MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.

extended filesystem attribute operator for ruby

A syntactic sugar PS module for managing NTFS Alternate Data Streams

Alternate Data Streams (ADS) in NTFS allow multiple data streams to be associated with a single file. In addition to the main data stream, files can store extra data under different names. This feature is often used for metadata but can also be exploited to hide information or malware within a file.