DIGITAL FORENSICS:MFTDump

DIGITAL FORENSICS:MFTDump

MFTDump – Tool to Parse MFT Files

The MFT Master File Table files on NTFS file system are table that will store and provide information about file changes on the hard disk. information may include file size, file name, date and time stamps and more. If you are looking to analyze MFT files you can check MFTDump.
MFTDump is a tool provides a quick and easy way to extract forensic metadata from an NTFS volume $MFT file. It is designed to supplement some forensic tools such as EnCase, FTK, Hex-Ways Forensic, etc.

 

I will pull the $MFT using FTK Imager Lite.  $MFT.copy0 File. The parse the MFT using MFTDump.

 

#MFTDump_V.1.3.0>mftdump.exe /l /o mft.csv "C:\Users\xxx\Downloads\MFTDump_V.1.3.0\$MFT.copy0"

 

Identifying alternate data streams (ADS).

#MFTDump_V.1.3.0>mftdump.exe -a "C:\Users\xxx\Downloads\MFTDump_V.1.3.0\$MFT.copy0"

 

Menu > Data > Text to Columns

 

Jeff Harrison mftdump Extra Credit

 

 

Download MFTDump

How to export Master File Table to csv

When a partition was created/Modify (Master File Table) 

Ref:  

You can read more and download the tool over here: http://malware-hunters.net/freetools/ 

https://sectechno.com/mftdump-tool-to-parse-mft-files/

• "A Journey into NTFS"
  • Part 1: https://medium.com/@bromiley/a-journey-into-ntfs-part-1-e2ac6a6367ec
  • Part 2: https://medium.com/@bromiley/ntfs-series-2b3b91faaf21
  • Part 3: https://medium.com/@bromiley/a-journey-into-ntfs-part-3-5e197a0cab58
  • Part 4: https://medium.com/@bromiley/a-journey-into-ntfs-part-4-f2865c39ac83
  • Part 5: https://medium.com/@bromiley/ntfs-part-5-13e20588af59
  • Part 6: https://medium.com/@bromiley/ntfs-part-6-43a50fad89f3
  • Part 7: https://medium.com/@bromiley/ntfs-part-7-an-ntfs-story-caf42565855b
• https://github.com/dkovar/analyzeMFT
• https://github.com/jschicht/Mft2Csv
• https://github.com/libyal/libfsntfs/blob/master/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc

alternate-data-streams-overview
beginning-analysisbeginning-analysis
http://az4n6.blogspot.com/2015/09/
forensics-tools-by-windows-artefact-cheat-sheet

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud #MobileForensics

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ