INDXParse

Author: 
Willi Ballenthin

INDXParse parses NTFS INDX/$I30 files to extract file entry information, such as filenames and timestamps. The tool supports recovering entries from the slack space within the INDX structures. The tool outputs results to CSV or Bodyfile formats.