MFTBrowser.exe (x64)

[Update]

• Updated/corrected the output for $Reparse_Point SymLinks, Mount_Points, and WOF
• Added support for $Loggged_Utility_Stream's $DSC (Desired Storage Class Flags) & TxFData
• Added the Storage Reserve Flag in $Standard_Information
• Updated the info provided by $UpCase:$Info $Data Atrribute
• Other minor corrections

MFTBrowser.exe (x64)

[Update]

• minor fixes

MFTBrowser.exe (x64)

[Update]

• fixed minor bug when after pressing cancel the directory tree remained hidden.

MFTBrowser.exe (x64)

[Update]

• updated '$UpCase:$Info' Stream decoding to include OS Version (Major/Minor) & CRC64

MFTBrowser.exe (x64)

[Update]

• Fixed minor bug resulting in the Folder tree not appearing under certain conditions (e.g.: after loading a new $Mft file and pressing cancel, then using the 'new range option' to look up a record, and then loading a new $MFT file)

MFTBrowser.exe (x64)

[Update]

• Minor correction with WCI Reparse Tag to skip 4 reserved(?) bytes and read the GUID correctly

MFTBrowser.exe (x64)

[Update]

• Added check : record info is only displayed if the fix-up value (offset 0x30, 0x31) of the record, matches (0x1FE,0x1FF) and (0x3FE,0x3FF) .
  Otherwise a 'Corrupt record' message is displayed + the hex view of the selected record.
  Example of corrupt record

MFTBrowser.exe (x64)

[Update list]

• added Symbolic Link Reparse Tag 'A000000C' flags:

0x00000000 -> The substitute name is a full path name.
0x00000001 -> The substitute name is a path name relative to the directory containing the symbolic link

MFTBrowser.exe (x64)

[Update list]

• Updated Windows Container Isolation (WCI) filter reparse point tag info for tags:

  80000018 - IO_REPARSE_TAG_WCI
  90001018 - IO_REPARSE_TAG_WCI_1
  A0001027 - IO_REPARSE_TAG_WCI_LINK_1
  A000001F - IO_REPARSE_TAG_WCI_TOMBSTONE
  A0000027 - IO_REPARSE_TAG_WCI_LINK

MFTBrowser.exe (x64)

[Update list]

• Corrected flag "$Verify and $Corrupt disabled" to display correctly in $Volume_Information Attribute
  (It's a PowerShell thing: just added a couple of "`" before the $ signs)