Analiza e Kohëzgjatjes NTFS

The NTFS Master File Table (MFT) records every file and directory on a Windows volume along with its timestamps, sizes and attributes.

Each MFT record contains four timestamps known as the MACB set: Modified (content changed), Accessed, Changed (metadata changed) and Born (created). Additionally, NTFS keeps a second set of timestamps in the $FILE_NAME attribute which Windows updates less often than the primary $STANDARD_INFO attribute. Attackers who timestomp files with tools like SetMACE usually modify only $STANDARD_INFO, leaving a detectable delta between the two sets. Tools like Plaso (log2timeline), MFTECmd and analyzeMFT extract the MFT and produce a supertimeline that combines MFT timestamps with event logs, prefetch files, USN journal, registry hives and browser history. The analyst then pivots around a suspected compromise time to see what was created, executed or modified within that window. A well-constructed timeline turns an ocean of artifacts into a narrative of the incident. Beyond the MFT, valuable Windows artifacts include the Prefetch folder (recently executed programs), ShimCache and AmCache (program execution history), UserAssist registry keys, the ShellBags (folder browsing history) and the Windows Event Log. Learning to correlate these across a timeline is the core craft of a disk forensics analyst.

Mjete:

• Sleuth Kit (fls, icat, mmls).
• Autopsy — GUI mbi Sleuth Kit.
• MFTECmd, Timeline Explorer (Eric Zimmerman tools).

Ekstraktim i MFT dhe ndërtim timeline:

mmls disk.img                # partitions
fls -r -m C: -o 2048 disk.img > body.txt
mactime -b body.txt > timeline.csv

Me MFTECmd:

MFTECmd.exe -f \ --csv C:\out --csvf mft.csv

1. Nxirr MFT-në nga një imazh laboratorik dhe gjej file-at e fshirë në 1 orë të fundit.
2. Identifiko timestomping duke krahasuar me .

• Brian Carrier — "File System Forensic Analysis".
• Eric Zimmerman tools.