analyzeMFT-2.0.4-bp153.1.12 >  A `BԜ!M@eee`Nm3` 4<[WVf╸?_sagq#RuI=Ǹ-B@} ES!ق=m,r&v 5]Z&1t!?/dzJwdfnz:W0ֽZPd3"[q{S#*=#H+G_r0UD!0,DE5$yGpX /YAc!saY`*`(ѿٺ|N/d2c20dd36139018703a6bab487d1b2704379636b932094227ea0d0c682935f36855408756504573cbfd0020b538c873754d3acf5c<`BԜ!M@eeeSTo=_qڣf&lE|dd%Qش{*3Xd7vS97JrZjg1 E~P0qNFK„^2lCH"O u%ѭö&p"B5[qR^S3JC^Ewʡve#\̎P}xcUҨ^ܗH/_+1$#-y`m0쩪 si9khK\ZjXE}LU i8UGS"wuFGI+QӟEF>p>?d   V  4Qv|   \  .  @   < `   d(89:FGH`IXY\]^bcmdefluv@wxy, zXhlrCanalyzeMFT2.0.4bp153.1.12A Python tool to deconstruct the Windows NTFS $MFT fileanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output: Record Number Good - if the entry is valid Active - if the entry is active Record type - the type of record Record Sequence - the sequence number for the record Parent Folder Record Number Parent Folder Sequence Number For the standard information attribute: Creation date Modification date Access date Entry date For up to four file name records: File name Creation date Modification date Access date Entry date Object ID Birth Volume ID Birth Object ID Birth Domain ID And flags to show if each of the following attributes is present: Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility Stream Notes/Log - Field used to log any significant events or observations relating to this record std-fn-shift - Populated if anomaly detection is turned on. Y/N. Y indicates that the FN create date is later than the STD create date. usec-zero - Populated if anomaly detection is turned on. Y/N. Y indicates that the STD create date's microsecond value is zero. For each entry in the MFT a record is written to an output file in CSV format. Major contributions from Matt Sabourin.`Bhci-cnode1-m0:SUSE Linux Enterprise 15 SP3openSUSECPL-1.0https://bugs.opensuse.orgDevelopment/Libraries/Pythonhttps://github.com/dkovar/analyzeMFTlinuxnoarch(#Y j G:A@큤AAA큤`B`B`BQ 2`BQ 2`BQ 2`BQ 2`B`BQ 2`B`BQ 2Q 2Q 2bcdb0a30967c30bdf8baea14751c546f83c1a1f2652e1ce893b3fb8ed3dcb1376c60e760bf0aa2fa95116e1ca6ff31cb5908bcb52a658e9173b92aebce3a9290feb17b1e877c6ee56bf4abb594a6e1365fe592ccb5dfc572549e3ee7362c725dfe38d0cc25c3a6b5e84842f4d4531d28772273c1dc8b57afe3411270ba0204280f2baa6e76c90275dc690b3f8965a4dec4d5bb96991d022d190f76c5eec231b4a86f4ed4debc452bf790fea92008fd1d9fe7bc483410bf8a6d223aa1dc7963c5c0f4ca41b4049c5a5899ce7414564e83043e589de9c56d0c8bd224180d7954d79efb89ae4106e04e75272cee46ad67176efa97f46c0bac56d9dce1f7acd8f3c5c6573f13006dcda9cabc0ba752302b9a612f890bdb6b601c0031635c1414540f95b2f8a3d5e36383ae8cd37cc2f383d27feedc54af20ef95bb3d129c5655470ce3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b8553356395f8db6401063f3a7900eb18947e3333e605bbae905dc06932f2bf39bb9b9b28423a3466b33c1cec275e9d1e0cc1a5129784efb7b8e56afc2eea52bdc427c81ca76a34d495138691247751b1fd805f82c9a15b5766983ba4586dc3a9ee6f50403ed24612ade85e1a5bbdc307c455390915e055b40627c76de4d3e3c6593rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootanalyzeMFT-2.0.4-bp153.1.12.src.rpmanalyzeMFT@@    /usr/bin/pythonpythonpython(abi)python-tkrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)2.73.0.4-14.6.0-14.0-15.2-14.14.1TO?Greg.Freemyer@gmail.comGreg.Freemyer@gmail.com- update to v2.0.4 * converted to a module * setup for pypi - updated Url and Source fields - use newly available python setup.py install - updated %files section since this is now a more traditional python package- initial package submission A Python tool to deconstruct the Windows NTFS $MFT filehci-cnode1-m0 1614994634 2.0.4-bp153.1.12analyzeMFT.pyanalyzeMFT-2.0.4-py2.7.egg-infoanalyzemft__init__.py__init__.pycmft.pymft.pycmftsession.pymftsession.pycmftutils.pymftutils.pyctest__init__.py__init__.pycanalyzeMFTCHANGES.txtLICENSE.txtREADME.txt/usr/bin//usr/lib/python2.7/site-packages//usr/lib/python2.7/site-packages/analyzemft//usr/lib/python2.7/site-packages/analyzemft/test//usr/share/doc/packages//usr/share/doc/packages/analyzeMFT/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protectionobs://build.opensuse.org/openSUSE:Backports:SLE-15-SP3/standard/6ee09f76b74f6a85334a98098a6cd175-analyzeMFTcpioxz5noarch-suse-linuxPython script, ASCII text executableASCII textdirectorypython 2.7 byte-compiledempty RRRRRRRRRRRK!kegutf-8f934ea8e5e562e315e54670c93f649b3b288093f28e6f4fe2f2361211d595fd0? 7zXZ !t/FI*] crv9wHF7L#F5QD,\`` 每D]Ri,uٝ `SqC.%%Rعpk 0 [bFz- &X̶ޱ䨠<8e]ZQ[G؛]z KSxu6Y 1;c *v:N{UZ7lcߥyZhL>fjTj×K), ?{P$+9i S}u}˱ Yhǎ@ܰWĖlhDQ԰@<Jn[>vh批qaJyWI@M8KPFYQ rdiӱJ|N>(-_ >Ac ˬ"f23c]\%>2;,5xA vӟW0AТєΠ_ -TO {Hҕ^yJew`"h6Uu]X upj$n^E#rh ~*P7ifbn )f<ɭ6Toގ6(i⽣]L]: p&WJ+roe>ԗj xî}]+wI F!!V4aƇa'3k€UΗ=3GSC֭ ]:}5e\cC9+?}?E Zze_ i6ݚGhn|݃{GT(6 ^u 9[uor/4(;ag9__r*T_O@ʥcNv uOZ ~uzDN όÑ!r,0g-J\%'DÙME47#mA $91 .׹͙΂Cc:ޯ}9)tC-0<$_5ka+ș^ jlJYab~AI{&ot:BKZyRw 9sVE Ǫ`4]Y ْm0EcŞNYtD:u Å2o:V$fJ ȊPDӑBʨ̕в?3sW-E E fKl 1Xz' &9f|2Mp|N jU$dlS5KzAPQB.%Aґ3`fh4gW-a1ed["]AcU3!7ǩ΍]Wc}tf(D젔`6~0'`f]ә0`3 q,1S8=/p裎b6MQ;+ į`uZo6W5!:ѠTIa.t1KXs&+-BjYC8vw+!ɞ%51990n-ZWLEEƗBێKU4ޡW/Pog< gX r@oi6sXp msITY`Typ<߀,EI?ϏDT`0z_*TwG}OdAMJG#$hO7{ɎL_!ۦԣfc-2L $)63/(0a68=S #AyI &C-01gb*Z&N[#rU??VKsS*:8/5 tU*Tad4O3%pŽֻ2Ay?$[a160vxdW$OpK8*@=.G/YDy氩?HEB\hjCWTx *=oLޑ6Ido2:VJШ`•Jj$[#wmwڠJ`n^陯fj|@r/Omt?͹S^i6=n ;۞Ynu{[hgPWhD^\L١!zZ}CuB9Y?!%? ƀ+=jO\L$6rf7o2- <ݛȘr^z&8  X{q^Oi+=C2+ ޺XʪUXme.8FT~s 5m{XZ%AO^:4G))ȥW F˚ӕ8͛m*QMi"+({MR} >u'K~iJR_N H6];`lgpzHB28Z8i gNȝ~_(fIbM-НL,0 'Fċ6:|J֙h hRvBM̄8R7{*sꨂ .hNi[Wvd+ tQaqhʴyӗL kuƐŰ S )+v1lՖF^eo&NhGA?6ZY.[G8Zv=ȮXHlg::0LSQ*NNϮqwPդ=|ܘ$Tljݰ*A{ߨ)*='Y9Ng? ؃J)N2J[gP/>H!ڴU;1fNPONK$jq F+8OmH;\*+ gs2Pxi@"Z.a~mʳ.sʰHL(;\/*FmO5&l)F~f.JKӜ1jr1\+ DD0SҧSGp1ZJj~oj¹)PI#S9 wvMJc;^0 +bm`ýqգ -i#t]?@=o8\{LE"RsgloiuO}nŖ hEg2_%IT&;#*m{NmN|8ZTz\C*FvNlsսF`(87{)?e $c<3RŦ6pcV8 [YPG4ߝ!ő|@]WV^{񘐹)pY!'43+]3{gpj||U䭔g1+7-)vDLCOOu]H5vhDu9 'S(D ϨL [m\6=1*nCڀ.\JX{w91KI^{bK 5YwUEvʥzt[aVޗ&4 [.09%f=m&{:u"[? iHs-hjyB$?g{]G)$Ě)-3&ڇtЛг2IΩh=1]T{Iv/V8i U;ӝ/,[Was"tkؒ 8x݆|bE`KۭvsnDIqcM\ qF{0xڽD,Ti;Jj{as̞X4mTa,!b;޹Ţh_eZ ȝVAU n*ӈ>އ/ke〼n(-6?W0{*0 ]a m_}`Ip)5Lb?v΍`4|"Ϩ2nKt.,9jb߻DcAQcekRlXsAd^_c׍|b97,4?+ |ٻ \Yô83)I ;c˺I" R/Ltabx9hx]R&R#]x!Kw I9R2P3TA;h>}XżDel/r`\e 7SIu V6bY<(r9ഀӠޑ 2AV0qŜεSߑ =?R6eLú>WR? DQK~.:nľqƺK0]xy~ɧJ1> `/9j]FeCȂi"zhœH' -NX NyR!$Ϥ[s3zi e6ϳ,xB iWnV" b¢UG$ %n3oڍ_bchjT30PC`Ο0= 2gY{r=m>SsOڵGk #WBXt: Ok݂NE_KAڥ➦(qon)gYkAYB- {PZz4bJEB15Zh' r-҂' \A3@ͷ*q+5ƈ ɏ'g)uv1h}r5X]M:}cɑT#rA C bH5lv 5 k%_덺qt`CGɞh Չd_oSnHn GsVu>)T#j?H8x2 !b "="R$anʸ[#O6GzgjKVE"~pŽywx-CC-xڑ]L:YW2v ׃02э%L5Pu7tڜJrcE 8)1УD;Oxs NRk <x;c֠l&^CPh*Ԫ8""6Kbk~W0z|4+} (:8k2WAB@x-VQ ݠ^;yg'p[~Ev1[}xNL(S0OY'QV؂x~w(7P%\hHs2y"7 $Or{Etڄ}".o?Vx|WBH&9Rؕ}" U*LfD%gK8(C>Cq9`vb.Qn^ Zf@p#_No~kM ƸZ\ub0ܕ|:nNѺdiCKFfŌr *6>ˡӹU:4(r˶3~!ﰒD@PA҂Q_++8HŰR zA$DUZW߭J ԝM/LLgHS<7Go훆LKNh7MruӀIk{7yKw[~.eM;MKcO]sfMLܣ;(6:p~_OR)x!1ˉd`_|pi3IM⓲JU!DX;r+D9P2ĵ tȾ>Ҝ=1?G1to eŪ%y ©b(UNĞVx+16x4m9u<+h ́㓅Ⴅ4J'9&Q-|j𪩮z}9w|=AiE @Z#4` [T3qˊ`雃li7p{j"^ *b:(juK*uV'"nܲR?c[>otc,8䂱3Y(͈^oe̛ ϪC^1kd?+o qi+]5cRl̅Z4^=mq;h66Cqj:Ej7jEֱ4 B:>:S]-?{nXe:g$ʨ6y teT7Dž=oǨ`.J@[ {4FrB*gCufuJMRFx\i&@5O;*W`w.?=:{{I3Fdc=)=O"E!D`O/ 8Qw9w9jEN%/l楧6u\쩯}NQ(y5j7u.O?,jgxՕ2A{:}_=Ox;\? I&4bIgJC^ =/Fyg(H}AUvAۣ|?cU `U/LU71n rt1tl!S4aLH|pYvj)x8^1a44/@Owr,"g#H{ 2)`HeUlC[/[7r0ьH֘ұRXt^l$izkt{+&g(3呹pOGȤd_a$xZeb\\E=kJ1Ja5]G~oH>uJ)ZMK"jۖ<0'̲"Tb`jOcl7a'avBt !Sqێ 72`Kd0S m!9{%.VGH Ym }%Iw "ndN*w|4qDR}0`W78c->!:/&ZVqu͚9FY5uGbU`ב6r"R!WaIUNc;D: 򘗝Vws)zc-srﵒ@>Mkfh(eux\a%xk%Z4,ow8+p }#(:6((|:"4ɢ[Yo[d9q*Vٲbq ۝/b\U+vW =LBo\(]J@*ZmoŒNR btm J Uf̰=XIG\Jgq˻EEwHISiTw0U^6ܢas(\Lt湛]g.l@auCհr>,_@d+^zf$xoEBƲy7;јoqZu6Xtםۀ=(G~=gg!S)K/lSTΊm`@n i@biF E8!ΆEP8Y~V",p/Rmb@SSѪVNdE(i*dtPG|9mHxDL}4pMGrr- 4˹nOR (xɳWP ZKی-a)@#bz-gϖׯt44+s8Jӥt}+E .vTl怜wz<Q 9Fl:f}X iLπBѣPaʖ?7lh ݁㊜5G߲X#~)k8Ue^@*)*Ł/F*xW5MӚ;V ȺUdo{?UA|oj[J-]hwOEEyQL} D<\^~ T6OpM`JGnE]"qo͖]MJw}Tq!v?Y{ϊ_{[n.0yp锘_cmXbmKzt! bn2b1wW6$JuJٽyJUw@!ÿ? gkW.`& qoR892:hhpקct]c+=C0Pք ƷX<$NZe%_۷o? N^gߝ{fhِ쩿UcK6ݽ>tFWt$IYEY¸ɟ8,ʶ[VlPϥ@°6/>.+5XV1h,_@ˮ2!eQlg;F_K|_/*=q=}X*FڼPIzxjɣ{?B:f|5M\RUUQ-$k WПI+D^^!}zZIn2 'C FB (k wLjBۗ!;,m]"7W1X4 Oʫ-*pׇ9|Q30 0Vhqy;L ϨXnةrpe6&q wYgM.>q"zF%Aq*ca:4l*$KB ̂" *ʗL Dh {ӛH՚[~oG%^A0?3MYv>T<y &K Y-e">opx$Cq.6͏Ͼ<Ȯ!09gڎo!k-emcH5t%a (xA.UP 5RrM[a5iܧ37;( !-.Z;-&\x".3G//avږP/6ǝ%gwk]6iD.3v&L9JRKAAbeL4.flDžĦ$}N@8{mU_84ʚ;LwY\C:J8dl,ccû \b"p'v#,!vz fXYӱ`_{U/XOb*θyw=.\j s֍3W.sY6ўةOKԂ@KR joe+9G/w =32$iv% rxh[1i5v6l5 *M&,lh|_$VEB /8cLffzis].otv~چÒ;D ` %ORߪ4ћehOinEOcM=EH)El.x˗jަ-4W6ltd'%O?i<=YeC?R$B“H⧱C!ub}R"^b1Ã2k!`.)x4R{ 0E5j#>rdG'$N2}M&/:xOĶAN *5;tm^VU0S '5h$>oGli',y@&U*&~i[m&8.d|* lwL}*eT)(]~xK.NFȜ'D%y mO;Ro{ lcC;#XS4A/0X ix;sN6E$Hнղ{)X qen"|kdVgnd2^yw8f~QWuIڰ9<7F9Vj}d}6{k?§#F=[yF7rRMΠx8nնqN=a_O95U+-shj("uɡBBupd/'UZ@R#Lx_U OL,n?wd$+,6?E|[\:iY%YH꽃ENfn)Ja/ʣziة& i{F7\g lf5yt4.)21 j&28]?crÅLzN݉7ej3VUb49B)Mܐ){,WgS)3P!m?q{ˬl Fk8tNn3s6a {\#9GOf*{+n:? BloF?4trY aB ~820V MЌXZ(.Pvd٥ƪt.Ģ^t5W8'!SO,~zr$¥mOMºq?o ~x 6QdpZҐr]NCLW,PQ6#NKoa@QLjӞUDyD .PͫϓJ7mdO֤l h&`M[msa,@Vd@ۗDnE}e G7#˅*]5<-fq:T%YF7T=6#%19FDsJ8h jtLb9]!mݣ P(`);zHŽ+CMu~(J’AAmA*KMID"Z!yHN}df\(cwd[k}+[%<uKyTЎ( ^KPPy(GLq̤ݰYקǽmJeqgr Dw8ڸHZ䲽"̀^V?< ( ړ7Yz.#˝/vNwz ;*w:Gv#^ IP6였J?1I 6R5X#%Lz_ f{J[_4R.j3d Gj`t z]M$ʢ7e6L5 ۹`'+e킇Śp:0ڝT,WҹN63)&Бpo6aunx^ΥC4{iYy:SI#LgeOQ.@^e>iCE<\{OLv|q`ñbi79LaGDGv)T⣁HDP/ M; :NgՇԆyrٟ2ڋ.5'ҴL%nx,]zT,cn\:E. T)yE3Vt׵v5nMG_l2$XrbFS {_+ +rLh£?P-t-kBDs*gy3`N?g

֙#Ǝ '+@:y(H-?eEFͰ ɔO5li H2k ee8M2)bܖ ҽD_zrrv+W[,2Pn)2I`h~֭cvQ>.oMÕm|whEG;CF3j: 7&A54MRE)ւa^Vxa Ȩs J6y{dh4CPMӎ/zl:row)VKE%'hHB md̬& ]ʟiI~knXp@iù@\H:E$k/ذN8x[=1w:*y7gM =y4uLdHK6V?$Ikge,%rIðf3L$WT@Q oH K"mR:FW:G-{ajSXۛG/N8J n^ xKS,ba(hkYU8mGpqO Ey-rp<&uG$}pl2GcQC%yP8t} z=_?DAe@ jJxl=mGvxтa3lTz)p#~TE9Xzkims j4_:l~%/1!E0Z@jIJ$Wp1ӵPpDT-Jqu4I|+*b$IW+vh40PO_J ։^XFfqao?pv}*ipzx}0GarLyۨ<.vy "KVQ)hqB_Ke1.و+cʦ\_gyPM2PߡWTohX*21FD^ юS=u+w%xjqf.<|)R3)T-8[fj`)Hlv#a~/m'Ub,@=pWAU?ze;׺/:vWzvܐv 􀻕Qf/8eV}/7 nxC RJ>;0-=P?|p0Wesl0P.gɶMV1沢:ՕwQɡMZv̾1<;47|/O9AG cgȜߦA-]]|@F ԏɨw"b^jub j'}Cl4HF\@J<՞^Fh `!4Rm&Y%mZ~$.ij7xCjt#jS+w ^{צmodo.W'VX~@Z!ڽmȘ#j#2tx_zC$ %9U=:T ^Lysv[!fꛛ"Fh4*9d o\O]O2Zkj&\'[wTYtJvUK0}h\i5 D l=bu}3Nw /XzD<ڎ;) bq\QՎmX%]r-scX٠2~0n sͱl\#iy4c%kr=4Q`x]~"aWT|Hi5~>k\k@Gi\pΝuGV0lU H/3 d-Q}xg?XѳcrNFTQI:]8OY HG6#Tusc.L׃5fɕ$;BN\ `"Nx1C\0! ɀ}OԷrZI'A[,b)>[>VMzN;aڻ .Z (P0m: HJ "Z=H@NH9k>bjj2l:0Q.T :z.Kg%Wdhz֬fv9Ow nç(B4f ~ji zbZ"A$`r6y ;(ϛ#@u:4+/.H½c,s@O^<#bu$$PG]ID{= =)#;:oˮgg8ʔMx1J/Gc5j@V^Ԕ̾?b:6ЪˬyhdԖ7SE+m|}!^*)Pb)ڂzlt2}~'evu t),3G.uMpT=DtLOwFmT<(ZjF.ϴ52LpXJE3m=ΒB2e]u:bSNa՚~,KE(;e4 JW(w^P0ZŒ)X-.ZR., JIl#}f4霔Y:/!f.fcTĜ8|pK d9eJ6 }Xt:.{Y2T=GbM[0W 8`LÜb&0@- :5};fl4b0t!uG\ #fΘ&+P2I!Rd߇mJfd${R[Y Pd#t}<BfX:/uLsI2R'!#SM+@=:HD1mLIMTkeT5&-iƅ%l2yt1O Y= 3k1MFOyJp"$njg#?1~n#+(7a.XuŚk8ޞi 9z vi #P;as%)ӛ{, ?!*>M݈uZ:rhKŢO,s{oӸVg࡙ͩEţʃݝ,鮎ZΨ'ŠxF7%+;;9ҁ8neȮ*>viov%] Rt .8>yY 1Vc(ef f'îtDZ:uv1A'  Ͽ,$ZS'؎߸x.,#$Y|ւ z`nfGps%fg+ʐ;jmsB1 dIz`Ynd6dɠt0CsrMP܆0ThexpOBx(/o+ @[x3S^ Bt1ŹD25381Bu}|#+Ns ]9ްNbQv~{Jc5 6a}v=KVl=.zFfu1tda0 f! sޒN YZ