Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

$MFT directory tree reconstruction & FILE record info

Parses $MFT from NTFS file systems

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.

A full & Open Source compatible Petya Ransomware Executable Placeholder

Carve file metadata from NTFS index ($I30) attributes

Ultra Fast File Search

PoC of a UEFI Petya ransomware

NTFS Master File Table (MFT) parser for Go.

Apache Airavata Managed File Transfer Services

EverythingSZ is a learning project to research Everything background technology. original source code stored in CodePlex, this branch support .net core.

A Simple Script for Rubber Ducky which Exploits Windows $MFT Vulnerability

This version is a major version for all Waarp Modules, previously being split.

$MFT Record Viewer

From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was painstakingly reverse-engineered since it's undocumented.

An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

NT File System (NTFS) recovery tool

A full rewrite of Red Petya ransomware from 2016 with full MBR and GPT support

Logpresso Mini and community contents for incident response

All Waarp modules have been regrouped in a new repository: https://github.com/waarp/Waarp-All. This repository is outdated and will not be maintained anymore.