Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
kacos2000 authored Jan 8, 2021
1 parent 8c8320b commit dbf9e07
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
- Clicking on any detail of the record, shows the source of the detail in the Hex view grid.
- All timestamps are in UTC

Note: Opening large MFT records might take a lot of time *(possibly hour(s))*, as it needs to map each child record to it's parent, and as the structure grows, the time needed to search is grown exponentially. A few small test $MFT files to play with can be found [here](https://github.com/EricZimmerman/MFT/tree/3bed2626ee85e9a96a6db70a17407d0c3696056a/MFT.Test/TestFiles) and [here](https://github.com/msuhanov/dfir_ntfs/tree/master/test_data)
Note: Opening large MFT files might take a lot of time *(possibly hour(s))*, as it needs to map each child record to it's parent, and as the structure grows, the time needed to search is grown exponentially. A few small test $MFT files to play with can be found [here](https://github.com/EricZimmerman/MFT/tree/3bed2626ee85e9a96a6db70a17407d0c3696056a/MFT.Test/TestFiles) and [here](https://github.com/msuhanov/dfir_ntfs/tree/master/test_data)

*Based on [$MFT Record Viewer](https://github.com/kacos2000/MFT_Record_Viewer)*

Expand Down

0 comments on commit dbf9e07

Please sign in to comment.