ntfstimecheck

It's a simple Python code block for detecting File Copy and Local File Move Operations on Windows systems (with STANDARD_INFORMATION Attribute)

Check For Single File;

ntfstimecheck.py -f FILE_PATH

Check For Directory;

ntfstimecheck.py -d DIRECTORY

OUTPUT:

Output file will be written to current folder with ".CSV" Format.