Security Slice

Tag: disk image forensics

MFTECmd

Description

A command-line tool for parsing the master file table.

PlatformWindows
AuthorEric Zimmerman
LicenseMIT License
URLhttps://github.com/EricZimmerman/MFTECmd

Usage

MFTECmd version 0.4.4.6
 
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
 
        f               File to process ($MFT | $J | $LogFile | $Boot | $SDS). Required
 
        json            Directory to save JSON formatted results to. This or --csv required unless --de or --body is specified
        jsonf           File name to save JSON formatted results to. When present, overrides default name
        csv             Directory to save CSV formatted results to. This or --json required unless --de or --body is specified
        csvf            File name to save CSV formatted results to. When present, overrides default name
 
        body            Directory to save bodyfile formatted results to. --bdl is also required when using this option
        bodyf           File name to save body formatted results to. When present, overrides default name
        bdl             Drive letter (C, D, etc.) to use with bodyfile. Only the drive letter itself should be provided
        blf             When true, use LF vs CRLF for newlines. Default is FALSE
 
        dd              Directory to save exported FILE record. --do is also required when using this option
        do              Offset of the FILE record to dump as decimal or hex. Ex: 5120 or 0x1400 Use --de or --vl 1 to see offsets
 
        de              Dump full details for entry/sequence #. Format is 'Entry' or 'Entry-Seq' as decimal or hex. Example: 5, 624-5 or 0x270-0x5.
        fls             When true, displays contents of directory specified by --de. Ignored when --de points to a file.
        ds              Dump full details for Security Id as decimal or hex. Example: 624 or 0x270
 
        dt              The custom date/time format to use when displaying time stamps. Default is: yyyy-MM-dd HH:mm:ss.fffffff
        sn              Include DOS file name types. Default is FALSE
        at              When true, include all timestamps from 0x30 attribute vs only when they differ from 0x10. Default is FALSE
 
        vss             Process all Volume Shadow Copies that exist on drive specified by -f . Default is FALSE
        dedupe          Deduplicate -f & VSCs based on SHA-1. First file found wins. Default is FALSE
 
        debug           Show debug information during processing
        trace           Show trace information during processing
 
 
Examples: MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out" --csvf MyOutputFile.csv
          MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out"
          MFTECmd.exe -f "C:\Temp\SomeMFT" --json "c:\temp\jsonout"
          MFTECmd.exe -f "C:\Temp\SomeMFT" --body "c:\temp\bout" --bdl c
          MFTECmd.exe -f "C:\Temp\SomeMFT" --de 5-5
 
          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

Examples

mftecmd -f $j –csv <folder>

The following command will parse a UsnJournal and save the results in a CSV file:

G:\>mftecmd -f "C:\Users\SANSDFIR\Desktop\netwars\$J" --csv "C:\Users\SANSDFIR\Desktop\netwars"
MFTECmd version 0.4.4.6
 
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
 
Command line: -f C:\Users\SANSDFIR\Desktop\netwars\$J --csv C:\Users\SANSDFIR\Desktop\netwars
 
File type: UsnJournal
 
 
Processed 'C:\Users\SANSDFIR\Desktop\netwars\$J' in 1.4809 seconds
 
Usn entries found in 'C:\Users\SANSDFIR\Desktop\netwars\$J': 458,051
        CSV output will be saved to 'C:\Users\SANSDFIR\Desktop\netwars\20210803162237_MFTECmd_$J_Output.csv'

The following is a sample from the output file:

Blog Posts

istat

Description

Displays details of a meta-data structure (inode or MFT).

PlatformLinux and Windows
AuthorBrian Carrier
LicenseCommon Public License 1.0
URLhttp://sleuthkit.org

Usage

usage: istat [-B num] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] [-z zone] [-s seconds] [-vV] image inum
    -B num: force the display of NUM address of block pointers
    -z zone: time zone of original machine (i.e. EST5EDT or GMT)
    -s seconds: Time skew of original machine (in seconds)
    -i imgtype: The format of the image file (use '-i list' for supported types)
    -b dev_sector_size: The size (in bytes) of the device sectors
    -f fstype: File system type (use '-f list' for supported types)
    -o imgoffset: The offset of the file system in the image (in sectors)
    -v: verbose output to stderr
    -V: print version

Examples

 istat <disk image> <entry number>

This example parses the $MFT in the provided image and displays data associated with entry number 48869:

root@siftworkstation:/home/sansforensics/netwars# istat ./romanoff/win7-32-nromanoff-c-drive.E01 48869
MFT Entry Header Values:
Entry: 48869        Sequence: 2
$LogFile Sequence Number: 8642056225
Allocated File
Links: 2
 
$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Security ID: 1723  (S-1-5-21-2036804247-3058324640-2116585241-1109)
Last User Journal Update Sequence Number: 1919383144
Created:        2011-08-28 22:33:18.571266300 (UTC)
File Modified:  2011-08-28 22:35:24.545830100 (UTC)
MFT Modified:   2012-04-04 15:21:06.753530300 (UTC)
Accessed:       2011-08-28 22:33:18.571266300 (UTC)
 
$FILE_NAME Attribute Values:
Flags: Archive
Name: adberdr813.exe
Parent MFT Entry: 42171         Sequence: 2
Allocated Size: 21807104        Actual Size: 21806256
Created:        2011-08-28 22:33:18.571266300 (UTC)
File Modified:  2011-08-28 22:33:28.007175500 (UTC)
MFT Modified:   2011-08-28 22:33:28.034520300 (UTC)
Accessed:       2011-08-28 22:33:18.571266300 (UTC)
 
Attributes:
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-7)   Name: N/A   Resident   size: 90
Type: $FILE_NAME (48-6)   Name: N/A   Resident   size: 94
Type: $DATA (128-4)   Name: N/A   Non-Resident   size: 21806256  init_size: 21806256
467370 467371 467372 467373 467374 467375 467376 467377
467378 467379 467380 467381 467382 467383 467384 467385
...
472690 472691 472692 472693
Type: $DATA (128-5)   Name: Zone.Identifier   Resident   size: 26

Blog Posts

FTK Imager

Description

FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as Forensic Toolkit (FTK®) is warranted.

Usage

Examples

Examining a disk image
  1. File → Add Evidence Item
  2. Image File → Next
  3. Browse → Finish
  4. Don’t forget to select the properties tab in the lower left corner

Blog Posts

ewfmount

Description

A command line tool for creating a mount file from a disk image. Use ewfmount to mount the EWF format (Expert Witness
Compression Format)

PlatformLinux
AuthorJoachim Metz
LicenseGPLv3
URLewfmount.c

Usage

Usage: ewfmount [ -f format ] [ -X extended_options ] [ -hvV ]
                ewf_files mount_point
 
    ewf_files:   the first or the entire set of EWF segment files
 
    mount_point: the directory to serve as mount point
 
    -f:          specify the input format, options: raw (default),
                 files (restricted to logical volume files)
    -h:          shows this help
    -v:          verbose output to stderr
                 ewfmount will remain running in the foreground
    -V:          print version
    -X:          extended options to pass to sub system

Examples

ewfmount win7-32-nromanoff-c-drive.E01 /mnt/ewf_mount

This command creates a mount file.

root@siftworkstation:/home/sansforensics/netwars/romanoff# cd /mnt/ewf_mount
root@siftworkstation:/mnt/ewf_mount# ll
total 4
drwxr-xr-x  2 root root           0 Jan  1  1970 ./
drwxr-xr-x 23 root root        4096 Jul 25  2016 ../
-r--r--r--  1 root root 26578255872 Jul 24 17:54 ewf1

You can then mount it with this command:

root@siftworkstation:/mnt/ewf_mount# mount -o ro,loop,show_sys_files,streams_interface=windows ewf1 /mnt/romanoff/
root@siftworkstation:/mnt/ewf_mount# cd /mnt/romanoff/
root@siftworkstation:/mnt/romanoff# ll
total 3736025
drwxrwxrwx  1 root root       4096 Apr  4  2012 ./
drwxr-xr-x 24 root root       4096 Jul 24 17:55 ../
-rwxrwxrwx  1 root root       2560 Nov 10  2010 $AttrDef*
-rwxrwxrwx  1 root root         24 Jun 10  2009 autoexec.bat*
-rwxrwxrwx  1 root root          0 Nov 10  2010 $BadClus*
-rwxrwxrwx  1 root root     811104 Nov 10  2010 $Bitmap*
drwxrwxrwx  1 root root       8192 Sep 17  2011 Boot/
-rwxrwxrwx  1 root root       8192 Nov 10  2010 $Boot*
-rwxrwxrwx  1 root root     383786 Nov 20  2010 bootmgr*
-rwxrwxrwx  1 root root       8192 Nov 10  2010 BOOTSECT.BAK*
-rwxrwxrwx  1 root root         10 Jun 10  2009 config.sys*
lrwxrwxrwx  2 root root         60 Jul 14  2009 Documents and Settings -> /mnt/romanoff//Users/
drwxrwxrwx  1 root root          0 Nov 10  2010 $Extend/
-rwxrwxrwx  1 root root 1610211328 Apr  4  2012 hiberfil.sys*
-rwxrwxrwx  1 root root   67108864 Nov 10  2010 $LogFile*
-rwxrwxrwx  1 root root       4096 Nov 10  2010 $MFTMirr*
drwxrwxrwx  1 root root          0 Nov 10  2010 MSOCache/
-rwxrwxrwx  1 root root 2146951168 Apr  4  2012 pagefile.sys*
drwxrwxrwx  1 root root          0 Jul 14  2009 PerfLogs/
drwxrwxrwx  1 root root       4096 Aug 30  2011 ProgramData/
drwxrwxrwx  1 root root       8192 Mar 15  2012 Program Files/
drwxrwxrwx  1 root root          0 Nov 10  2010 Recovery/
drwxrwxrwx  1 root root       4096 Apr  4  2012 $Recycle.Bin/
----------  1 root root          0 Nov 10  2010 $Secure
drwxrwxrwx  1 root root       8192 Apr  4  2012 System Volume Information/
-rwxrwxrwx  1 root root     131072 Nov 10  2010 $UpCase*
drwxrwxrwx  1 root root       4096 Apr  3  2012 Users/
-rwxrwxrwx  1 root root          0 Nov 10  2010 $Volume*
drwxrwxrwx  1 root root      16384 Apr  4  2012 Windows/

Blog Posts

analyzeMFT.py

Description

This tool is designed to fully parse the MFT file from an NTFS filesystem
and present the results as accurately as possible in multiple formats.
PlatformPython
AuthorDavid Kovar
LicenseCommon Public License 1.0
URLhttps://github.com/dkovar/analyzeMFT

Usage

Usage: analyzeMFT.py [options]
 
Options:
  -h, --help            show this help message and exit
  -v, --version         report version and exit
  -f FILE, --file=FILE  read MFT from FILE
  -o FILE, --output=FILE
                        write results to FILE
  -a, --anomaly         turn on anomaly detection
  -e, --excel           print date/time in Excel friendly format
  -b FILE, --bodyfile=FILE
                        write MAC information to bodyfile
  --bodystd             Use STD_INFO timestamps for body file rather than FN
                        timestamps
  --bodyfull            Use full path name + filename rather than just
                        filename
  -c FILE, --csvtimefile=FILE
                        write CSV format timeline file
  -l, --localtz         report times using local timezone
  -d, --debug           turn on debugging output
  -s, --saveinmemory    Save a copy of the decoded MFT in memory. Do not use
                        for very large MFTs
  -p, --progress        Show systematic progress reports.

Examples

Blog Posts