.@forensic_matt Just confirmed, list-mft, et al. check parent reference sequence numbers https://github.com/williballenthin/INDXParse/blob/master/MFT.py#L1400 Good question!