analyzeMFT icon indicating copy to clipboard operation
analyzeMFT copied to clipboard

List the modified files, sorted by modification date

Open Thorsten-Sick opened this issue 12 years ago • 1 comments

Hi

This commit adds a feature to list files by modification date. I want to use it for forensics of malware infected VMs. When the infection just happened. (See cuckoosandbox.org)

Thanks Thorsten Sick

Thorsten-Sick avatar Aug 29 '13 09:08 Thorsten-Sick

Thorsten,

My original thinking was to leave this sort of work to Excel, sort, and other external tools. Is there some reason for building this functionality into analyzeMFT rather than leaving it to an external tool?

-David

dkovar avatar Aug 29 '13 17:08 dkovar