File System

Extracts entries that Windows marks as excluded from Volume Shadow Copy Service (VSS) and backup operations, from the System hive

Parse the GetThis files produced by Orc and retrieve information about the collected files

Extracts information about every USB (or other) mass‑storage device ever connected to a Windows system, using data from the System hive

Reads a text file and concatenates every line into a single output line

Extract NTFS’s Master File Table (MFT) from an ORC‑generated CSV file

Extracts entries from the PendingFileRenameOperations value in the System hive

Extracts metadata from Windows recycle‑bin files

Extracts the contents of Shell Bag structures stored in the UsrClass hive

Srum table for windows server 2022 that tracks physical drive information

Srum table for windows server 2022 that tracks storage volumes information

Parses the CSV export of the Windows USN Journal

Parses a Windows volume‑statistics csv file

Parses CSV files that list Volume Shadow Copy (VSS) snapshots