MFTECmd

MFTECmd.exe -f $MFT --csv <out>

Parses the NTFS $MFT with MFTECmd to CSV, obtaining the activity of each file (creation, modification, deletion) on the system.

Run it when you need file activity on the system: the $MFT (Master File Table) records every file on the volume with its MACB times, size, and attributes — and MFTECmd converts it to CSV with columns ready for filtering. It's the go-to file activity artifact: the payload created in Temp, the deletion of tools, the modification of a system file — everything lands in the MFT. In IR, the MFT is one of the first artifacts processed (with KAPE you collect it in minutes) and the resulting CSV is filtered by the incident window.

Don't use it as a complete activity log: the MFT records files that exist or existed, but not all operations (reading a file doesn't always update access) — for execution, use prefetch and amcache. On large volumes, the MFT CSV is huge (thousands of rows): filtering by time and path is mandatory. And watch out: the MFT gets overwritten — files deleted long ago lose their entries; the recovery window depends on volume activity. The $MFT is copied with the volume in use (or from the image); hot copies may have minor inconsistencies.