MFT 解析器在线 MFT 查看器与 $MFT 分析工具

# Elevated PowerShell: copies the live C:\$MFT to C:\triage\$MFT by reading the raw volume.
$drive = 'C:'; $dst = 'C:\triage\$MFT'
New-Item -ItemType Directory -Force -Path (Split-Path $dst) | Out-Null
if (-not ('Raw.Vol' -as [type])) { Add-Type -Namespace Raw -Name Vol -MemberDefinition '[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)] public static extern Microsoft.Win32.SafeHandles.SafeFileHandle CreateFile(string name, uint access, uint share, IntPtr sa, uint disposition, uint flags, IntPtr template);' }
$h = [Raw.Vol]::CreateFile("\\.\$drive", 2147483648, 3, [IntPtr]::Zero, 3, 0, [IntPtr]::Zero)
if ($h.IsInvalid) { throw "Cannot open \\.\$drive - run PowerShell as administrator" }
$vol = New-Object IO.FileStream($h, [IO.FileAccess]::Read)
function Read-At([long]$pos, [int]$len) { $b = New-Object byte[] $len; [void]$vol.Seek($pos, 'Begin'); $got = 0; while ($got -lt $len) { $n = $vol.Read($b, $got, $len - $got); if ($n -le 0) { throw 'Short read' }; $got += $n }; , $b }
$boot = Read-At 0 4096
$bps = [BitConverter]::ToUInt16($boot, 11); $spc = [int]$boot[13]; if ($spc -gt 128) { $spc = 1 -shl (256 - $spc) }
$cs = [long]$bps * $spc; $c = [int]$boot[64]; $rs = if ($c -gt 127) { 1 -shl (256 - $c) } else { $c * $cs }
$rec = Read-At ([BitConverter]::ToInt64($boot, 48) * $cs) ([math]::Max($rs, 4096))
$uo = [BitConverter]::ToUInt16($rec, 4)
for ($i = 1; $i -lt [BitConverter]::ToUInt16($rec, 6); $i++) { $rec[$i * 512 - 2] = $rec[$uo + 2 * $i]; $rec[$i * 512 - 1] = $rec[$uo + 2 * $i + 1] }
$a = [int][BitConverter]::ToUInt16($rec, 20)
while ($true) { $t = [BitConverter]::ToUInt32($rec, $a); if ($t -eq [uint32]::MaxValue) { throw 'No $DATA in record 0' }; if ($t -eq 0x80 -and $rec[$a + 9] -eq 0) { break }; $a += [int][BitConverter]::ToUInt32($rec, $a + 4) }
$size = [BitConverter]::ToInt64($rec, $a + 48); $p = $a + [BitConverter]::ToUInt16($rec, $a + 32)
$out = [IO.File]::Create($dst); $buf = New-Object byte[] 4MB; $lcn = [long]0
while ($rec[$p] -ne 0) {
  $ln = $rec[$p] -band 15; $lo = $rec[$p] -shr 4; $len = [long]0; $d = [long]0
  for ($i = $ln; $i -ge 1; $i--) { $len = $len * 256 + $rec[$p + $i] }
  for ($i = $ln + $lo; $i -gt $ln; $i--) { $d = $d * 256 + $rec[$p + $i] }
  if ($lo -gt 0 -and $rec[$p + $ln + $lo] -ge 128) { $d -= [long]1 -shl (8 * $lo) }
  $lcn += $d; $p += 1 + $ln + $lo; $left = $len * $cs; [void]$vol.Seek($lcn * $cs, 'Begin')
  while ($left -gt 0) { $n = $vol.Read($buf, 0, [int][math]::Min($left, $buf.Length)); if ($n -le 0) { throw 'Short read' }; $out.Write($buf, 0, $n); $left -= $n }
}
$out.SetLength($size); $out.Close(); $vol.Close()
Get-FileHash -Algorithm SHA256 $dst