analyzeMFT-2.0.4-lp151.2.1 >  A [f/=„)CEZEg_CFfD;KaguU9uRjK)ϧ!geG:B\MX 0]1LF "CDZEmGՑ`f+˞f-j>z|;H1La*30e;ٳFrM&_R (=T5㱩<өV* ׆dU`!ɝAcb8f1483aa680f05c353dca48d3c0b162795b07b979ab9a1070f459114e6739a1ef535f2ab1beea3194679ed18489a844a3d7dc1c[f/=„vƳ-_s~Z%t` #ևwGJ߂bcu-; 훚۵cMh@H 888R*; DY3,I(3pW$h:$7H/uEowGIo ^cezΠ1V4~iηN$ɼ%7̘e=_>60:֦IFJ >ʉK'ebn }juxa ^!,wvF>p>?d   U "?djt   L    0 x  , P   T(w89:FGHHIXY\]^bcTdefluvwxxy z4DHNCanalyzeMFT2.0.4lp151.2.1A Python tool to deconstruct the Windows NTFS $MFT fileanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output: Record Number Good - if the entry is valid Active - if the entry is active Record type - the type of record Record Sequence - the sequence number for the record Parent Folder Record Number Parent Folder Sequence Number For the standard information attribute: Creation date Modification date Access date Entry date For up to four file name records: File name Creation date Modification date Access date Entry date Object ID Birth Volume ID Birth Object ID Birth Domain ID And flags to show if each of the following attributes is present: Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility Stream Notes/Log - Field used to log any significant events or observations relating to this record std-fn-shift - Populated if anomaly detection is turned on. Y/N. Y indicates that the FN create date is later than the STD create date. usec-zero - Populated if anomaly detection is turned on. Y/N. Y indicates that the STD create date's microsecond value is zero. For each entry in the MFT a record is written to an output file in CSV format. Major contributions from Matt Sabourin.[[lamb14:openSUSE Leap 15.1openSUSECPL-1.0https://bugs.opensuse.orgDevelopment/Libraries/Pythonhttps://github.com/dkovar/analyzeMFTlinuxnoarch(#Y j G:A@큤AAA큤[Z[Z[ZQ 2[ZQ 2[ZQ 2[ZQ 2[Z[ZQ 2[Z[[Q 2Q 2Q 2bcdb0a30967c30bdf8baea14751c546f83c1a1f2652e1ce893b3fb8ed3dcb1376c60e760bf0aa2fa95116e1ca6ff31cb5908bcb52a658e9173b92aebce3a9290feb17b1e877c6ee56bf4abb594a6e1365fe592ccb5dfc572549e3ee7362c725dfe38d0cc25c3a6b5e84842f4d4531d28772273c1dc8b57afe3411270ba0204280f2baa6e76c90275dc690b3f8965a4dec4d5bb96991d022d190f76c5eec231b4a86f4ed4debc452bf790fea92008fd1d9fe7bc483410bf8a6d223aa1dc7963c5c0f4ca41b4049c5a5899ce7414564e83043e589de9c56d0c8bd224180d7954d79efb89ae4106e04e75272cee46ad67176efa97f46c0bac56d9dce1f7acd8f3c5c6573f13006dcda9cabc0ba752302b9a612f890bdb6b601c0031635c1414540f95b2f8a3d5e36383ae8cd37cc2f383d27feedc54af20ef95bb3d129c5655470ce3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b85548fac24fdb662b9a80131c5c41f5f80821b1c086168ff07bf1888ba443b7fc6db9b28423a3466b33c1cec275e9d1e0cc1a5129784efb7b8e56afc2eea52bdc427c81ca76a34d495138691247751b1fd805f82c9a15b5766983ba4586dc3a9ee6f50403ed24612ade85e1a5bbdc307c455390915e055b40627c76de4d3e3c6593rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootanalyzeMFT-2.0.4-lp151.2.1.src.rpmanalyzeMFT@@    /usr/bin/pythonpythonpython(abi)python-tkrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)2.73.0.4-14.6.0-14.0-15.2-14.14.1TO?Greg.Freemyer@gmail.comGreg.Freemyer@gmail.com- update to v2.0.4 * converted to a module * setup for pypi - updated Url and Source fields - use newly available python setup.py install - updated %files section since this is now a more traditional python package- initial package submission A Python tool to deconstruct the Windows NTFS $MFT filelamb14 1528404059 2.0.4-lp151.2.1analyzeMFT.pyanalyzeMFT-2.0.4-py2.7.egg-infoanalyzemft__init__.py__init__.pycmft.pymft.pycmftsession.pymftsession.pycmftutils.pymftutils.pyctest__init__.py__init__.pycanalyzeMFTCHANGES.txtLICENSE.txtREADME.txt/usr/bin//usr/lib/python2.7/site-packages//usr/lib/python2.7/site-packages/analyzemft//usr/lib/python2.7/site-packages/analyzemft/test//usr/share/doc/packages//usr/share/doc/packages/analyzeMFT/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Leap:15.1/standard/6ee09f76b74f6a85334a98098a6cd175-analyzeMFTcpioxz5noarch-suse-linuxPython script, ASCII text executableASCII textdirectorypython 2.7 byte-compiledempty RRRRRRRRRRR+<с)N؆Sutf-80a6b26cc51edcd70edbd1d687a080cb6ac67d4793ab7590d655dd6a37a29d386? 7zXZ !t/FI0] crv9uҶj\?Dl&Vj*'[%gPxr&Z C6rUԍ\e ks[ ń5n[vӉf!3#H|f#>f e;3!U5o-G%Ư◬{'~&Z̭$(|SݜJeço>qy$KY̍7 $NhfXonEN1̖WVn"ܪ;'!lDJ\uf)\24>' clwaD:WU Z jp:)~?/'m̪QݏqDu0 ֙ȣQM 5D4FF*chE-K>$D.X؟õaRomzvЏy YJoĦ6?{ w,zEMcI$ @*EO-)F qSPOF ^5,r#噘lFi1J$L[T*{49jy1Jro!J'\}aE~AA> AVrB` kWM+$PMGXX%,ʌ!}"T5f'n7B(v4JղO4 P\~;k6#>PNC LVFOT>覎'%JK|؅逷dW"N?n@}e_g9DN)䔸<^(L(_;ک)45L#ŷ5b0J.ө)v0P"b|nvt-k]kFb;4*k&g*6mJ+qɂޞE~rjiYp!fl1}|*v̋Vge5@(4J8}?aEJeJp$O5gpmJ4 k f}-1NyN{֎ҹxU@E `V[0C} ׄݕQ8Dͦň2F$.9Ps!UA*fg=Z0*2{B+Aٌ#@ҜEal@.sTg=6)77$']hHVND_Pr+$nW[*xTH:ϙ:IlPs*hR9gQL83/o g՝x%E:%GѦ¬]8!o^&~76o;b 5 vG0|:|d cPsы |) *|>2S]]!֜kpgP=G (NY"%5tHH=u_ j@b7R@9?5"= P1{/}s9e++ŷYi}x.0v!p1HY:}B}Ha'/\abeԐW=X,޵Tl uv긛N܃ʒh*S $Kg>p[!G"X>88Ph!>\:2b!pdafs_#%A`e }Xtds)| ^Aѣ]3USZk O0J6rWbo+N=1K>ۄ0׾̲T K 0xYq={h^,wP!ܤ.' 7-:m B+ @mtrW~y=Ȯgbϭ>+/` 1=`$?@LEp4)tAic4u#5o(UpmW_f,#:v܁Gvd"{[`hPC]\K1j،ЉN`b4қR{D微T(s<%P*@S=E! 89oB6v#@zұb^B2N5Fs&N$f ǐpC+vG3 CObA PQ4j`,ʠ*]e~/5i*Y 4\cͭ|F.߫uLνC.=NoQjY!ۄL90h*| :;=fvtδ{zP$妧Niy!{!=?YSˣU~VrOsY;ͨBՊ%KB0m|()+Gux_ EZE8NP\8fEfפ/nq1iLAraMF^Ο zO䏩*[@pQ*pѰ,))qJ}w8N9̂c-})H3d!N,uDldVK-DL`vĄ'qt' 7qwMC46x??Ѐo6++y$vZA+&"A83adT]x¥X:Zҙ5@U]Z<9*$/ @T Ohx|j)! vѽÍh&L9?j83_̋xb vH# :r_ժoY%$*ZL|oPi//] hj~wΪV2 u"ANFbJvR: hdYяcE|S-/Չ秂 N} b0,9M̖&erDr{mqggU}_y}3In5\ ے D oIH}һDx6ZAKQ GDʸޘ qD!%n?P&mSpHbhD)BZPUQD?WQc`^CKE#Lqylbn3,LM/I?(}`5^lFɂ)o'|'[S 6яk˱oZ(Ϡ4> NVhĔ G(Xkd~qD!#+ӫ8%i,0؅挽B7i19, p u ׁ@S8c1yr)n<!H׎'X̅$ [|?QT+mB)%{le-Tr БYaiݗxJP^7t)F#9wZ@k3gݜi6Dt縿~c{?Πxk/^,IJxV;! \wS>> 7{*-j՘G1QɝzΦ [=o-Z}IT"v&MS(y}+A2 ߿a>*?zX8Sdm+RF}b_zgW*A7:ICx*T`-c!OrNc$c!aHcރ[f׵F @J>)Ttz4a G_"l(z-/̏YFɕ  G[AO"y וCXBHR܉m@/Xs1R@WZ6UR歾Tkwjc}]9*cMTPȭuu@@1Լؕy`Xva;bdFz`&&N`C|l1I2JWf@"<%ר'o$F>2WG7N(z+-Z҇Րnq_hy3i; 9$$,\ypy#}6'r0Q3 P~o [,,u`2NO.5n">^Ș𓄿L,p2r&᭢OxTk*$ νiɄOܢVjKx t+i ゲ5%bP:b[aN 6+^,@y9Wcǀ}bw%J>N?Ed4| '*d/.nF6=Zի-}S.ܮc6=kj#I3eA7ؐք Ќ4>3NW$䔎cX}'ؓ~Bꉉyh[b-ZL<~Zbzy঴bjS{5D'\x CvԦD&(r=Z87F5 (%\נ ҏSK-fb`yߩG_ Vԣ ?d^O܈_D31?#Q=b}G @hqYnRQNӢq>^Ęy[>kBCh,ZgE,B%̟XW.7/cMb㱦Y%*'4˕z,)61BWd⩡3d@ /Ig ɻM3'YF QHVt^?e <|d?zRg4CkC"q LL! ?=%Q5ݕhgڤNwDR2 _5Y\_Lqn͖0 ,3Hrl/r~&u 0㘾5lT3\jEM+Ba!ytm0eGrG׷uDkU{ zNsO?/t#z od6+ulѧ& ېP')Tq!Uj]u:cp$$X36"pZMb1rYWk<EoHiy`K)X@Up 쒺`3!/kMV .S v`M ٣4bO1xdnZg~'}r@shmɽ6SKz--/b^e!u桂^jr m' 4~Q/u(n S,z[_orM0P,B> `ܰ8 5Y0 w& C ӕn<_\"!}vԄr]n'Yhp v1z}J2 nckC 4[ ^ z&1[4KK`j 6VnÂ߃mRϯ5 |C DIF& l:ė$w?f(قTH[wPBtZw( Čl>6: `$Jꦀϱ܈ -\vz/bmB`Y- @aG?mL)* +C 2 9|o;?Mߨ7GZ1̫U rA ɲCLݼ|'I2 A%{Kn۹/#_ F&=Xo7Yž&JxQ VvFrgJ+A2=!c"_ #B'/U<-bR C'ʿ(WZP L=cHCh$&myRig tvBt_y7v*jM\~O  yɂU\tYj|;VGwΉӊ BݪaU":!E$;%`$q ~5D.vK`uk},Ҧ]q,XrI46,73F.K,y]h>zOurPpK,=V=")}KD13= 8ZbO*O7q)}H"3ET>@>꣚A7:aŒ-hyYvOF!@TU~.3GBfX>pF6XQ'@V9JS#BKFA;N}3~A&3(M; T7ly(w5˄Pݱtn&3`%OM)"o7,Kl[u L;(̘\# bܱ#m_tCmmEqJ, a|],:5'10IFUWCKT44O^ i~^3EEXBQ_M`'ٌZ. <ȥtp L23c]t_\59y}3["5_ֽ.,cճ&Ax( ~f {ÄVV?LY&9[ty4*L(-.2x1$W0eU_2u<IExHP}rgwޑ91b~ip@;/)I.:D+Wm-YD+=`urD?5f^>a+i%nZDWgM4$bdS]]i8_cJ3&$f˦t]Ez)k,`]'t|U/r`+XLC%sl-B+\ߚ#_]s.e*Vëҳ]Vh4plX rˇÎ:/&׺$÷q]= rKC}teQ8; >JYE؜;HuD=cRwzvYxG4SEo ;hV4b#b,w2>Y`˧rNHmߏ];h+JWPi0!'Cp @э$pG .$ƤbGBLz8>*b8 E33'& oˤ|guJtvTwVq3PN(x ၟjuH3R ®ɸݠ:_xIES^fT睊IQL g% )ϴe11'^S92IpD޹bɮ/ lx2h(ipZ7)r4^y2Fl]"ϷTrd[axA\P6M)ih x0q&]R |7RrWO #Pjuo4l팄iu $g499vU'|u~Πzi8$vlNA& %ъr1c{q1S+-m汪|z"g6u*g]+ẁې-]8FOՁ"ޞDvN3Γ+= 1!";r[宇[PRXOF7iEĸ#af[/4͘imE:x_|{$1܀[@+P9C!^n^|q|'a91&.jibȉ`g$mqc8g޸p?I ]im튦05NMLF)tlYξ:WN1N$@^P7orUGDŁüIgR" xbܷg͒pTH!_.ZO&=act=&xПxOj uRM|h3ZMCnWe`&]_xZLL Z/* Y\&PfyVp;D%ֺ YaЫtQۚkL}_˼W?f)%kUݩk2HCmơJXYl^$߆ɪ댿U@P=2ά-:µ,bT=λB.~ S 23M6ϒZU pZI!.إO B5J?ǽdpp.ǂ* UPVҽMbŠ<Ňp$!v6 ZK\˥%LbE z!ఃE.PL<Nm7:hJ!&س<゙=wZ.*dan] ھ"kH$zstbFjA֬n3@Dԅ8A՘؄PY Q 'YN=2f/_8_^"s\S8ES7|JabIs*,ٜ ͢m4d>{^,j[T7eWܗތ;8fς ;p|rʽ nϛf&/$;o3-h)'rM9XcBI&q{KV@pcJ#;^X`Xu&LZ{c2rdڽD:f$v[z3l2&o:lhgoށ~JzݏMC٬:Z!Xj4E,W.o} jnPZ4t"1V6qD1AGUX&5L3ȦLã ޮ GQ}p/c("'VZz S"A؁א3eEE\N-\dF\F~VIIDM|ׂjz1ȎqqXibh^Nn!{_+ 4-8J*3@NcN uBd0-֣)PI϶T4l:7&t|m{c b(/cAsho\}.sz~Hg#aI6dH [:%M%jA3>KZL'&hƛnDޢt;ٸWzvdO R)>\DIBew$mx*FL9Ys3S}G& ʴΕk i;PnDw R3W!@sX2!^«q>›HRJkd $մ leV5q0Y.ى GhΐfsCzAem-._@9ejږ Sڞ:e0 Rs5Bgqt SmF5.''AL,CM_<=43 Vj{n1 D?њ,hUl1`[[PO=6vfR,t2CVܝc~CЪUR:ҁZ,LiLSq7*c溋AjP}x% ׂ >!O('(67As׬| 6k_o~uHzvzRI&sIZ>gζ.V][?wu~k*NƒWHɁfCzX0Eku@Ps@0ns{$u(1_럓Դ+bS MF/o2c-f4+}V;#J%ܐ4j44%}3 'q̊2FDRO) l<{yyOZ$bd2 \h(~8ahR`|h='ģ>Ҿ-M ]V>,o;D'{q7Yy9&dR3#/6.mAH +=V=pL'Jw}A:*h`pЈg[@"yroO#kxOiJ*>C1_Nj-t:\iS!=yoUMh#jI mM{Mκf&Ĩqq]j vY־eb0F}@]ޒTqjB]B4 I1*iyaB(2,,mW܋b#vd;^k5Tch\'ߏ\ 9\rmijdO1Gnճ.ܾn&[*P U1;%jVDd\}$ Mn%pUhT\\ҭ0Tͻ$)]Hb/&hBA=Һk#-N.RfPw:wl)NZ̗b4.[m9.N|4< ?$mB4,E@+gOUSК,R'wq Hf({o.ɳ=tZSv \Kh4o6&;c{xg$I~ۃJ,}UGuke4E=g=GkÀ#=pٵk/"nYN-d+)cqϨ EǡZBbF 'se b27o sxu-AeD< #jj'!9g}6mKӞ `,RU'ٵGtNWC3=Z|rGRGtHppƀrKTs_@خْv9|!+q>.}-@h^X+7QhUʂ4MEUI٨皏6:l[m`(؂:7hyVF"Yc,5~^zSdsUHؠMseHb2 K)bo7:׹yŕO6l7P?b;[+66Q=`}LVuv kTKdh 䏐{o^(cj$ \Ydli {84r1ƘW!r.r~CW zyo&Dj"n="S]JoiAOK)z#@&XÔa9X%SvK{0IF͗l5_':-P B5R%s%ljT-]'Cvz{ Z/Oi.{*@N7t ߐ{GpA3OLadYik Yfˇ̪X5y-&V~-a-O3.Űm8YHM=z3KI\\&\{I?^~"Mj򜣗ya9E~c=z摵7f-r !"W2U4YJ&@w“Ɯ;~xҔdFD`ѓ.AfYt~P3vB laݒopUt?z\mw:3_N3_x?ZOg^>z֭k&|Vz\KN&H#RU'.PJƮT6fL\5x+*aJC17ke\@<_e`2A.s ;$7PLvQ"jɄ`'v|DUg߅m,.yDeіrIaAE ;NWsKQastiu(+Q=%o+r6Azخp6=<*_0fz0-E>s[m 酻G7 2vQGGMrNg.w*v*;($ug%l*Ű/kŸ(q}mUZds"8q86ǻZO^2*N(ܫ{ݙXLA I? a(Uq!tⰘc` c8AFO*ò$(D2 w֗~H ] f0[G4\<3g#@[cs;}{dp^TA = `&E@}AdJ$_:A@`"H9+LuZ_>eؕZޑY XdT>~ 2Jȶ$1fS +Tne%<' y#(0Fl-m2e71 H-;I[y0f[>%4)sW(Q]Vg>C~1KtPI_no86=2Ť |pg޼6J4t,t72KöLxZn&Mn_0!j̭"9xZ$l&ۖqA vB~}8N=(wjk߿cbX/]QerwGc, JZ~۫t7914K󻁆$ܖ9f%9$4RXtƑɳ(OcO'?9ܭL3[l|F>@“U. "EǬOU&:Ꝉ0\NMe2K5Y>xl3~U[LC_n,]SE+m5 M8CWQj>s!kZGȀlRDu^y୩Y&;k~p+ͱ$($cD ܑ4~=RL~^׉X&LWԊFs6Sm["ƿYᖸPT Ve pPGԛq¨WJ%2*jBzwh5j4S:Ma56_N9‰PRB+E(e O6@7K_j&QOv"Nk)r "fA 'W(iɞ~J6 XEy'yʘ?v c]% |6:2ErThf ¯]_Y"LՖ k8x?vD\&..]#%LZjZwYDpEm4Tc,O=$Ɲˀ(q{v&c\N W*903p&ѭSϽ[nV @թ#ts6+] EF Y_>z4{3nX:}rci m~HI|A΋[^=#@)!y㬞1//ٙ]v.+"7 Kn奄~®NtnB^}\l2M9tl})^N`D;vDQƞM};r%q;B~' N YZ