analyzeMFT-2.0.4-6.2>t  DH`pY0/=„ C!Aϔ,Q4\VO |sP\R]xPl}p 2o&^k(Qő֨u|2NJ/޿4E*l{,W㛔1C/Y!+fsg!gTxkI\7$KD 9Gi~eX=ڶ"}_.4.ݙx cp!t Wa][j#6j8ӊEJ9d6b58f632835b440738dcf4210a2ceb622cf979e`Y0/=„* ɢE8Dȱʽ5J7ᓌfWA,i'я ,W%w,:í*$"U?jd\_=KY^!-;1Ԕ=b 8𡉣5:0VWp4Egt(]8g;S,̭OBs0pqUYYS6N|v""Bt2Gk]";a%wCem|trkM^zh,D& ETF>:(?d   O :_el   D  6  H   D d    R( o8 x9 : F G H@IXY\]^bc(defluvwLxy zCanalyzeMFT2.0.46.2A Python tool to deconstruct the Windows NTFS $MFT fileanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output: Record Number Good - if the entry is valid Active - if the entry is active Record type - the type of record Record Sequence - the sequence number for the record Parent Folder Record Number Parent Folder Sequence Number For the standard information attribute: Creation date Modification date Access date Entry date For up to four file name records: File name Creation date Modification date Access date Entry date Object ID Birth Volume ID Birth Object ID Birth Domain ID And flags to show if each of the following attributes is present: Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility Stream Notes/Log - Field used to log any significant events or observations relating to this record std-fn-shift - Populated if anomaly detection is turned on. Y/N. Y indicates that the FN create date is later than the STD create date. usec-zero - Populated if anomaly detection is turned on. Y/N. Y indicates that the STD create date's microsecond value is zero. For each entry in the MFT a record is written to an output file in CSV format. Major contributions from Matt Sabourin.Y0lamb53:openSUSE Leap 42.3openSUSECPL-1.0http://bugs.opensuse.orgDevelopment/Libraries/Pythonhttps://github.com/dkovar/analyzeMFTlinuxnoarch(#Y j G:A@큤AAA큤Y0Y0Y0Q 2Y0Q 2Y0Q 2Y0Q 2Y0Y0Q 2Y0Y0Q 2Q 2Q 2cbb80a9b6f89bd9f2529e7d8eeede7e560ef3074b0b748f8e2c63ef29e64746242d488428676fd2de8f9d79cf4054320bb22179aa2846aad645e2ba6606b08be1d4faeb0699e9fb592e0b9cda91eb5fb59c9d8a30b4dda43b6baed695562c3c0a7c1f433da5c2de3371d7d32bbc6763f696ea5957d2e95c910838f061da21096ada2c7e12c5e2798a43a7b9830ff0c28a759749d9fb69f449bed843bc014ea33d41d8cd98f00b204e9800998ecf8427ef56a7e3b001c5432da93b05e5e049561ce0e5ffc197a968e20bc3833c7c37bb6ce3ebcdf5b5a9968ebaf66ae3617ea830ad7bc6db26bec003557cef42c041d89rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootanalyzeMFT-2.0.4-6.2.src.rpmanalyzeMFT@@   /usr/bin/pythonpythonpython(abi)python-tkrpmlib(CompressedFileNames)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsLzma)2.73.0.4-14.0-14.4.6-14.11.2TO?Greg.Freemyer@gmail.comGreg.Freemyer@gmail.com- update to v2.0.4 * converted to a module * setup for pypi - updated Url and Source fields - use newly available python setup.py install - updated %files section since this is now a more traditional python package- initial package submission A Python tool to deconstruct the Windows NTFS $MFT filelamb53 1495216291 2.0.4-6.2analyzeMFT.pyanalyzeMFT-2.0.4-py2.7.egg-infoanalyzemft__init__.py__init__.pycmft.pymft.pycmftsession.pymftsession.pycmftutils.pymftutils.pyctest__init__.py__init__.pycanalyzeMFTCHANGES.txtLICENSE.txtREADME.txt/usr/bin//usr/lib/python2.7/site-packages//usr/lib/python2.7/site-packages/analyzemft//usr/lib/python2.7/site-packages/analyzemft/test//usr/share/doc/packages//usr/share/doc/packages/analyzeMFT/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -gobs://build.opensuse.org/openSUSE:Leap:42.3/standard/6ee09f76b74f6a85334a98098a6cd175-analyzeMFTcpiolzma5noarch-suse-linuxPython script, ASCII text executableASCII textdirectorypython 2.7 byte-compiledempty RRRRRRRRRRRّ%r K?`] crv9uh"c7#|e*nFa}lq푗6bȗ5޷bAx*pa-BJ)P)y4l\֡F/D4[^3^РBRo%e8t㉿,6S 6cϫ/hktwV{!StP1aY#m[ɎTJUX5- ܯ^٦{b>eMG3H8!"~sPZ1 ?(sf:^"b:W8Fm/I\UyRVx>kA+٫lޗ_I3=FU].[`A٠N̻)cF0HkCLiiBdf\m6{~Dɩ$!z;M{{5@Ա{7񓇓喥2$XG/s}}Bl )'u].À[}=+adgM` b#LxA X?Xsi`){ 3QAK{v;8ݼ5Os9EBX8{Ns"ҦRvS?-[ iZH(.V,e=7E$}Tεr OH}0Pha 7|̥iCq2m9se[w'ߎ2NQdo,)׌_D`^d v$ Ewq$T n6qfY17GXʋ:i9+|zE}V.3py dD/0;%AxԎzLAEeL0~bcȂED4ҙ9vF,QmjyVfDN˭vgwt-˾[ɀ8XЋ!bkȆ "5xBvhsPn ԵW^pC]0 PMT~$R+0tkW+Q']תq\u ^rl ΰXO dݕluN>;Xp oQVcÒ\"aOcZ}6b~3v la pH[?2lSNz-/P'p:7rɣsK`ĥJW#]RT3 {e=/hU1hOr]@Diz-- \=,I}f.ފdnwxYͧIRREbIc+< bnV{J2wŒ]jeش )O4z*@؉8`YR͊VCOdRʑNLgiڒyUnraۥ)$=gh+67K't(-(&5nVD?`ȦFZd-YXME\)<PiW[>%Xo@jv'Ӽ;mU(=leM6!p)*=-5byVHZJ4c!?izL4Fv?[R \J9 a(&k>Hq$`Xb:IUFZG TS}+f)-+&Y TR῟{1 M.WM!ʘE/'ymҺusz)kzLUy%N3מj5 f["|e(AeUq]^ȾԎL$fUkN},pHߞ ]|C& ]&p>P;5*vTH CSqA5zdn2p&oT.W6)׏z f 6PY#g+`Ղ)a$ҧX҉.80㊍pHjj:vKֵL`f;HgvyړQ38/F_?z7qJ&L}Ԑ 3epi 1nbrFX;ΰ/'hxq:,^)(v="ک"4WA',NQrh7S fAՖ/RAẆy.P7ƦdH'k>hN9NrP=ۍo#%,9nN .`+/:RCj~HmG6u6=1)=')̇n-gvw+C j[L "ZJ8GԽ$" 20>#L$RVk[.;DMYX8Ȓ^%G>%Lfo ‰~>;k4\c~ 8O%4d^oq?qL:AM8|&aw^o@ 9grH&Q ¾e8z4\a5öJ^uL;vρALb6Fæ{vɘxVuxD4mF2 bmJnà :MG~bxȯqJy7ƯY[Pq!fAq4۫Cq$lKmY\ro6lȬٰ'Ўͪ%'ͣ5(ϵ{72ʉ\K4}mwkF߲ѕv RqP1\lQ*?6~ Cg^%uqbkpMd0dzt  OCJqS j1ZapR|=w"\JDm[ΠP ;4w#GB3F|V 751-_7}^n*pw+Cgqkfwk ˰/Z29Z}( x1p_gzPRZ2VY-;,7/[]hu,DY3gvx\ZWa_6yͿ8&JZ lJBqP(PCȚG˃xew0 t/#^KImS%(roň%2p+rI<۲잰.G23BQHV0dm%$`"mJdIرߙ&M}0*seo`PezO" iQamY0y4˴gI7|TN>D-.^K{'jQ^ϗQLld %3"P\ |E@;[you؇LdfJwbqXᙖ"~a,go_<1 ݃/1O1HErX(@&P^T w;kdNo#[< 6:Z"H<"}3K't0 /f4qݰ <nIfo qmDfǕtq3%<(Fxmн=UD|%Ӿҟ#'Hùz&RA K,)0_?BMz<8|$ZwB |gYAۋOM*M\IeB7\W,h@z&*: Tmhf""]V0@2Tps  QXK0N.Xf}n- LLdM>P-|Nw= 3 w{\CT2߀ʃ!g]1ӊxZUM~^vosj41cB*dj1Js.fl>RV z 9jvr[YQv75[䆋i0GwT="rd&7mYeWZ$M4Ā|qcBVE/+6]St-wT%߉m Iw`ᷴ'H1mAAiYSǢȹurAo,Z:B Σ%Lʸu#_К_(jQ=<;3=o%2*fV6LXZws)3])a3XNϬ7JzZS=ء/ aW Fn9qL~>ٵ帰jWN+@ذP#F0`Vɾ="# v'S|CBGv4DxSt$3J%-_zEjGK?>%J*pcYo2Qk/ OyB{VܴgVgg$^C=Z -W 2>;bu20cRCE]a^pP0aQpFQ0W? B8-}&/賵ԂkY*71;XVÂztaB6ݙ,3N*ҙf3hߧzߺtt,YJԖG*~Ld&ZK7JMryFrV~#`ΨA}0_t!młҌ·.S-l + :kghd;#Kr>WO nFb犍(BQ9iL̐b5.NP_e9@vaf!d Ϩ<\K-čxƳ"2vLGԇP\˒ bGgGEplh@A c;}YӦMeI?12`խG4%2tA$̈́08uZ +s|߼q29 d׏4h-qܭ;w9G%vvgYZ_B:Gyeb+ʀEh'gei56ӮRG*lm-]9Ž3i%!Ӥr "nˌ~A@V«TE=Jv!Mtv'b9 F $ѫTbKd VKܞ]ߟyqGasLşvapӸΙ8pDnE`uKMÐ&DzھI@k*ЁRb{ ;Hn6F$1ؙ[5^}DpRPX [`B00Jq38\5xjǜɆ)u!jo>D~p p@Nq.cXg4o {ŦwR=B,f^aN+Z&wO@j/}9sbq> Nbo9o'hF{"B\*R v EB90X&|A#iX9@x\8 4u`pDփ+|gӨק;+En\Q"YXS/s`&0b_6cuy&[j~MZcQ0橡`ƚQZvERnfɨt$/l^u`0[+5\SMuf؋TP 4e*UM\tE#uk d݀Vΐ:QwuM}9Ji XN.<A:w*#7U.ߦ6:@cilHIa P®ga9]D<ƞpxJfpǮJwW-ַv^gi4k"ӑW,EM @䈆B>よà=:(YM.̭hEDE!U BΥ7z,[-e ﹣I`{]S-MLD]34X5ૅ]e*"n*Vo%l3)7PrUo@N% 2[ (8γ%um hJqSgv)f[Mߥ50O.C.MƧ)])Lc@RUp\ghEw=KG$!T,@J'v?Dv?~2qߤƍ*&քbHs]{3D:I[MxRʧ))Jg `-MM- 0{V|sOl ɚV#U=f }9k'dž|֎NCg9\n`Rsh::, 'TlZ@Y$T3-w7SZ+b5CW. ap=0B4( d˔5 T/e'R]YuPJ,Qz-~^a )O8^ʯoCҀ1)Cobq$ځK%!jObNg[r_̻`tRQm=:m¯4NdFu !kh~1XO8S4_b*|r{xa6keWWojL^7-FJcϦLDU גb3Lxh^,l\q YiQ3s+kD-&̈́-g:c,B #CO缅鼭ܹ꺥Pw9SCёYr.F}7cI##b7} q11,Ĥ U1iO}w{d1Bݕv n6' 71 󉲕v4|G|,P0UP b7 !.ɵE_Q6LX*wTO6']gq=r8Ml(2hԿыQaL6v1/fR!R͢ORV%I)H`[g#o:9d`gEQK!IF탑5T!S0cA;vÕM{.Lʏa0e@%"?-gP5i?[; } 7ҸJbU˥kt0I͗!0f גg:<빹ssΦOy*_yVIނFQny&J=sSF0-T E?&[O„@RԵF ,o5Z qzO*\K`ppY4)՛WqJ{veY1b޼t.UAZO=QnM`Y!A̍n5jAk[JIf$o1H3uI%N3ۖ3dC;W7b EYis3A2:!ZSH!euN2۞i(Lk D+>Va;۞,+u~OdC1֧h ״̿e6_ǻ[k:Y-"|4Kl[`1@#_ڨ)Ȭs>[ڍ¢kDy؊`??R<_J 4,)매iGkjyr=0 4/hNV c=ؔinR +ҙt|N_Tf-J-@-4f&79ȌG"kMT;rص7_ϐ:#dr =W'=- KOUO6ܖ=8`[ }ʅ^+XX7BRH5xԈ]XgOvLB^.5dclDt“ԒHL{џ(鸉&MMGXC6KGjM& ".KHM98tFXwDWF7+7ϣL#kRKPC߈~?sQV( DJ˶Ӗ!'ЙгUn×c+H_H!bsO}Ԓt)Md:22Fm~*^afڳ$@ɾ17H-YBIMDGxE' `tZ9-xeƶ˔&ݱlR7tXM㖱xWD-ु+l!7sco3/,:4s[2/ >ZILKsh.ŷȉ9i KM [6W`$^ ]M-co'CDu! 8zkM&nH-$헮$Г 9_ uoTWL!0%կnvӰ'j}5\M_VVe4kiRCVYZ Aٍ?tCa9L6DG)&`UP`6F;t1(kA0+W+=3gnO|$Xd{ڸ~;:O[$(C;rJ;o*!sr<7?7 8tBa[jMSTѩs65^VҘ5h Dng0j@,o Ҏk |)~csX]!ƙva&J$b ~|`|#/7t >ZdbBlO4\-@ mlƱѺ:۫]w@Gݰ'Q8H@euBFKla5v!]<">Ӣa߶^ݧS>7JIR/9MZVK06ftVȵɫQB/;Or:R/^MQexd)m`JQ2yF͕ ObCr@23|C(ya?e(=7uMQw}xbZ@L,TR `6.K JT! > 8RSb0ȷGg 5ߏ?RCmZ\LF |AR+x=U_z+QHZ[KZJ2ϦT}Qf sѭà̫1_ %eSUWMCnfwiΞ;WZ!7) ]ן]9J.^,Ay܎W~ B }e7gb#0Kc`m.)GTtq+џ<1&dLe$ʩv{(l"2?eI caxFMܓƲL)B J<~P[5{fTԟLV.F4]r1=Ck-J=d<2 Hy|mdg`[ 4fie8f@OiprO!yȧeny6,.|I൭IcCٚaC@Eq6d75TƄʶEC0E7/&89YK,vj2}o: lQh{ae'^^0y>GGeGh{P\La [f6$qwI fzw ёgr`Be'O^pD{ ݵaFk;?g3\*P#YjG#J vn^ W1Д2_vWF܁ LȦ!@2ШN/Ozz!h:U~”<#T3b^I"y"J3kuW0v>]@xKwu _U>wa&P5h\|o3D[1+o^Mɩu|9 㿷R$c:\MFɘO`пr`^j Pe[%%1':f 1 m6RD/X`J#T:9µ>QXjV+<մU˵+9[X<ծB<. W@Rji% Xʱ<˓6ʪ̲F*]Z}QHe*,zP20+М[N RO0r5W!3"7o0N$ crE3 De=m󋲺\iȎ3Bz,JMs[R<8NLtk|;s/ Ս|k½V:nW4 n jo[vU$RV\DVe3ܜ+U)>Ac+E3.VS}Ϥ 1ȳA-iD ~/3yxmwELab%gBpD/@M}a>dԧuoM0'':r m*eno *ec-;? \wt]c4>̌oRˇJW +LԿ. ;#J+yJCO/tÓr>y> A~@H/*/sW)#z> G.JnYG)(˟B3_2tJAhŖxd򷴦#/͟V\B\(Q?ʲI\ \hնʔLd+;9Nޚ$aAdU2rq$t*ql(sg_9nu7V& ltA21 C$'$D90d;KBU!p_I0K/A֥iluk؁ୋ^f[g)Ĵ 2/!RbݰM&6y s(;Fh}ys+Ï}c`Lj޵*t`lBe)ag{c0It[KymiCqO9)ӆ1 T)?cB-|90~vt~hq]Hu,>OVͼ=• ?F~yӬa 34+=i ZY߄C- ?캭 ۪t6ٴqSD83lۨe[̾ɏa tTMo^s%ٍ譒V{4NRIĵ0 |2* 8T ":uA7 bj r|V~5?4> J5Qq> q>Ifł>AIځ%˴ոf^ee;8졍3N;B( "`an,k~֘5 hbX\\T47ZF~uv8I+gKBԠ&%4/ HY Q("3@$g_R% 7j eNuk`i9,~sw,D0sW3Mb3+?tex2;P2 m 1Cɴeq:a79rg:&;iM86“*_vighG~O-u@'g0Ml'^/ІŇ^J$ ; td3~͸PDm^fFW')vC%b7B_`STJk:K7q9\)TnEpj#sol/"~yh.(V%~t<{@ _>NXm:G'ں6w̘]Ss1hM][WMС]L2-U$b[4|Q4+EԔƷ!8ݗa'NFzx;^JTq22y_!19F{:[~J#G$'C;(;xzN[#i&zI2+NTnH}Dwĸ^Va=طj@_!uk0GWO '?#mIll9yD %vw7OSikbfK䱽C:Je-{_e)+Qǐ@abBFVjuւEi`v}?P30X\ZajU/LMl^iiG{$58E>fP)`렮 &F=?Cge"CDkG(T6IAɗ0g?lU_.4Z5;l$"[LVu|HB{/x6Peâ:*U# >n/5|!Gpx E|+dl։6@)A} {,#@} ;Ϟ)?x93U\caWO,q}zl.CdTO$BEWLd:Otޕ&J|`dg@c1%!)~ncB1R$hГ2=O+lmRwMrY)8y樜ҍ5 gцE,e1q_Ix+O[H*KD,16AOosMBg0RU(/i؝mMÀdwN8"h+ XFoT'DI ֈ!?V (ÅAPA? e%2'2G\BݑA_\G ϐ2M H5%_E,q T}aaU49tWsA,Cc::Կ!-Y鯹~Wy,u&G*AR鲆(١9ޅüf{.!y.e'n-9sc+BK6TvQ{Or0KrhQl.iH{oioRbٕ&({]>5yVOXn Mb>V$h,.$){ci]uD=;$67?fC6hi膀!;KstIQhd(l@D]#i5<Ƥkpr}p.5MZ0a^MѢ5,r;,b9& Zye.9a6;Y:RF ~$'M$\*.ڒthֆ",M۶AU+)rhԭyH@;t'D2,C4<;G.\E@LxN>j7/-ukbVqaV9tד.aloqƵ6uu =5oPBĹ6\R8# iX/) dT RLQXmm싎`7u|G"Tt; p*% OL#ɸlrxcEdg1 g{-Zե`lxcMEPd>i+J ,J]ě aU4(KP8gGuT'R)s cmN ,̋h="}hX¼n3ł=;#z!XqMBT.]Wk `AI X)}#Yn/6D3W{Lv|ܽMr~5>z4Ao[rqyF+YͦBX~So\bX t&Cd|K s15R4> ZsDuI'pu[t31^TiUhbRFRGp9HCgtPa[[ ߐ;h9 5.QьW]XEn?AlO) Z\a 0" ><[Ü@*v<qTeIGmKk4IJk6ul -0D]KH#'hGGh4KeIKDD+^P^m0R$¦AQ U`$DvѲS[ev%7g5aej,n {@ р)C]9a,x Y6D$,'Vt3P*yS ڶ]&*c?J+|v <E]Br$PW6DbnL %}CÒ P*s, ;fCc3. Q$.mIZ镯s_y@/=S&a V:fx?ϸ 4gDU#[&U9g0c\.Qԯ`" =':KgeNA0Ëafٚ54:eOH4t$H|{bOga}&r ti)<߁5^MjT8?w#@4 $t,<=^}*xX%\Pܳ5,DJ7mM7z,e%Y#%M. kx1K{zRkMʡY$-=&N)հ%ZXVb%zn /`plÛb;csw[U)|e6db0Bmq?D{UHFW=%&]*}.Wr@4y4Y_&Es!TBWdD.o=j|2Dgq.Uܕcj&^8;/iTD9/~ xJϾ@kpH-juF~ R7Ջ?B,@Z1Y=ӽߏ_SЈ?FϨ "@S7ʶHJ)+Q G?EܔD-n s_6`Fj] D[K2$3/;t:Cf(ns9c e 3H,UTCYdN(1w/R j^[b&C8 |ϕ9K{/* e(}b܂LT|oa#x.Jj tV Cx:vM:fam/Ӧ=N2:"n$cqKg|62Ab05 dztP&lm@n4B9rA+d\8{2MP:=FЄ2