getting information on a file ENTRY

Will it be on a NTFS or FAT volume, file entry (of MFT record) properties can be easely decoded.

When possible, try locking the volume before, so helping Tyrhex by providing the volume essential settings.

Locate the desired file entry and set the position on the first byte of it (for NTFS, the first byte of the MFT record, usually at the start of a sector, for FAT the first byte of a 32 bytes entry). Use then the feature « Analyse - Item at sector » and you will get all information available for this item. When possible, navigation through the file system tree.

Keep upgrading your version, as we will implement more and more features to analyse other file systems and meta-data embedded in some file types.    

tyrhex © Yves Vandermeer  2015-2017   #tyrhex