FileSystem

File system metadata

Compound
11 paths from 6 artifacts
Version 1
Eric Zimmerman

Paths on disk

11 paths from 6 targets

Includes 6 targets

Each one is collected with this target

$MFT1 path
$LogFile1 path
$J4 paths
$SDS2 paths
$Boot1 path
$T2 paths

Collect it

KAPE command line for FileSystem

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target FileSystem

Note: This is a compound target that references 6 other targets. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.

Run with administrator privileges. KAPE Documentation

Decode with CyberChef

1 recipe for this artifact

Windows FILETIMEConvert Windows FILETIME to readable date(opens in new tab)