_README.txt for mftparser
Gary C. Kessler, 6/7/2012
gck@garykessler.net


MFTPARSER
=========

mftparser is an NTFS Master File Table parser. The input is a file containing the contents of one or more MFT records, each of which is 1,024 bytes in length.

Program usage: mftparser [-i input_file] [-v] [-f first_MFT] [-l last_MFT]
               mftparser {[-h] | [-t]}

 where: -i is the input file name
        -f is the first MFT_record to display (counting starts at 0)
        -l is the last MFT_record to display (-1 or blank "to the end")
        -h prints this help file
        -t displays the MFT template
        -v (verbose) displays the entire MFT record in hex

If no -i switch is provided, the program will ask for the input file name.

Examples
--------

To parse MFT records in a file named MFT, use:

     mftparser -i MFT

To parse a set of MFT records in a file named MFT and display a hex dump of the records, use:

     mftparser -i MBR -v

To display the MFT record template, use:

     mftparser -t


