Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping during a Windows forensic examination.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-mft-for-deleted-file-recoverynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-mft-for-deleted-file-recovery -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-mft-for-deleted-file-recovery -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-mft-for-deleted-file-recoverygh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-mft-for-deleted-file-recoverygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-mft-for-deleted-file-recovery ~/.claude/skills/analyzing-mft-for-deleted-file-recovery # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-mft-for-deleted-file-recovery ~/.agents/skills/analyzing-mft-for-deleted-file-recovery # Codex, Cursor, Gemini CLI, Copilot, OpenCode