MFTDump is a tool provides a quick and easy way to extract forensic metadata from an NTFS volume $MFT file.