$MFT Record Viewer

[Update list]

• Corrected flag "$Verify and $Corrupt disabled" to display correctly in $Volume_Information Attribute
  (It's a PowerShell thing: just added a couple of "`" before the $ signs)

$MFT Record Viewer

[Update list]

• Added undocumented 0x80000000 $Standard_Information Attribute flag
• Corrected $Volume_info Attribute flag decoding - now the flags (hex) are converted to LE first ie 0x8000 is flag 0x0080 ("tunneling cache & Short filenames disabled)

$MFT Record Viewer

[Update List]

• Updated/corrected $Volume_info Attribute flags as follows:

    	Hex	        Binary	                Description
    	# 0x0000	0000000000000000	Volume is OK
    	# 0x0001	0000000000000001	Is dirty
    	# 0x0002	0000000000000010	Re-size journal ($LogFile)
    	# 0x0004	0000000000000100	Upgrade Volume version underway
    	# 0x0008	0000000000001000	Mounted on Windows NT4
    	# 0x0010	0000000000010000	Delete USN underway
    	# 0x0020	0000000000100000	Repair Object IDs underway
    	# 0x0040	0000000001000000	Volume is corrupt and caused a bug check
    	# 0x0080	0000000010000000	Tunneling cache, Short filenames disabled
    	# 0x0100	0000000100000000	Full Chkdsk scan underway
    	# 0x0200	0000001000000000	Proactive scan underway
    	# 0x0400	0000010000000000	TxF feature is disabled
    	# 0x0800	0000100000000000	Volume scrub disabled
    	# 0x1000	0001000000000000	$Verify and $Corrupt disabled
    	# 0x2000	0010000000000000	Heat gathering disabled
    	# 0x4000	0100000000000000	Chkdsk underway
    	# 0x8000	1000000000000000	Modified by Chkdsk
  

Source

$MFT Record Viewer

[Update List]

• Corrected typo
• Separated fixup entries

$MFT Record Viewer

[Update List]

• Added millisecond precision to all timestamps, which are now in formatted as:
  'dd/MM/yyyy HH:mm:ss.fffffff'
• All timestamps are in UTC

$MFT Record Viewer

[Update List]

• Corrected a tag (offset of $Upcase:$Info resident content showing Win version used to format drive)

$MFT Record Viewer

[Update Log]

• Fixed typo resulting in $Volume_Information status flags not being read correctly.

$MFT Record Viewer

[Update Log]

• Optimizations
• Fixed bug when encountering $Reparse Point Tag Value: 0x9000701A

$MFT Record Viewer

[Change log]

• Corrected offset typo ('[0x28] $MFT Record Nr' to '[0x2C] $MFT Record Nr')

$MFT Record Viewer

[Change log]

• Added $MFT Record Reference Number (8 byte value => MFT Record sequence Number & MFT record Nr.)
• Added/Fixed the 'cancel' exit