Carve $MFT records from a chunk of data (for instance a memory dump)