analyzeMFT - a Python tool to deconstruct the Windows NTFS

kovar · 2010-01-23T09:43:37Z

I recently wrote analyzeMFT - a Python tool to deconstruct the Windows NTFS $MFT fileThe project page is here www.integriography.comFrom the pageOverviewanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output * Record Number * Good - if the entry is valid * Active - if the entry is active * Record type - the type of record * Parent Folder - The file's parent folder * Record Sequence - the sequence number for the record * For the standard information attribute o Creation date o Modification date o Access date o Entry date * For up to four file name records o File name o Creation date o Modification date o Access date o Entry date * Object ID * Birth Volume ID * Birth Object ID * Birth Domain ID * And flags to show if each of the following attributes is present o Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility StreaFor each entry in the MFT a record is written to an output file in CSV format.analyzeMFT will run on any system with Python installed. A standalone Windows executable will be released when possible.Contributions and suggestions for improvement are quite welcome.Sample outputSample output"Record Number","Good","Active","Record type","Parent Folder","Record Sequence","Filename #1","Std Info Creation date","Std Info Modification date","Std Info Access date","Std Info Entry date","FN Info Creation date","FN Info Modification date","FN Info Access date","FN Info Entry date","Object ID","Birth Volume ID","Birth Object ID","Birth Domain ID","Filename #2","FN Info Creation date","FN Info Modify date","FN Info Access date","FN Info Entry date","Filename #3","FN Info Creation date","FN Info Modify date","FN Info Access date","FN Info Entry date","Filename #4","FN Info Creation date","FN Info Modify date","FN Info Access date","FN Info Entry date","Standard Information","Attribute List","Filename","Object ID","Volume Name","Volume Info","Data","Index Root","Index Allocation","Bitmap","Reparse Point","EA Information","EA","Property Set","Logged Utility Stream""0","Good","Active","File","5 - 5","1","$MFT","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","2007/07/31 191613.734373","","","","","","","","","","","","","","","","","","","","True","False","False","False","False","False","True","False","False","True","False","False","False","False","False"——-"110575","Good","Inactive","0","5422 - 5426","3","TRANSFERMGR.EXE-24D2A23F.pf","2009/12/27 183557.625000","2009/12/28 053201.390625","2009/12/27 183557.625000","2009/12/28 053201.390625","2009/12/27 183557.625000","2009/12/27 183557.625000","2009/12/27 183557.625000","2009/12/27 183557.625000","","","","","TRANSFERMGR.EXE-24D2A23F.pf","2009/12/27 183557.625000","2009/12/27 183557.625000","2009/12/27 183557.625000","2009/12/27 183557.625000","","","","","","","","","","","True","False","False","False","False","False","True","False","False","False","False","False","False","False","False"SourceanalyzeMFT is Copyright © 2010 David Kovar. All rights reserved. This software is distributed under the Common Public License 1.0.The source code can be downloaded here.BackgroundMy original inspiration was a combination of MFT Ripper (thus the current output format) and the SANS 508.1 study guide. I couldn't bear to read about NTFS structures again, particularly since the information didn't "stick". I also wanted to learn Python so I figured that using it to tear apart the MFT file was a reasonably sized project.Many of the variable names are taken directly from Brian Carrier's The Sleuth Kit. His code, plus his book "File System Forensic Analysis", was very helpful in my efforts to write this code.The output format is almost identical to Mark Menz's MFT Ripper. His tool really inspired me to learn more about the structure of the MFT and to learn what additional information I could glean from the data.I also am getting much more interested in timeline analysis and figured that really understanding the the MFT and having a tool that could parse it might serve as a good foundation for further research in that area.Output from –helpUsage analyzeMFT.py [options]Options-h, –help show this help message and exit-f FILE, –file=FILE read MFT from FILE-o FILE, –output=FILEwrite results to FILE-g, –gui Use GUI for file selection-d, –debug turn on debugging outputPurposeanalyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystemand present the results as accurately as possible in a format that allowsfurther analysis with othe...

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by KPryor 16 years ago

12 Posts

7 Users

0 Reactions

6,220 Views

RSS

douglasbrush

(@douglasbrush)

Prominent Member

Joined: 16 years ago

Posts: 812

25/01/2010 6:59 pm

David-
Well done! Thanks for sharing.

ReplyQuote

KPryor

(@kpryor)

Trusted Member

Joined: 19 years ago

Posts: 68

26/01/2010 12:47 am

Thanks David!
KP

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
270 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed