Grok-NTFS is an NTFS file system analysis tool with powerful data recovery and visualization features.
Grok-NTFS runs on Windows, linux and Macintosh.
Grok-NTFS will accept all types of forensic images (Expert Witness / EnCase E01, FTK Imager, SMART, SAW, etc.) as well as dd images and VMWare disk images. Of course, Grok-NTFS can look directly at physical disks and RAID arrays too.
When used in conjunction with our Remote Forensic Client software, Grok-NTFS may be used to securely examine and document NTFS file systems over the network.
Grok-NTFS provides a familiar tabbed interface, able to display lots of information without clutter. The tabs are connected, so when you switch from one view to another, you don’t lose focus.
Comments