Configure and Export with Mft2Csv

Read the interface by decision

1Choose a sourceMounted NTFS volume, physical drive, shadow copy, image, extracted `$MFT`, or specialist fragment.

›

2Verify contextConfirm the intended volume, input identity, record size, and case scope.

›

3Configure outputFormat, time zone, timestamp representation, separator, Unicode, and output directory.

›

4Process and validateRetain status messages, generated files, counts, hashes, and warnings.

Choose the correct source mode

Interface route	Appropriate use	Beginner boundary
Choose $MFT	An extracted, verified $MFT working copy	Recommended for the core workflow
Choose Image	Raw disk or partition image	Verify the correct NTFS volume before processing
Scan Drives / Verify Volumes	Mounted or unmounted physical media	Requires clear authority and careful device selection
Scan Shadows	$MFT from a Volume Shadow Copy	Record the shadow-copy identity and time context
Broken $MFT / Skip Fixups	Partial, carved, or memory-derived records	Leave off for a normal complete $MFT; enable only with a documented reason

The normal core configuration

For a verified, complete extracted $MFT: choose the working file, keep Skip Fixups, Broken $MFT, and Scan slack off, select all, use the case time basis, keep Unicode enabled, set an output folder, then process. Add specialist options only when the question requires them.

Configure the export

Output format

Use all for the richest CSV during focused review. Bodyfile and log2timeline formats serve different downstream workflows and should be selected deliberately.

Time zone

Record the target-system time basis and the selected Mft2Csv offset. Prefer a normalized UTC export for correlation, while retaining the original case context.

Timestamp format and precision

Choose a consistent representation supported by downstream tools. Nanosecond precision preserves the parsed value but does not make the underlying event accurate to a nanosecond.

Separator and quotation

The default pipe separator reduces collisions with commas in paths. Match the importer and document the delimiter. Quotation can help preserve fields containing separators.

Unicode

Keep Unicode enabled when filenames may contain non-ASCII characters. Validate the encoding when opening the CSV in another application.

Split CSV

Use only when it improves the downstream workflow. Record which files were generated so a reviewer knows where additional timestamps went.

Understand specialist options

Scan slack

Scans record slack for older $I30 entries. Results may be valuable leads but need stronger validation because slack is historical, partial, and prone to stale context.

Extract resident data or slack

Creates additional derived files. Use a separate extraction folder, expect small resident content, preserve filenames and MFT offsets, hash outputs, and treat deleted or ADS-prefixed files as derived evidence.

Broken `$MFT` and Skip Fixups

These are recovery-oriented controls for partial or memory-carved inputs. They are not performance switches. Enabling them on a normal $MFT can weaken validation assumptions and confuse interpretation.

Record size

The interface supports 1024 and 4096-byte records. Use the value appropriate to the source; do not change it merely to make a failed parse continue.

Run and preserve the result

1. 1
   Select the verified working sourceConfirm path, hash, host, volume, and case question.
2. 2
   Record every non-default choiceInclude time zone, output format, precision, separator, Unicode, split state, and advanced options.
3. 3
   Set the output pathUse the case output directory, never the protected evidence folder.
4. 4
   Start processingWatch the status pane and preserve completion, record counts, warnings, and errors.
5. 5
   Inventory outputsRecord names, sizes, hashes, timestamps, parser version, and configuration.
6. 6
   Open a copy for reviewRetain the complete parser output and perform filters on an identified review copy when practical.

PreviousInstall and prepareNextReview and interpret