analyzeMFT-2.0.4-lp152.3.3 >  A ^[/=„׫r,@;rZKL({"Ga{* L! "2>#dGx^'OT|qf'ubik>F+^ ު> PE*ނwq ﬊dkhɀ0̏8A] ]>HmȋSڢ .j?WSp߁z&Vha3%D6RE /h6'JĦ `GTջ-@b>[Jvh3\&A>I؄/c*"ۊ(EjXz&-}4S0aacbad8513a9a0d6557fea2ad2a90d8e78e55f2e902d4d85c685347f44c1fe1acdd49862602cfe419a27f7238afed010878539cc^[/=„<h`.NH PfxM@F4sb#C5^ <쉋"]d%Ǧ`ֲ0eak| >TF״Kn^ad}V7c~lQMp>?d   U "?djt   L    0 x  , P   T(w89:FGHHIXY\]^bcTdefluvwxxy z4DHNCanalyzeMFT2.0.4lp152.3.3A Python tool to deconstruct the Windows NTFS $MFT fileanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output: Record Number Good - if the entry is valid Active - if the entry is active Record type - the type of record Record Sequence - the sequence number for the record Parent Folder Record Number Parent Folder Sequence Number For the standard information attribute: Creation date Modification date Access date Entry date For up to four file name records: File name Creation date Modification date Access date Entry date Object ID Birth Volume ID Birth Object ID Birth Domain ID And flags to show if each of the following attributes is present: Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility Stream Notes/Log - Field used to log any significant events or observations relating to this record std-fn-shift - Populated if anomaly detection is turned on. Y/N. Y indicates that the FN create date is later than the STD create date. usec-zero - Populated if anomaly detection is turned on. Y/N. Y indicates that the STD create date's microsecond value is zero. For each entry in the MFT a record is written to an output file in CSV format. Major contributions from Matt Sabourin.^[lamb02:openSUSE Leap 15.2openSUSECPL-1.0https://bugs.opensuse.orgDevelopment/Libraries/Pythonhttps://github.com/dkovar/analyzeMFTlinuxnoarch(#Y j G:A@큤AAA큤^[^[^[Q 2^[Q 2^[Q 2^[Q 2^[^[Q 2^[^[Q 2Q 2Q 2bcdb0a30967c30bdf8baea14751c546f83c1a1f2652e1ce893b3fb8ed3dcb1376c60e760bf0aa2fa95116e1ca6ff31cb5908bcb52a658e9173b92aebce3a9290feb17b1e877c6ee56bf4abb594a6e1365fe592ccb5dfc572549e3ee7362c725dfe38d0cc25c3a6b5e84842f4d4531d28772273c1dc8b57afe3411270ba0204280f2baa6e76c90275dc690b3f8965a4dec4d5bb96991d022d190f76c5eec231b4a86f4ed4debc452bf790fea92008fd1d9fe7bc483410bf8a6d223aa1dc7963c5c0f4ca41b4049c5a5899ce7414564e83043e589de9c56d0c8bd224180d7954d79efb89ae4106e04e75272cee46ad67176efa97f46c0bac56d9dce1f7acd8f3c5c6573f13006dcda9cabc0ba752302b9a612f890bdb6b601c0031635c1414540f95b2f8a3d5e36383ae8cd37cc2f383d27feedc54af20ef95bb3d129c5655470ce3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b8553356395f8db6401063f3a7900eb18947e3333e605bbae905dc06932f2bf39bb9b9b28423a3466b33c1cec275e9d1e0cc1a5129784efb7b8e56afc2eea52bdc427c81ca76a34d495138691247751b1fd805f82c9a15b5766983ba4586dc3a9ee6f50403ed24612ade85e1a5bbdc307c455390915e055b40627c76de4d3e3c6593rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootanalyzeMFT-2.0.4-lp152.3.3.src.rpmanalyzeMFT@@    /usr/bin/pythonpythonpython(abi)python-tkrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)2.73.0.4-14.6.0-14.0-15.2-14.14.1TO?Greg.Freemyer@gmail.comGreg.Freemyer@gmail.com- update to v2.0.4 * converted to a module * setup for pypi - updated Url and Source fields - use newly available python setup.py install - updated %files section since this is now a more traditional python package- initial package submission A Python tool to deconstruct the Windows NTFS $MFT filelamb02 1583057551 2.0.4-lp152.3.3analyzeMFT.pyanalyzeMFT-2.0.4-py2.7.egg-infoanalyzemft__init__.py__init__.pycmft.pymft.pycmftsession.pymftsession.pycmftutils.pymftutils.pyctest__init__.py__init__.pycanalyzeMFTCHANGES.txtLICENSE.txtREADME.txt/usr/bin//usr/lib/python2.7/site-packages//usr/lib/python2.7/site-packages/analyzemft//usr/lib/python2.7/site-packages/analyzemft/test//usr/share/doc/packages//usr/share/doc/packages/analyzeMFT/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Leap:15.2/standard/6ee09f76b74f6a85334a98098a6cd175-analyzeMFTcpioxz5noarch-suse-linuxPython script, ASCII text executableASCII textdirectorypython 2.7 byte-compiledempty RRRRRRRRRRRlw&(#utf-8bfe10df09ecbcacd56dfae9dcb765cea9392f6ed35a4ce09cc793441f0c2b183? 7zXZ !t/FI-] crv9u*8hRi[ɗI+;9'>@5^B56'v !1NmL 7THXKӐ }*7.o?MY@Ɖfpa@ࡽėb,_S^OK%RLMy3ޞd7ұ/?e0 :b%ǘXO<6fcH*\EX'A焢[{,*8ݺpxo#4ܤGo.$ЈidBC&(Qg](8|35Y^[+nunLE.,$! $1J?fnf`#=\#F a8 P,#j&aJ%,O@y/ 3_!Sdq9yv*&4,Cp{%/lS=Gw2X5 {7۵Gd^' k!$g:6. 40F=L*|oóq6*s^v= 4FdǯjàEU Ȯ<`2ٯsEm=yo\Vid|2Df)qg[~Jq:E1}:"f <L2HUf&LmR|ǘt1PJRoR+=T*1v̌4s'O'"yr "6Fw`铓)xɁy -ėwzqV%a[l R.]gXS²\EG$NsGA j'oxAi ||Ç(֩%r-VQjJ3BQws1?ޅ-Zi%7%5A!"M [c[̀!eu1XIypUh7_ IQL@,Lx%DifQmW~Dfw~Np}`t}%9qto﯑i[2啯0fk^n93en/)g~NB*<8K-^sK}z|yu8Kag6gO* [IV{%].H}< =Iw۷*P)l t/A:E5I H^nBcOVʌ')~"B#V}JZ  NE0ɢމ>NTl#af)dy!W~Ƕ淹ԑj?uGZӦHt)(iD]~9qh٤hY.z<'hKXQ4wj<7u٥ %,9v.f6Zק4~p`B cFɤ*{vߍ#>=햴 T.<Rrrh~nԹoZZ] w^Cm2e؞/v^LƎDQJ G.9DoVc5HzU3T̔ĸ1P?4vϪz JxoCɐ:Dă}tі46EjV\b{ǀlΩ*dAIu/VIDAKȨ2d #3֣ 68| VgE`EF= P:6,s`#_87r3ԁ~ x)_)%טqU᧒.k{Xʳ鮢iDe+H#*z5H.]NʫV.H}Q$H`n)3-T<4 PU"e,2rkL/c[ Z"Gu2Ξ{NFQ_xcNsÃdRlk1ƪ2zaR&l.Hj߅#cL.u+@ӇTv`WW ?;^w}ⷶSuZpW,UYc8->R^ &6cR38r7kK¥=P"sO/f@+#; &}l#Juo*ȍL8жzTluz;ոi(d~j%-UzrT{NnIkKiǑZKT ^[oȄ>Bs\:kI~%mHU1y.vV_6yJ&?9q" G&Iő/IOQu??o)_]O.;ʭ3U錳>4%N$T) yJ#-?61+I@A[n*WؗM ׯZ׼a_&}n ^ÍӸBu!FK*r ][E6b#E fC'-FK5,>CƷM*MS6ɤE `SSxGO2%;lPժXZN:oY9ڌyH6Z]X7"I^ RKU+pcQ.zBF@0Q8m̔ۻ4ǀ(|=$2;Q̿(-h`96GkF5y8Yg"!Gdܓ'CF galj^y>-ɖs£2$# A/B2Te۫ 2շ`^+Bc.ݣI*TG`DW8#fuV+-8{{ °|YyFB_P5Sd. SкYt;Z?Ð蹥dQ >/חAC,rUMS"cJ½2 ,ܖmH,nu6C :׽dé/oRxEZxkKqqw*zc9Y 7[3]2ٜJ`{!@LD;4\ @C ,䆟DG_ \d,\kuHNb< ދ4=Ȓ'i%e=HePR˷nX)HB%_y#TCʹj4C<ه|oGmD-HQK9.oI50F^-Ҵ@)ۏ5[(6"8n Fk65 JjߥM;c7%l}hVp'jX.^}֋JĽ%3zu T.`}wI8\r;Ԙj p; GQgɎSQ@H1X$%)4S:3FS5 {p)'YN[gPKrw3ȦǔvE԰{< Mpp&1ۭ$ضȴ}莜uYDeǜQY'#a #'xWLNy_O9BiXF $1T㣗>7~P(.N#w)a0EkaȄV7LLZq2(ps] ?CMچsU , ;Ƙ>+]R*z赃ced}x)a{Y6?dwֳdrnۃxMgV,9%jS)]Fu?1Fmat`ECܒ-z'(k62B_|1z t}tYDf5&iGQVJNF F}CӨUEs"0xPHj)Oe@sU4!-ў=ajS0zXb3ݕ5A+M0SgwՇq`@-ҁ!iPĨqe\;cn(hSuZq"V|ǣi2R@ݟ~8){7`v {~pT0g&5Q Iۈ»F/lz-:B!}=!ҨD*AŦ[1#xAusN7g6NQKn<J ,m>Ar(Ì^:}%3yM Fkе˹ 7;n&}Hk3k-,#cd6eB|`}s%0C$|"XW*K}̌: fnG&bA".vfgCңٟճѼubBy_s6Tg?q?! "N{X9,v i' lԆdZ~%]R0lRH+ɷEO؁Qմr7`K8*sdxRO~n=qψJ6=&Zk6J:`6pbL^BuHst>}E};Pqګc:eUV4 @![>VX=,w/I+,<1yٛ3/:'u:)0d1̰ wz-:Fsq$fPBl+5%U0,-:mV31$~Ⱥq0ApnB .}FبSgf KԢYh[i0_ 3!n5Dh?K6Pa0]&G$D;(̣Iz??V 6̴4?c,(UidW0:yغt>`{5yz.(84z\Q8y8sL3\sah#"|hC힄[E$<ܚ?8?~fQXl7ɠ\o/V֪1RY%2ֹj )&j>pm'==YP~zz08U1?a ֑ލBd\YGbȢlw3Pzx{.E/Ox˺n9Gc-]Sv:pǿo%!k&yFuq=Ir6/ak*SN=#UV߭E1j aI^,?h%c9JL+FS ݧŌDǛiGqЗ~t̎l|˽ #qF]A/ ɧP#2]?)ŇABؾm3tE ?ac+G lX%%=՚ `d^x7yY`7k(yڠn+5NShFZ0-]+# as8t n ;]KӮ=([lnp;[rq 2Z}Gr;V/H+ (DϪIOV sǼD !<Ց_O7!IٌI!2ny?VQK 8T@Il /zKHJQ|.KLf²o$&#'znVȯs9{w35=lOЛ՘>PY;;;J G汹Jg qc!QFǗH YP1<6WAr5ú"VEX|YaxY1Jwƽnk^ye;8(ϗC>811`B F.cb0Lz539[6T`B!4 ^ϮsI#|Y"Qeғ?Mw֐:Q]1w/_sURaQ`/U3 <>:kc}ۋ}z'Bߍ.ډמ%Q(^@9+}w+i-ՅŽ}Pk[*!JwzeSwLHKƦrɩyQQ-GAL9 ûu۫yؘ_﯏Nqeadۍqڗ/, Kv-Xɭ>n,:s afb ;)5G:vDSTG]O$@԰ P8R]LQY#

sez*_]Z⡿$C֢_G֌_$rw`1yFt آFtuXӣu>V0KFhfr_)_brt$5ib+?UZ~Pj.{aCI̞Py%>񚳀΋(ߝznPRB5Mq_5z} tu\ ZJ_:6:? *>b5:,fr!?d"VWX 4t9hJԖ2ˬnt#CX¼x D6OdxĤYr"5:s7эz)ZRz4Dm*3 ^$›:]cצWM!])nv1%SWq^|g39< S] F4,*~HQHufPz ME &E`لrR-N_5bIeAs(kDĐ l. gt#ZxzCLζv0!G6S H, TACzn4~ryuo+m M8D u)ՔT*bۺ*7C&OmR1F%Bg > Vʾ^ )./\jO^c7ڐ'u1]=?fVQ$rcQ4nATnj;,MM.E\$0-ZyW,66o.766-.o"$(x sL4u5K=MP1EJg9XFr`; lLGGuPVzubD똠nW"Gd^yNja,JZCϼzD_iGG[}NXz?TsX}6NēJO^)aO,n c t6}' l|?ı<эn_=}r.G˼o6Ya|'@XYDʍxha!ػ>TOJ~,W b90:@(ӽIf/1P-o(6tA87COt ٕ܁JQg>ҥ )*+x!2@nhN4rXH3zK{+^tmX rAa=Yy.$sP5^3\\k#<c544~:p0N'\WS@ ۃir/Ĝ @ O?S{:sYJyv2JboQSp._2IB?T驒/l/3 -:e˯IٜRT4} D*ϓ%`GëT x2R#eTpo4yqR:R9,h2 +ؼ:6.qFW։4)>PWD<݋> 2TFpLw^'^P2(>KAyf}[EVZ左*,M#{IOiE pkP;&# ȝ~=oA4fy Pޣ~)x#()Z#Z0LjV!+wA5&u~U7lweQi#".th te{8gTeH54}ߧhL;[]s\PðdfrcSc{cZb7όXC}̜nRz+leZyaM:8XxM5߂NʊM'5 J݃7;T[4F̋ry-yk_rʰ&.Cb(?B89POv;TO_ xFmeJCɋP?*KjqcSSZN"@8- 7;`qwz~A CAh8)AM}zw9w--8dB_Iwu~۷m猦pYH*%z3s8PIΗu:U(h{4~6b!N}zHdQpتu%v.f75 +n <?:`0;GC̨rH(㈦sUEqBvfEt "CxKx$w:;;L5 ^fÅgQ5Hb[O*M5vNnL;pĪƗC,r ^K*n G^@0<\ [#޴ ?*с_e Д>)al z D|R?d1^kϟڦFP`Iq%+A^fus v"#4b!as5ٞ'1^Oc, _BuM|<xP"go [oquzƤn:fk ۲;9ŕB3^FՑ[ːWUxz |>?}ToI+FZ'꡽oBi<3/:E\{I ډfL5wufsH S_I7r;C1VO5d5a+DM{ܜ`'ncVԣVȄUq~}oO`$N47^2& Ar涡 ) r%H͔%pRe"yVg3Skp!m4HcS)#=Z)U,>-mEN,Di፵$1`o^gJ H& 2\HLA3lU1C\xnзkfg k2o?Fx=Nf&vOnQ?XSsB ga[y>`9"j ,Vc 47 Q10OtѤ#(*``p8s{M!|{A̘|٪3ZCثtlդ&|Y3ӑ%u"t͋MxBMA(rjw5%' ^L?H7+N9jsSxVW$?uϠDZ:Pâh4eynSXJ5p q'`J.\z;kQu]7!#hc50^kzXR`#dBn F]Qnrj?g},if TXk$j.3/^IvS< ~ f4p{843+#'P~|qhuK%b2j.Y}):?"H tb>`8?kŭ0Uu7AЄ$> N56ZrBTrB?=lTa+1TFQ,ڠ ?[ٔb}UKc L-mp{SǬ w.auw'sɬd 5K' ncyv^zr rlo'ɰ nV,>Ѳ<*>r"2=f>^"|"qVX pK$R` "Ng?p7ߩ#, ǟr?NmoNiOKYfuOPpy7#+F`/3G!L1go@dN"DmaX8sdm@{Zx{n;6nw:/yK]UOg[᎝;ECBFČ Oe9)1аwZE-)R-2/0ُ`d0C]XhGB<#xeSd>e颲 W#qYGJ'jRQ~eml&jw h/ؼdY/m'Ñ;F1yՅWn$q jy`M yOabneT;b&2.4Jͳb S,/1Sl#Yuocbw0I`{O?Y + '睼rm nU[յ1@}茱l~×",lK/-g<4CNxwf5 jſ&xr2rz}GMi.hV_UX襉/*ⴟΝ=.ȣ3S- ?3Z1+,{"I H졗 )7{%o:RXs")SY lyHd?Z`g.5jF &"$Ѱk ͜0ݪ<;[.@L>@ś8 `侍Q*E_w3umVs`oz. S. e?E*;#,A׀) kgɅYCv}c`X&/j/J_O/CclQ GdP#?Ϯ9-ڋYsͬʢRXiw)Z&Y455 @o_P!H;v{!8Teԯ~VYhEg`}+_*5rAy@g5)&y$9s\?((/yTBqLZrSdt:x;4I+M Ls;@%-nd0j<"%F5Ek:<9C (16@v_⇅PrZ٣̫~B~֗+gܘJ21HLe(ݢOu&z|0vX#xaJfQri0^Q.$> Q鈺&GJI.50?# 9ktW=u!5e5~0Μ`{qs@{r^<}8ׅM(J)n4Mde.<늨0*=IUw󸋋2z`1g>1V՞ڰv*Em:;.Ia"iQ=` R\zmTO$F#2繉$4-#b 7{L+4`6zuX\0t"QZ'-!((]􂳵Ktv*ToGTԹ%Xb{yA(r в4".ϺI$@#9%\AL`QpbqVbFO>ҙ <@xyH&LrF|dN_ -d>HǗUpjh<4a풡my/\G3c3Wu'fz3.Q;}BU `)q-4ʖ<M%9;y]-lCDN&Du q2;pnP-.}'ZWiC~TDd3i0d`wUGVC>< l?jf. ]aP "9J}V[%^BaVIs{#8bHnixO() 5L68%<~!)o \SM6ydĨ2`tff%Z@P"t?h ئ"a _R iCrZ2&%e3/\L H>sH=:e'01sAjaޗenbnZJw-Y&cgԷWbA#Ce?uOVog|9꿛ebi5@{Iu$ )\˨a0F:!!&pv.SUrNn2nƇ|hn_EqV7;Lo$5/ ᮍE✙w1|^Q=Ez|3 v%b(i-zb;L"A?K☻<ڌ 1^LE˃ dbҳ v7X&xU27ʜF[q&z 4 u!\'-̒ =cP6Kv`G7oe4"ԉr{JT7rqXemY%[͋ %~K,TQʹGe.q#S0P:EW"nHLсp/܆.#8@-=1P7UZ7Kk%ȖƮ81wō*K %듬a–^cVYi4ֶV|l+z4|o vʴȱ[qiD+a,ta CcO/aʣlՄq[RwKwjﮭFQ}{G3}wGHȪf_(hs>{LP,cRT3 Yѻ[ʈ-KV@$,EQzr2lJ=c!~NĨIǘ5c:u;$Nuu | ")*sm†BQOȲ;fqTjxZY _[mqUY Q2x' MsX le˦\L]'Ԗ6d >QM(^nm?_ֺ7 ezD{en&[tV<hmAcXQN"0bW]lP>k'u|mki bMāRe$_ė K<H6ҴsP8Y `3oXup*bp~&qx6Hbf9 \.|E0]S'Kƕns8K(3H<.yg1t+ص'_{㭒p%y6t$+v!< d^n;nQsv&_@=A 6Cs3Jښj7ELggJ?zzfkee7=1#2o'=oJH[Ջ*} ).\ .f &b'j5 iCmޜy LFԡꑫg?-!m2QQ>" MÜ+s8aLpD6lG7br}s&l5D`H%]X|۫l*INw;WCHQ&c6/&a}#tjj*PCO~oXJR!=y;ǼF6 zت͸Y)(rZ`w~ [`~A95_0S0z*LɫJj6ysgJ>9^[CrɊ`Mjڦ,4gfV?|=jYTD2Iju̅ebdw.AѨʺ[?ڐw}3A3";T^8&Z_]{sK pH%Ur_fdv 2o3 F]o }()M0`zR+. 5@I~h&]ťx|v]ږ~H(J*Ro YzR)v񞆱ؔ䞺tB6:AzC"ύ8 *VzQd!{Ag @Y+=IZa<Ļ]v>H_pYM![-Z?阤)Zr:72n)Vp̢~;3" ]Ŵ rQMWg Wv"wsI.;f+ԭD-($U2݈% ?j@雰ym,y3HlPq0u^S ^Cu"}]ex]c&rqՍR]_nUmb YZ