Today’s tool release: list-mft. Supports timestamps from $FN, $SN, and INDX_ROOT entries. Memory efficient. http://www.williballenthin.com/forensics/mft/list_mft/