INDXRipper
Find index entries in $INDEX_ALLOCATION attributes
Timeline created using mactime.pl on the combined output of INDXRipper and fls.
See: sleuthkit
Motivation
$INDEX_ALLOCATION attributes are used by NTFS directories to store index entries for the files in the directory.
A file's index entry contains the following information:
- File name
- File size
- Allocated size of file (size on disk)
- A set of MACB timestamps
The slack space of these attributes may contain index entries of deleted files, even after thier MFT record was recycled. Finding these index entries may help you prove a file existed on a system.
How it works
INDXRipper scans the MFT for records of directories that have an $INDEX_ALLOCATION attribute. If it finds such a record, it searches the attribute for file references to this record. Since the index entries in the attribute represent children of the directory, the $FILE_NAME attributes in them must contain this file reference.
This way, It is able to find entries most other tools aren't.
Finding the full paths of directories is done by using the parent directory reference in $FILE_NAME attributes inside the MFT records.
Features and Details
These are pretty standard but here's a list anyways
- Applies fixups for index records and mft records.
- Supports $INDEX_ALLOCATION and $FILE_NAME attributes in extension records
- Supports unicode filenames
- Index entries from orphan directories are listed under "/$Orphan"
- Provides bodyfile output for supertimeline creation
- Works on live windows systems using the "\\.\" notation
- All times outputted are UTC times
Installation
Python 3.8 or above is required.
Use the package manager pip to install construct.
pip install construct==2.10.56
Alternatively, you can use the Windows standalone executable.
Usage
# process dead disk image, get all index entries
python INDXRipper.py ntfs.part.001 output.csv
# process live system, slack space only, bodyfile output, append "C:" to all the paths
python INDXRipper.py -m C: --slack-only --bodyfile \\.\C: output.bodyfile
Limitations
Entries that are partially overitten may not be found. If they are found, though, the tool may give you false information
What this tool doesn't do
- This tool doesn't process $INDEX_ROOT attributes. You won't see an output for every file on the volume
- This tool doesn't carve $INDEX_ALLOCATION attributes. It won't find attributes that thier MFT entry was recycled.
2.5k Dec 29, 2022
1.8k Jan 2, 2023
62 Nov 18, 2022
753 Dec 23, 2022
1 Nov 17, 2021
0 Dec 31, 2021
9 Dec 12, 2022
2 Jan 8, 2022
1 Jan 11, 2022
1 Jan 10, 2022
6 May 15, 2022
540 Jan 5, 2023
3.1k Jan 1, 2023
40 Oct 21, 2022
235 Dec 24, 2022
7.8k Jan 6, 2023
2 Aug 03, 2022
34 Dec 27, 2022
2.1k Dec 31, 2022
3.5k Dec 30, 2022
67 Dec 01, 2022
1 Nov 17, 2022
1 Jan 22, 2022
4 Jan 27, 2022
30 Sep 23, 2022
4 Jan 30, 2022
76 Nov 25, 2022
13 Jul 05, 2022
2 Oct 31, 2022
3 Dec 04, 2021
6 Dec 14, 2022
1.2k Jan 03, 2023
4 Dec 11, 2019
15 Sep 14, 2022
1 Jan 08, 2022
8 Mar 13, 2022