undefined

undefined

undefined

filename = entry.get_filename()
if filename is None:
    continue

is_deleted = not entry.is_active()
is_directory = entry.is_directory()
created = entry.get_created_timestamp()
modified = entry.get_modified_timestamp()
mft_modified = entry.get_mft_modified_timestamp()
size = entry.get_file_size()

# Flag deleted files for recovery
if is_deleted and not is_directory and size > 0:
    deleted_files.append({
        'filename': filename,
        'size': size,
        'created': str(created),
        'modified': str(modified),
        'entry_number': entry.entry_number
    })

# Detect timestomping (MFT modified time != $SI modified time)
si_modified = entry.get_si_modified_timestamp()
fn_modified = entry.get_fn_modified_timestamp()
if si_modified and fn_modified:
    if abs((si_modified - fn_modified).total_seconds()) > 86400:  # >1 day difference
        suspicious_files.append({
            'filename': filename,
            'si_modified': str(si_modified),
            'fn_modified': str(fn_modified),
            'delta': str(si_modified - fn_modified)
        })

undefined

undefined

undefined

undefined

record_len = struct.unpack_from('<I', data, offset)[0]
if record_len < 56 or record_len > 65536 or offset + record_len > len(data):
    return None, offset + 8

major_ver = struct.unpack_from('<H', data, offset + 4)[0]
if major_ver != 2:
    return None, offset + record_len

mft_ref = struct.unpack_from('<Q', data, offset + 8)[0] & 0xFFFFFFFFFFFF
parent_ref = struct.unpack_from('<Q', data, offset + 16)[0] & 0xFFFFFFFFFFFF
usn = struct.unpack_from('<Q', data, offset + 24)[0]
timestamp = struct.unpack_from('<Q', data, offset + 32)[0]
reason = struct.unpack_from('<I', data, offset + 40)[0]
source_info = struct.unpack_from('<I', data, offset + 44)[0]
security_id = struct.unpack_from('<I', data, offset + 48)[0]
file_attrs = struct.unpack_from('<I', data, offset + 52)[0]
filename_len = struct.unpack_from('<H', data, offset + 56)[0]
filename_off = struct.unpack_from('<H', data, offset + 58)[0]

name = data[offset + filename_off:offset + filename_off + filename_len].decode('utf-16-le', errors='ignore')

# Convert Windows FILETIME to datetime
ts = datetime(1601, 1, 1) + timedelta(microseconds=timestamp // 10)

# Decode reason flags
reasons = []
reason_flags = {
    0x01: 'DATA_OVERWRITE', 0x02: 'DATA_EXTEND', 0x04: 'DATA_TRUNCATION',
    0x10: 'NAMED_DATA_OVERWRITE', 0x20: 'NAMED_DATA_EXTEND',
    0x100: 'FILE_CREATE', 0x200: 'FILE_DELETE', 0x400: 'EA_CHANGE',
    0x800: 'SECURITY_CHANGE', 0x1000: 'RENAME_OLD_NAME', 0x2000: 'RENAME_NEW_NAME',
    0x4000: 'INDEXABLE_CHANGE', 0x8000: 'BASIC_INFO_CHANGE',
    0x10000: 'HARD_LINK_CHANGE', 0x20000: 'COMPRESSION_CHANGE',
    0x40000: 'ENCRYPTION_CHANGE', 0x80000: 'OBJECT_ID_CHANGE',
    0x100000: 'REPARSE_POINT_CHANGE', 0x200000: 'STREAM_CHANGE',
    0x80000000: 'CLOSE'
}
for flag, desc in reason_flags.items():
    if reason & flag:
        reasons.append(desc)

record = {
    'timestamp': ts.strftime('%Y-%m-%d %H:%M:%S'),
    'filename': name,
    'mft_entry': mft_ref,
    'parent_entry': parent_ref,
    'reasons': '|'.join(reasons),
    'usn': usn
}

return record, offset + record_len

undefined

undefined

undefined

File System Artifact Analysis:
  Volume: NTFS (Partition 2, 465 GB)
  Cluster Size: 4096 bytes

  MFT Analysis:
    Total Entries: 456,789
    Active Files: 234,567
    Deleted Entries: 12,345 (8,901 with recoverable metadata)
    Timestomped Files: 23 (SI/FN mismatch detected)

  USN Journal:
    Records Parsed: 2,345,678
    Date Range: 2024-01-01 to 2024-01-20
    File Creations: 45,678
    File Deletions: 23,456
    File Renames: 12,345

  Alternate Data Streams:
    Total ADS Found: 1,234
    Zone.Identifier: 890 (downloaded files)
    Custom/Suspicious ADS: 5 (hidden data detected)

  Slack Space:
    Total Slack: 12.3 GB
    Keyword Hits: 45 (passwords, credit cards)
    Carved Files: 23 from slack space

  Suspicious Findings:
    - 23 files with timestomped timestamps
    - 5 files with hidden ADS containing data
    - USN shows mass deletion on 2024-01-18 (anti-forensics)
    - Slack space contains residual email fragments

  Reports: /cases/case-2024-001/analysis/