Get-ForensicFileRecordIndex

NAME Get-ForensicFileRecordIndex



SYNOPSIS

Gets the MFT Record Index for the specified file.





SYNTAX

Get-ForensicFileRecordIndex [-Path] <String> [<CommonParameters>]





DESCRIPTION

The Get-ForensicFileRecordIndex cmdlet returns the Master File Table Record Index Number for the specified file.



Except as noted, the cmdlets in the PowerForensics module require the permissions of a member of the

Administrators group on the computer. To run them, start Windows PowerShell with the 'Run as administrator' option.





PARAMETERS

-Path <String>

The path of the file to return the Master File Table record index for.



Required? true

Position? 0

Default value

Accept pipeline input? false

Accept wildcard characters? false



<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,

ErrorAction, ErrorVariable, WarningAction, WarningVariable,

OutBuffer, PipelineVariable, and OutVariable. For more information, see

about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).



INPUTS

None







OUTPUTS

System.UInt64













-------------------------- EXAMPLE 1 --------------------------



[ADMIN]: PS C:\\>Get-ForensicFileRecordIndex C:\\Windows\\Notepad.exe



This command uses Get-ForensicFileRecordIndex to get the Master File Table Record Index for C:\\Windows\\Notepad.exe.



RELATED LINKS