June 23, 2024, 7:12 p.m. | /u/Dry_Crazy_7570

Computer Forensics www.reddit.com

I have been working to parse out the MFT entries using the seek() and read() functions, but after locating the NTFS Volume Boot Block and finding the long long value which represents the location of the first entry of the table ("C00000" in little endian), I could find the first entry after adding in the offset the NTFS Volume Boot Block.

I loaded my image into FTKImager and navigated to my calculated location and was able to find the first …

block boot computerforensics entry find functions location mft ntfs python python 3 using value working

Senior Analyst, Corporate Security

@ Toast | Bengaluru, Karnataka, India

Senior Product Manager

@ Microsoft | Bengaluru, Karnataka, India

VP, Product Marketing

@ Proofpoint | Sunnyvale, CA

Senior Sales Engineer - NYC

@ Juniper Networks | New York City, United States

Sr. Analyst | Onsite, Bangalore.

@ Optiv | Bengaluru

Senior Data Analyst (ArcSight)

@ Capgemini | Washington, DC, District of Columbia, United States