05 · NTFS & File System
NTFS Forensics: $MFT, USN Journal and $LogFile Explained
Read NTFS like an examiner: MFT record structure, $SI vs $FN timestamps, timestomping checks, USN reason flags, $LogFile, $I30 slack and deleted files.
Area 05
NTFS & File System
NTFS records far more than file contents. This area covers MFT records and attributes, $STANDARD_INFORMATION versus $FILE_NAME timestamps, the USN change journal, $LogFile, $I30 slack, alternate data streams and how to detect timestomping and recover deleted entries.
Key sources
- $MFT
- $UsnJrnl:$J
- $LogFile
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- Master File Table ($MFT)$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.
- USN Journal ($UsnJrnl:$J)USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.
- $LogFile (NTFS transaction log)$LogFile cheat sheet: NTFS metadata journal (MFT record 2), 64 MB default, redo/undo operations, restart area, short retention and parsers.
- $I30 index attributes$I30 cheat sheet: NTFS directory indexes ($INDEX_ROOT, $INDEX_ALLOCATION), INDX records, timestamps, slack entries of deleted files and parsers.
- $Secure:$SDS security descriptors$Secure:$SDS cheat sheet: NTFS security descriptor store, $SDH and $SII indexes, Security ID in $SI, file owner SID and ACLs, collection and MFTECmd.
- Zone.Identifier (Mark of the Web)Zone.Identifier cheat sheet: Mark of the Web ADS, ZoneId 0 to 4, ReferrerUrl and HostUrl per browser, loss and bypass cases, and collection from the $MFT.
- Recycle BinRecycle Bin cheat sheet: $Recycle.Bin $I and $R files, $I version 1 vs 2, XP INFO2, deletion time, original path and size, emptying and Shift+Delete traces.
- Mounted Disk Images (ISO, IMG, VHD, VHDX)Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.