTYyMFowLwYJKoZIhvcNAQkEMSIEID6q
# buW4+X0Ra84jgOeTOdD4BuHYe3g/cVj8Wj7WXPngMIGgBgsqhkiG9w0BCRACDDGB
# HAYJKoZIhvcNAQkFMQ8XDTIxMDExMTE0MzkxNVowLwYJKoZIhvcNAQkEMSIEIG82
# 9GKWtChEFr7k80zQ/R3W/lImi8l8uslk4ocbW/3gMIGgBgsqhkiG9w0BCRACDDGB
# kDCBjTCBijCBhwQUPsdm1dTUcuIbHyFDUhwxt5DZS2gwbzBfpF0wWzELMAkGA1UE
# BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExMTAvBgNVBAMTKEdsb2Jh
# bFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMjU2IC0gRzICDCRUuH8eFFOtN/qh
# eDANBgkqhkiG9w0BAQEFAASCAQBlA2drj1yzU6VCcZzsO7vsozYMY1CyrZRh0q54
# TiqF1RCrjmEFUOwt3jLl3/SlE1/hHQFrt4wLqQyKlBZsaXeYEdExXTc8Zm6tzU3L
# sosrfrTbBfadHiVio3yUT8dGtFWMmUj6IMLBdL8NJvcOTNF4AGe0WvPuuKId4HLy
# PJ5wijdFuzlP+9U1YBDTSrLeX6OBPbJno4juZdIRRA2j3QbtVKVX8IZbbAEqI8ef
# LEWqvbzsK4yIH2FMNkMzrSGUelMFiE73ReDcP7FNXVhdSDP7rS7dO2spjmUeTSiW
# ljDnkl83uUn98HIaqaKt3uwDD63H57BSUlCnDbHdFQKIAbt8
# eDANBgkqhkiG9w0BAQEFAASCAQAhDZl2Nq6iQTelKGMQF2jbOByLR41M0KFW+rCV
# P0G8jm5EwadeEb1Bp2msjP/Vq2wyzUESqkDcJbj4EBgtdj82/mWe+rvrtjjANjyR
# N7asGwmK4nbnqVbBwEnq79JrOv3Drvobl31OUcq3ypLs1nrvkaHENYAaLZFsQsXe
# /PfK3BzQZyJnIZ3amq0p5JzVZzeuDofFjLobTwTj8y33nML18876z302fSJjBl1W
# xKlO6/Rf8epjNQ1Wn+TXSc7dyoaJrl5ua0BjiwAwPRvrjwLvCeNmzsg5+mair+28
# erccUHHihZ1clGAIs0kTveB2Lav5kuqUM3HGGFOyXq7vZLLF
# SIG # End signature block

0 comments on commit 7fe117c

Please sign in to comment.