Extract of attribut...
 
Notifications
Clear all

Extract of attribute $OBJECT_ID from files of MicrosoftWord

3 Posts
2 Users
0 Likes
629 Views
(@eugene_777)
Posts: 22
Eminent Member
Topic starter
 

Hello.
I have the image that consists 100 of files of MicrosoftWord. I need to know parameter ObjectId each of files. I can do it manually with help program NTFS Stream Explorer but it will be too long. I tried to do it through FTK but I haven't found necessary columns for it.
Help me, please.

 
Posted : 14/06/2017 3:50 pm
joakims
(@joakims)
Posts: 224
Estimable Member
 

There are several ways

You can parse $MFT directly (either by file, image, physical device or live volume) with https://github.com/jschicht/Mft2Csv

You can also parse the individual files directly (mounted volume) with https://github.com/jschicht/MftRcrd

You can extract the index itself $O in the $ObjId file with https://github.com/jschicht/RawCopy and then parse the extracted INDX dump with https://github.com/jschicht/Indx2Csv

 
Posted : 14/06/2017 9:31 pm
(@eugene_777)
Posts: 22
Eminent Member
Topic starter
 

Joakims, thank you very much. Very useful program for me.

 
Posted : 16/06/2017 8:16 pm
Share: