diff --git a/MFTbrowser.ps1 b/MFTbrowser.ps1 index 1677db3..4553643 100644 --- a/MFTbrowser.ps1 +++ b/MFTbrowser.ps1 @@ -3,7 +3,7 @@ .NOTES -------------------------------------------------------------------------------- Code generated by: SAPIEN Technologies, Inc., PowerShell Studio 2020 v5.7.182 - Generated on: 10/1/2021 + Generated on: 11/1/2021 Generated by: Costas Katsavounidis -------------------------------------------------------------------------------- .DESCRIPTION @@ -262,7 +262,7 @@ function Show-MainForm_psf $NewRecordRange.Enabled = $false # Hide Treeview & Datagridview etc - $picturebox1.Visible = $true + $picturebox1.Visible = $false $treeview1.Visible = $false $datagridview1.Visible = $false $richtextbox1.Visible = $false @@ -923,28 +923,28 @@ Should match the 'File reference number' in fsutil" $1concreb = [System.Text.Encoding]::getencoding(28591).GetBytes($1concre) [array]::reverse($1concreb) $1concrebh = [System.BitConverter]::ToString($1concreb) -replace '-', '' - $File_create1 = [datetime]::FromFileTimeUtc("0x$($1concrebh)") + $File_create1 = [datetime]::FromFileTimeUtc("0x$($1concrebh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Modified time $1conmod = $data.Substring($Attributeoffset + $contentoffset + 8, 8) $1conmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($1conmod) [array]::reverse($1conmodb) $1conmodbh = [System.BitConverter]::ToString($1conmodb) -replace '-', '' - $File_mod1 = [datetime]::FromFileTimeUtc("0x$($1conmodbh)") + $File_mod1 = [datetime]::FromFileTimeUtc("0x$($1conmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File MFT Modified time $1conmftmod = $data.Substring($Attributeoffset + $contentoffset + 16, 8) $1conmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($1conmftmod) [array]::reverse($1conmftmodb) $1conmftmodbh = [System.BitConverter]::ToString($1conmftmodb) -replace '-', '' - $File_mftmod1 = [datetime]::FromFileTimeUtc("0x$($1conmftmodbh)") + $File_mftmod1 = [datetime]::FromFileTimeUtc("0x$($1conmftmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Last Accessed time $1conla = $data.Substring($Attributeoffset + $contentoffset + 24, 8) $1conlab = [System.Text.Encoding]::getencoding(28591).GetBytes($1conla) [array]::reverse($1conlab) $1conlabh = [System.BitConverter]::ToString($1conlab) -replace '-', '' - $File_lastaccess1 = [datetime]::FromFileTimeUtc("0x$($1conlabh)") + $File_lastaccess1 = [datetime]::FromFileTimeUtc("0x$($1conlabh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Type Flags $1confl = $data.Substring($Attributeoffset + $contentoffset + 32, 4) @@ -1299,28 +1299,28 @@ Name: (Variable)" $2concreb = [System.Text.Encoding]::getencoding(28591).GetBytes($2concre) [array]::reverse($2concreb) $2concrebh = [System.BitConverter]::ToString($2concreb) -replace '-', '' - $File_create = [datetime]::FromFileTimeUtc("0x$($2concrebh)") + $File_create = [datetime]::FromFileTimeUtc("0x$($2concrebh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Modified time $2conmod = $data.Substring($residentcontentoffset + 16, 8) $2conmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($2conmod) [array]::reverse($2conmodb) $2conmodbh = [System.BitConverter]::ToString($2conmodb) -replace '-', '' - $File_mod = [datetime]::FromFileTimeUtc("0x$($2conmodbh)") + $File_mod = [datetime]::FromFileTimeUtc("0x$($2conmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File MFT Modified time $2conmftmod = $data.Substring($residentcontentoffset + 24, 8) $2conmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($2conmftmod) [array]::reverse($2conmftmodb) $2conmftmodbh = [System.BitConverter]::ToString($2conmftmodb) -replace '-', '' - $File_mftmod = [datetime]::FromFileTimeUtc("0x$($2conmftmodbh)") + $File_mftmod = [datetime]::FromFileTimeUtc("0x$($2conmftmodbh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Last Accessed time $2conla = $data.Substring($residentcontentoffset + 32, 8) $2conlab = [System.Text.Encoding]::getencoding(28591).GetBytes($2conla) [array]::reverse($2conlab) $2conlabh = [System.BitConverter]::ToString($2conlab) -replace '-', '' - $File_lastaccess = [datetime]::FromFileTimeUtc("0x$($2conlabh)") + $File_lastaccess = [datetime]::FromFileTimeUtc("0x$($2conlabh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Type Flags $2confl = $data.Substring($residentcontentoffset + 56, 4) @@ -1543,7 +1543,7 @@ If the file is a Reparse Point, then the Reparse Field will give its type (repar $1582offset = (New-Object DateTime(1582, 10, 15, 0, 0, 0)).Ticks $1601offset = (New-Object DateTime(1601, 1, 1, 0, 0, 0)).Ticks # Calculate the Date after substracting the two Date offsets - $ObjectIdCreated = [datetime]::FromFileTimeUtc($timedec - ($1601offset - $1582offset)) + $ObjectIdCreated = [datetime]::FromFileTimeUtc($timedec - ($1601offset - $1582offset)).ToString("dd/MM/yyyy HH:mm:ss.fffffff") # Add to tree $Null = $objectNode.Nodes.Add("GUIDcreated", "GUID created at: $($ObjectIdCreated)") @@ -2014,8 +2014,8 @@ The object ID is assigned at file creation time." $winformatversion = [Convert]::TouInt16($winformvh, 16) # Add to tree - $Null = $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes.Add("Winformatversion", "[0x$(($Attributeoffset + 24).tostring('X3'))] Win version used to format the volume: $($winformatversion)") - $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].Tag = @("$($Attributeoffset + 24)", "2") + $Null = $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes.Add("Winformatversion", "[0x$(($residentcontentoffset + 24).tostring('X3'))] Win version used to format the volume: $($winformatversion)") + $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].Tag = @("$($residentcontentoffset + 24)", "2") $ANodes.Nodes["($("Attribute" + $Attributeoffset))"].Nodes["Winformatversion"].ToolTipText = "Windows version used to format the source drive https://twitter.com/errno_fail/status/1258900141479809025?s=20 https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions" @@ -2271,28 +2271,28 @@ The object ID is assigned at file creation time." $idxconcreb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxconcre) [array]::reverse($idxconcreb) $idxconcreh = [System.BitConverter]::ToString($idxconcreb) -replace '-', '' - $Idx_File_create = [datetime]::FromFileTimeUtc("0x$($idxconcreh)") + $Idx_File_create = [datetime]::FromFileTimeUtc("0x$($idxconcreh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Modified time $idxmod = $data.Substring($firstoffset + 32, 8) $idxmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxmod) [array]::reverse($idxmodb) $idxmodh = [System.BitConverter]::ToString($idxmodb) -replace '-', '' - $Idx_File_mod = [datetime]::FromFileTimeUtc("0x$($idxmodh)") + $Idx_File_mod = [datetime]::FromFileTimeUtc("0x$($idxmodh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File MFT Modified time $idxmftmod = $data.Substring($firstoffset + 40, 8) $idxmftmodb = [System.Text.Encoding]::getencoding(28591).GetBytes($idxmftmod) [array]::reverse($idxmftmodb) $idxmftmodh = [System.BitConverter]::ToString($idxmftmodb) -replace '-', '' - $Idx_File_mftmod = [datetime]::FromFileTimeUtc("0x$($idxmftmodh)") + $Idx_File_mftmod = [datetime]::FromFileTimeUtc("0x$($idxmftmodh)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Last Accessed time $idxla = $data.Substring($firstoffset + 48, 8) $idxlab = [System.Text.Encoding]::getencoding(28591).GetBytes($idxla) [array]::reverse($idxlab) $idxlah = [System.BitConverter]::ToString($idxlab) -replace '-', '' - $Idx_File_lastaccess = [datetime]::FromFileTimeUtc("0x$($idxlah)") + $Idx_File_lastaccess = [datetime]::FromFileTimeUtc("0x$($idxlah)").ToString("dd/MM/yyyy HH:mm:ss.fffffff") # File Allocated Size $idxfszh = $data.Substring($firstoffset + 56, 8) @@ -10226,7 +10226,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAgAEAAAs=')) [void]$splitcontainer1.Panel1.Controls.Add($picturebox1) [void]$splitcontainer1.Panel2.Controls.Add($splitcontainer2) $splitcontainer1.Size = New-Object System.Drawing.Size(2390, 1441) - $splitcontainer1.SplitterDistance = 1109 + $splitcontainer1.SplitterDistance = 1106 $splitcontainer1.SplitterWidth = 6 $splitcontainer1.TabIndex = 3 $splitcontainer1.TabStop = $False @@ -10312,7 +10312,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL')) $treeview1.Margin = '28, 24, 28, 24' $treeview1.Name = 'treeview1' $treeview1.ShowNodeToolTips = $True - $treeview1.Size = New-Object System.Drawing.Size(1105, 1437) + $treeview1.Size = New-Object System.Drawing.Size(1102, 1437) $treeview1.TabIndex = 0 $treeview1.Visible = $False $treeview1.add_AfterSelect($treeview1_AfterSelect) @@ -10332,7 +10332,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL')) $richtextbox1.Name = 'richtextbox1' $richtextbox1.ReadOnly = $True $richtextbox1.ShowSelectionMargin = $True - $richtextbox1.Size = New-Object System.Drawing.Size(1271, 327) + $richtextbox1.Size = New-Object System.Drawing.Size(1274, 327) $richtextbox1.TabIndex = 0 $richtextbox1.Text = '' # @@ -10406,7 +10406,7 @@ dD+HD+5i324JOyQ++Hp7sWnjWtav8WCDp4c74D+XIPwBF8beaT1+/VgAAAAASUVORK5CYIIL')) $datagridview1.ShowCellErrors = $False $datagridview1.ShowEditingIcon = $False $datagridview1.ShowRowErrors = $False - $datagridview1.Size = New-Object System.Drawing.Size(1271, 1100) + $datagridview1.Size = New-Object System.Drawing.Size(1274, 1100) $datagridview1.TabIndex = 1 $datagridview1.Visible = $False $datagridview1.add_CellMouseEnter($datagridview1_CellMouseEnter) @@ -14036,7 +14036,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAgAEAAAs=')) [void]$splitcontainer2.Panel1.Controls.Add($toolstrip1) [void]$splitcontainer2.Panel1.Controls.Add($richtextbox1) [void]$splitcontainer2.Panel2.Controls.Add($datagridview1) - $splitcontainer2.Size = New-Object System.Drawing.Size(1275, 1441) + $splitcontainer2.Size = New-Object System.Drawing.Size(1278, 1441) $splitcontainer2.SplitterDistance = 331 $splitcontainer2.SplitterWidth = 6 $splitcontainer2.TabIndex = 3 @@ -14388,7 +14388,7 @@ V3r+l7leIiAvDHlrTQXSM4H5tGn/AjkLWg2DRQjrAAAAAElFTkSuQmCCCw==')) AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAu MC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAA ACZTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkD -AAAADwMAAAAoCwAAAk1TRnQBSQFMAgEBBQEAASgBAAEoAQABEAEAARABAAT/AQkBAAj/AUIBTQE2 +AAAADwMAAAAoCwAAAk1TRnQBSQFMAgEBBQEAAUABAAFAAQABEAEAARABAAT/AQkBAAj/AUIBTQE2 AQQGAAE2AQQCAAEoAwABQAMAASADAAEBAQABCAYAAQgYAAGAAgABgAMAAoABAAGAAwABgAEAAYAB AAKAAgADwAEAAcAB3AHAAQAB8AHKAaYBAAEzBQABMwEAATMBAAEzAQACMwIAAxYBAAMcAQADIgEA AykBAANVAQADTQEAA0IBAAM5AQABgAF8Af8BAAJQAf8BAAGTAQAB1gEAAf8B7AHMAQABxgHWAe8B @@ -14555,11 +14555,10 @@ BwIAAfABBwL/AcABDwL/Af4BPws=')) $picturebox1.Location = New-Object System.Drawing.Point(0, 0) $picturebox1.Margin = '20, 20, 20, 20' $picturebox1.Name = 'picturebox1' - $picturebox1.Size = New-Object System.Drawing.Size(1105, 1437) + $picturebox1.Size = New-Object System.Drawing.Size(1102, 1437) $picturebox1.SizeMode = 'CenterImage' $picturebox1.TabIndex = 1 $picturebox1.TabStop = $False - $picturebox1.Visible = $False $contextmenustrip5.ResumeLayout() $toolstrip1.ResumeLayout() $splitcontainer2.ResumeLayout() @@ -18446,8 +18445,8 @@ Main ($CommandLine) # SIG # Begin signature block # MIIfcAYJKoZIhvcNAQcCoIIfYTCCH10CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG -# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAD/Ui+mAsKt2zf -# K3nRpywC92Jqhf6GYlLp8d6xSujjiaCCGf4wggQVMIIC/aADAgECAgsEAAAAAAEx +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD/2lxzXSfOX8MB +# iyBpQ4/tACSl//ChaNS9A9WTzlrooaCCGf4wggQVMIIC/aADAgECAgsEAAAAAAEx # icZQBDANBgkqhkiG9w0BAQsFADBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3Qg # Q0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2ln # bjAeFw0xMTA4MDIxMDAwMDBaFw0yOTAzMjkxMDAwMDBaMFsxCzAJBgNVBAYTAkJF @@ -18590,26 +18589,26 @@ Main ($CommandLine) # R3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9T # ZWN0aWdvIExpbWl0ZWQxJDAiBgNVBAMTG1NlY3RpZ28gUlNBIENvZGUgU2lnbmlu # ZyBDQQIRALjpohQ9sxfPAIfj9za0FgUwDQYJYIZIAWUDBAIBBQCgTDAZBgkqhkiG -# 9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgJ1lsiNL8vsJF8pf6 -# 1Ki1GEx2IJlytrQOxGpJX3s6wgUwDQYJKoZIhvcNAQEBBQAEggEAg+QNp0k4KmI8 -# qp616ATbW5P5VdsJr1oPfwoP2q0vZPv6+0Te/YIMy+8M2JVlcfWVyijTq2Tiq+VG -# mROQJ005Xw0PaVHQ3U6iANC6E3ktM+x8vZuLS7d7auypWV2eWfn/n+pT29yBDwyZ -# AyCYkZfwthRvP9Tq5J5AhcDJUVmpR7r4oyyI6OcW5N0M9jlItZMbw6FVafueRUl8 -# r2OEeUu5jkFyqp9Kp67YlNzKRGpr/REKl36XuaQIkb2mJiEjRPaYVzunZEK1uRCU -# zj2bsxvecs7XCgtOiZLEoUIJy71CMGGN9VkWMkLq4CqI4ULpWulGr3SMwlPphIcK -# 4mR2n7oXrqGCArkwggK1BgkqhkiG9w0BCQYxggKmMIICogIBATBrMFsxCzAJBgNV +# 9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgfn02ESlm7xyb5MlV +# XL6Z0PfBOP4CB3ZgurkU83l1LMAwDQYJKoZIhvcNAQEBBQAEggEABRI+A84L/BoA +# jFkk5Fk1g2s/2uCkkl7bU4lGreSlOHrrDl4bUkch9qbnvZttJ0qoajDPOD+9dPAz +# FTONHJZYLvqBKhLfbW2h1EUk3TRbbaUHmIOXR8z99JlzKt7UJlW8R+JL/TZYG7/e +# nWvwyj8WgZo1c307K++Fr3t6gl7WE8ObPfVmDH8Jo6qSqThxdVg4DPbEsIvRsRf8 +# RLp333isCo3IOr/n2FkTqQcBzwnWNeAoLul4CqJfRKXua3RnY8tX3iqQVpSWKCrV +# z1drqeVms+ifKmr8Yv/oDzYkiFQHlejP/V1WJwoUZ/FbSGOqtugjF9+Z87MdJJ4z +# dEgdVF+gVKGCArkwggK1BgkqhkiG9w0BCQYxggKmMIICogIBATBrMFsxCzAJBgNV # BAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTEwLwYDVQQDEyhHbG9i # YWxTaWduIFRpbWVzdGFtcGluZyBDQSAtIFNIQTI1NiAtIEcyAgwkVLh/HhRTrTf6 # oXgwDQYJYIZIAWUDBAIBBQCgggEMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw -# HAYJKoZIhvcNAQkFMQ8XDTIxMDExMDIxNTYyMFowLwYJKoZIhvcNAQkEMSIEID6q -# buW4+X0Ra84jgOeTOdD4BuHYe3g/cVj8Wj7WXPngMIGgBgsqhkiG9w0BCRACDDGB +# HAYJKoZIhvcNAQkFMQ8XDTIxMDExMTE0MzkxNVowLwYJKoZIhvcNAQkEMSIEIG82 +# 9GKWtChEFr7k80zQ/R3W/lImi8l8uslk4ocbW/3gMIGgBgsqhkiG9w0BCRACDDGB # kDCBjTCBijCBhwQUPsdm1dTUcuIbHyFDUhwxt5DZS2gwbzBfpF0wWzELMAkGA1UE # BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExMTAvBgNVBAMTKEdsb2Jh # bFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMjU2IC0gRzICDCRUuH8eFFOtN/qh -# eDANBgkqhkiG9w0BAQEFAASCAQBlA2drj1yzU6VCcZzsO7vsozYMY1CyrZRh0q54 -# TiqF1RCrjmEFUOwt3jLl3/SlE1/hHQFrt4wLqQyKlBZsaXeYEdExXTc8Zm6tzU3L -# sosrfrTbBfadHiVio3yUT8dGtFWMmUj6IMLBdL8NJvcOTNF4AGe0WvPuuKId4HLy -# PJ5wijdFuzlP+9U1YBDTSrLeX6OBPbJno4juZdIRRA2j3QbtVKVX8IZbbAEqI8ef -# LEWqvbzsK4yIH2FMNkMzrSGUelMFiE73ReDcP7FNXVhdSDP7rS7dO2spjmUeTSiW -# ljDnkl83uUn98HIaqaKt3uwDD63H57BSUlCnDbHdFQKIAbt8 +# eDANBgkqhkiG9w0BAQEFAASCAQAhDZl2Nq6iQTelKGMQF2jbOByLR41M0KFW+rCV +# P0G8jm5EwadeEb1Bp2msjP/Vq2wyzUESqkDcJbj4EBgtdj82/mWe+rvrtjjANjyR +# N7asGwmK4nbnqVbBwEnq79JrOv3Drvobl31OUcq3ypLs1nrvkaHENYAaLZFsQsXe +# /PfK3BzQZyJnIZ3amq0p5JzVZzeuDofFjLobTwTj8y33nML18876z302fSJjBl1W +# xKlO6/Rf8epjNQ1Wn+TXSc7dyoaJrl5ua0BjiwAwPRvrjwLvCeNmzsg5+mair+28 +# erccUHHihZ1clGAIs0kTveB2Lav5kuqUM3HGGFOyXq7vZLLF # SIG # End signature block