Thanks to @phillmoore for reporting a bug in list_mft that prevented path prefixes (prefices?) from working! Fixed. http://www.williballenthin.com/forensics/mft/list_mft/