Hello.
I have the image that consists 100 of files of MicrosoftWord. I need to know parameter ObjectId each of files. I can do it manually with help program NTFS Stream Explorer but it will be too long. I tried to do it through FTK but I haven't found necessary columns for it.
Help me, please.
There are several ways
You can parse $MFT directly (either by file, image, physical device or live volume) with https://
You can also parse the individual files directly (mounted volume) with https://
You can extract the index itself $O in the $ObjId file with https://
Joakims, thank you very much. Very useful program for me.