Today’s tool release: fuse-mft. Mount an MFT as a filesystem and explore contents. Virtual files provide more context http://www.williballenthin.com/forensics/mft/fuse_mft/