NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl This project is part of a research looking into the possibilities of combining the MFT, LogFile and UsnJrnl. The code is written from scratch and made open-source under the MIT license.

This proof-of-concept is not a commercial ready project.

There is a basic shell script which does all the basic parsing. This gives the user a quick output of files without knowing all the separate commands.

NOTE: Some subcommands/programs have a raw,parsed,csv,transactions choice. This gives a type of output. In case of the transaction option in the logfileparse.py this will connect the separate LSN together.

Without a parameter the help information will be printed.

usage:

./full_run.sh image_name sector_offset directory

NOTE: this script needs The Sleuth Kit's (TSK) 'fls' program

MFT parser This program exists out of multiple subcommands which makes it able to export specific inums, of extract the date which belongs to a specific inum.

usage:

mftparse.py [-h] {export,extractdata,statistics} ...

Export specific inums into a certain type

usage:

mftparse.py export [-h] [-o OFFSET_SECTORS | -O OFFSET_BYTES] [-s SECTOR_SIZE] [-i IMAGE | -f FILE] [-t {raw,parsed,csv}] [-e EXPORT_FILE] [-q INUMS]

Extracts data for a single entry, essentially returning the file

usage:

mftparse.py extractdata [-h] [-o OFFSET_SECTORS | -O OFFSET_BYTES] [-s SECTOR_SIZE] [-i IMAGE | -f FILE] [-q INUM] [-a DATA_STREAM] [-e OUTPUT_FILE]

Show statistics about this NTFS

usage:

mftparse.py statistics [-h] [-o OFFSET_SECTORS | -O OFFSET_BYTES] [-s SECTOR_SIZE] [-i IMAGE | -f FILE]

usage: ./logfileparse.py [-h] [-f FILE_NAME] [-e EXPORT_FILE] [-t {parsed,csv,transaction,parsedlsns}] [-d DUMP_DIR] [-n NUM] [-q LSNS] [-p]

usage:

usnjrnlparse.py [-h] [-f FILE] [-e OUTPUT] [-n NUMBER]

This program combines the separate parsers and generate a simple overview illustrating the possibilities of what can be reached when combining the different outputs.

usage:

proof-of-concept.py [-h] [-o OFFSET_SECTORS | -O OFFSET_BYTES] [-s SECTOR_SIZE] -i IMAGE [-d DUMP_DIR] [-q INUM] [--deleted]

To do a full run using the example disk:

./full_run.sh disk_image/disk.raw 128 output

To generate a human-readable parsed output of the MFT do:

./mftparse.py export -i disk_image/disk.raw -o 128 -t parsed -e output/mft.parsed

Extracting the LogFile out of the MFT:

./mftparse.py extractdata -i disk_image/disk.raw -o 128 -q 2 -e output/logfile.raw

Parse the raw LogFile data into a .csv file:

./logfileparse.py -f output/logfile.raw -t csv -e output/logfile.csv

For the output of the proof-of-concept program piped to less:

./proof-of-concept.py -o 128 -i disk_image/disk.raw | less

For a specific inum do:

./proof-of-concept.py -o 128 -i disk_image/disk.raw -q 40 | less

For a specific inum, only showing historic information:

./proof-of-concept.py -o 128 -i disk_image/disk.raw -q 40 --deleted | less

Short explanation of the directories in the repo.

• disk_image Contains a 10.5 MB example NTFS disk, including MBR.
• errorpages Directory that will contain all invalid and error pages of a LogFile parser run.
• ntfs_parse Directory containing the framework structure.
• output Example directory with the extracted files of the example disk in the disk_image directory.

To automatically create a class diagram from the Python3 code, do the following:

1. apt-get install pylint3
2. pyreverse3 ntfs_parse/
3. dot -Tsvg classes_No_Name.dot -o classes.svg

Or for Debian Jessie, 8.2

1. apt-get install python3-pip
2. pip3 install pylint
3. pyreverse ntfs_parse/
4. dot -Tsvg classes_No_Name.dot -o classes.svg

The svg can be opened in Firefox