User defined list-mft output format example

gistfile1.sh

    Git/INDXParse - [master●] » python list_mft.py /evidence/case001/CMFT --prefix "C:" --format "{{ record.inode }}, {{ prefix }}{{ record.path }}, {{ record.is_active }}, {{ record.standard_information.accessed }}, {{ record.filename_information.created }}, {{ record.size }}" | head 
    0, C:\$MFT, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 181895168
    1, C:\$MFTMirr, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 4096
    2, C:\$LogFile, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 67108864
    3, C:\$Volume, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 0
    4, C:\$AttrDef, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 2560
    5, C:, 1, 2012-03-19 13:18:46.741314, 2005-04-30 21:04:47.484373, 0
    6, C:\$Bitmap, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 2442136
    7, C:\$Boot, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 8192
    8, C:\$BadClus, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 0
    9, C:\$Secure, 1, 2005-04-30 21:04:47.484373, 2005-04-30 21:04:47.484373, 0

List Unicode strings found in record slack, by inode number:

Git/INDXParse - [master●] » python list_mft.py /evidence/case001/CMFT --format "{{ record.inode }}                            
{% for string in record.slack_unicode_strings %}
   {{ string }}
{% endfor %}"   

Output (clipped):

30
  rstrui.exe
  srdiag.exef
  srframe.mmf

31
  -1-5-~1041
  S-1-5-~2

32
  ms.r3en.dll
  nls302en.lex
  srchctls.dll
  srchui.dll
  NFO2

33

34

35
  system.adm
  wmplayer.adm
  wuau.adm

36

37
  HPC24X06.GPD
  hpzen042.hlp
  HPZSS042.DLL
  $I30
  $I30?
  e 2000