{"id":13677495,"url":"https://github.com/thewhiteninja/ntfstool","last_synced_at":"2025-04-29T11:31:14.745Z","repository":{"id":39789347,"uuid":"243850864","full_name":"thewhiteninja/ntfstool","owner":"thewhiteninja","description":"Forensics tool for NTFS (parser, mft, bitlocker, deleted files) ","archived":false,"fork":false,"pushed_at":"2023-07-23T09:51:27.000Z","size":17913,"stargazers_count":478,"open_issues_count":2,"forks_count":95,"subscribers_count":23,"default_branch":"master","last_synced_at":"2024-11-11T19:41:13.965Z","etag":null,"topics":["bitlocker","btree","compressed","disk","efs","fve","gpt","logfile","mbr","mft","ntfs","parser","reparse","smart","sparse","undelete","usn","vbr","vmk","vss"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thewhiteninja.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-02-28T20:41:41.000Z","updated_at":"2024-11-09T23:39:42.000Z","dependencies_parsed_at":"2024-01-14T15:21:31.395Z","dependency_job_id":"fc9f7ec4-61d3-43a0-beb7-880c84f6918a","html_url":"https://github.com/thewhiteninja/ntfstool","commit_stats":null,"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thewhiteninja%2Fntfstool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thewhiteninja%2Fntfstool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thewhiteninja%2Fntfstool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thewhiteninja%2Fntfstool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thewhiteninja","download_url":"https://codeload.github.com/thewhiteninja/ntfstool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251493767,"owners_count":21598165,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitlocker","btree","compressed","disk","efs","fve","gpt","logfile","mbr","mft","ntfs","parser","reparse","smart","sparse","undelete","usn","vbr","vmk","vss"],"created_at":"2024-08-02T13:00:43.053Z","updated_at":"2025-04-29T11:31:09.736Z","avatar_url":"https://github.com/thewhiteninja.png","language":"C++","funding_links":[],"categories":["Challenges","Tools","C++"],"sub_categories":["Windows Artifacts"],"readme":"# ntfstool\n\n[![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE.MIT)\n[![Language: C++](https://img.shields.io/badge/Language-C%2B%2B-brightgreen.svg?tyle=flat-square)](#)\n[![x64](https://img.shields.io/badge/Windows-64_bit-0078d7.svg)](#)\n[![x86](https://img.shields.io/badge/Windows-32_bit-0078d7.svg)](#)\n[![v1.6](https://img.shields.io/badge/Version-1.6-ff5733.svg)](#)\n[![Build](https://ci.appveyor.com/api/projects/status/a3cn5dpdv146tdji?svg=true)](https://ci.appveyor.com/project/thewhiteninja/ntfstool)\n\n\u003cimg align=\"right\" width=\"100\" height=\"100\" src=\"https://cdn-icons-png.flaticon.com/512/3850/3850133.png\"\u003e\n\n\u003cbr /\u003e\n\nNTFSTool is a forensic tool focused on [NTFS][10] volumes.\nIt supports reading partition info (MBR, partition table, VBR) but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more.\n\nDownload the latest binaries on [AppVeyor](https://ci.appveyor.com/project/thewhiteninja/ntfstool) or by checking the last GitHub [artefacts](https://github.com/thewhiteninja/ntfstool/actions).\n\nSee below for some [examples](#examples) of the features!\n\n\n## Features\n\n### Forensics\n\nNTFSTool displays the complete structure of master boot record, volume boot record, partition table and [$MFT][8] file record.\nIt is also possible to dump any file (even $MFT or [SAM][9]) or parse and analyze [USN journal][6], [LogFile][7] including streams from Alternate Data Stream ([ADS][5]). $MFT can be dumped as csv or json with [Zone.Identifier][13] parsing to quickly identify downloaded files.\nThe undelete command will search for any file record marked as \"not in use\" and allow you to retrieve the file (or part of the file if it was already rewritten).\nIt support input from image file, live disk or virtual like [VeraCrypt][11] and [TrueCrypt][12], but you can also use tools like [OSFMount][3] to mount your disk image.\nSparse and compressed files (lznt1, xpress) are also supported. \n\n[3]: https://www.osforensics.com/tools/mount-disk-images.html\n[5]: https://www.sans.org/white-papers/1503/\n[6]: https://docs.microsoft.com/en-gb/windows/win32/fileio/change-journal-records\n[7]: https://dfir.ru/2019/02/16/how-the-logfile-works/\n[8]: https://en.wikipedia.org/wiki/NTFS#Master_File_Table\n[9]: https://en.wikipedia.org/wiki/Security_Account_Manager\n[10]: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc781134(v=ws.10)?redirectedfrom=MSDN\n[11]: https://www.veracrypt.fr/en/Home.html\n[12]: http://truecrypt.sourceforge.net/\n[13]: https://www.digital-detective.net/forensic-analysis-of-zone-identifier-stream/\n\n### Bitlocker support\n\nFor bitlocked partition, it can display FVE records, check a password and key (bek, password, recovery key), extract VMK and FVEK.\nThere is no bruteforce feature because GPU-based cracking is better (see [Bitcracker][1] and [Hashcat][2]) but you can get the hash for these tools.\n\n[1]: https://arxiv.org/pdf/1901.01337\n[2]: https://hashcat.net/hashcat/\n\n### EFS support\n\nMasterkeys, private keys and certificates can be listed, displayed and decrypted using needed inputs (SID, password).\nCertificates with private keys can be exported using the backup command.\n\nReinmport the backup on another machine to be able to read your encrypted file again!\nOr you can use the `efs.decrypt` command to decrypt a file using the backed-up key.\n\nMore information on [Mimikatz Wiki][4] \n\n[4]: https://github.com/gentilkiwi/mimikatz/wiki/howto-~-decrypt-EFS-files#installing-the-pfx\n\n### USN Journal analysis\n\nUSN journal records can be analyzed using custom rules to detect suspicious programs and actions but also to have an overview of the journal (% of file deleted, created ...)\n\nDefault rules: [Rules/default.json](Rules/default.json)\n\n```\n {\n \"id\": \"lsass-dump\",\n \"description\": \"Dumped LSASS.exe process.\",\n \"severity\": \"high\",\n \"rule\": {\n \"filename\": \"lsass(\\\\.(dmp|dump))?\"\n }\n }\n```\n\nSee an example of run here: [usn.analyze](#usn-analyze)\n\n### Shell\n\nThere is a limited shell with few commands (exit, cd, ls, cat, pwd, cp, quit, rec).\n\nCommand `rec` shows the MFT record details.\n\n## Help \u0026 Examples\n\nHelp command displays description and examples for each command.\n\nOptions can be entered as decimal or hex number with \"0x\" prefix (ex: inode).\n\n ntfstool help [command]\n \n| Command | Description |\n| --- | --- |\n| [info](#info) | Display information for all disks and volumes |\n| [mbr](#mbr) | Display MBR structure, code and partitions for a disk |\n| [gpt](#gpt) | Display GPT structure, code and partitions for a disk |\n| [vbr](#vbr) | Display VBR structure and code for a specidifed volume (ntfs, fat32, fat1x, bitlocker supported) |\n| [extract](#extract) | Extract a file from a volume. |\n| [image](#image) | Create an image file of a disk or volume. |\n| [mft.dump](#mft-dump) | Dump $MFT file in specified format: csv, json, raw. |\n| [mft.record](#mft-record) | Display FILE record details for a specified MFT inode. Almost all attribute types supported |\n| [mft.btree](#mft-btree) | Display VCN content and Btree index for an inode |\n| [bitlocker.info](#bitlocker-info) | Display information and hash ($bitlocker$) for all VMK. Test a password or recovery key. |\n| [bitlocker.decrypt](#bitlocker-decrypt) | Decrypt a volume to a file using password, recovery key or bek. |\n| [bitlocker.fve](#bitlocker-fve) | Display information for the specified FVE block. |\n| [efs.backup](#efs-backup) | Export EFS keys in PKCS12 (pfx) format. |\n| [efs.decrypt](#efs-decrypt) | Decrypt EFS encrypted file using keys in PKCS12 (pfx) format. |\n| [efs.certificate](#efs-certificate) | List, display and export system certificates (SystemCertificates/My/Certificates). |\n| [efs.key](#efs-key) | List, display, decrypt and export private keys (Crypto/RSA). |\n| [efs.masterkey](#efs-masterkey) | List, display and decrypt masterkeys (Protect). |\n| [reparse](#reparse) | Parse and display reparse points from \\$Extend\\$Reparse. |\n| [logfile.dump](#logfile-dump) | Dump $LogFile file in specified format: csv, json, raw. |\n| [usn.analyze](#usn-analyze) | Analyze $UsnJrnl file with specified rules. Output : csv or json. |\n| [usn.dump](#usn-dump) | Dump $UsnJrnl file in specified format: csv, json, raw. |\n| [shadow](#shadow) | List volume shadow snapshots from selected disk and volume. |\n| [streams](#streams) | Display Alternate Data Streams |\n| [undelete](#undelete) | Search and extract deleted files for a volume. |\n| [shell](#shell-1) | Start a limited Unix-like shell |\n| [smart](#smart) | Display S.M.A.R.T data |\n\n\n## Limitations\n\n- Some unsupported cases. WIP.\n- No documentation :no_mouth:.\n\nFeel free to open an issue or ask for a new feature!\n\n## Build\n \n- Install [Visual Studio 2022](https://visualstudio.microsoft.com/fr/vs/)\n \n- Install vcpkg (for required third-party libs) as described here: [vcpkg#getting-started](https://github.com/microsoft/vcpkg#getting-started)\n\n\t```\n\tgit clone https://github.com/microsoft/vcpkg\n\t.\\vcpkg\\bootstrap-vcpkg.bat\n\t```\n\n- Integrate it to your VisualStudio env:\n\n\t```\n\tvcpkg integrate install\n\t```\n\nAt build time, VisualStudio will detect the `vcpkg.json` file and install required packages automatically.\n\nThird-party libraries:\n- [openssl](https://www.openssl.org/): OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\n- [nlohmann-json](https://github.com/nlohmann/json): JSON for Modern C++\n- [distorm](https://github.com/gdabah/distorm): Powerful Disassembler Library For x86/AMD64\n- [cppcoro](https://github.com/lewissbaker/cppcoro): A library of C++ coroutine abstractions for the coroutines TS.\n- [re2](https://github.com/google/re2): RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines.\n\n\n## Examples\n\n### Info\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003einfo\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n +-------------------------------------------------------------------------------------+\n | Id | Model | Type | Partition | Size |\n +-------------------------------------------------------------------------------------+\n | 0 | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT | 500107862016 (465.76 GiBs) |\n | 1 | ST2000DM001-1ER164 | Fixed HDD | GPT | 2000398934016 (1.82 TiB) |\n | 2 | 15EADS External | Fixed HDD | MBR | 1500301910016 (1.36 TiB) |\n | 3 | osfdisk | Fixed HDD | MBR | 536870912 (512.00 MiBs) |\n +-------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003einfo disk=3\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Model : osfdisk\n Version : 1\n Serial :\n Media Type : Fixed HDD\n Size : 536870912 (512.00 MiBs)\n Geometry : 512 bytes * 63 sectors * 255 tracks * 65 cylinders\n Volume : MBR\n\n +--------------------------------------------------------------------------------------------------+\n | Id | Boot | Label | Mounted | Filesystem | Offset | Size |\n +--------------------------------------------------------------------------------------------------+\n | 1 | No | NTFSDRIVE | F:\\ | Bitlocker | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |\n +--------------------------------------------------------------------------------------------------+ \n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003einfo disk=3 volume=1\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Serial Number : 0000aa60-00002eae\n Filesystem : Bitlocker\n Bootable : False\n Type : Fixed\n Label : NTFSDRIVE\n Offset : 512 (512.00 bytes)\n Size : 536870400 (512.00 MiBs)\n Free : 519442432 (495.38 MiBs)\n Mounted : True (F:\\)\n Bitlocker : True (Unlocked)\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### MBR\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003embr disk=2\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Disk signature : e4589462\n Reserved bytes : 0000\n \n Partition table :\n +---------------------------------------------------------------------------------------------------+\n | Id | Boot | Flags | Filesystem | First sector | Last sector | Offset | Sectors | Size |\n +---------------------------------------------------------------------------------------------------+\n | 1 | No | Principal | NTFS / exFAT | 0 2 3 | 255 254 255 | 128 | 16771072 | 8.00 GiBs |\n +---------------------------------------------------------------------------------------------------+\n \n MBR signature : 55aa\n \n Strings:\n [63] : Invalid partition table\n [7b] : Error loading operating system\n [9a] : Missing operating system\n \n Disassemble Bootstrap Code [y/N] ? y\n \n 0000 : 33c0 : xor ax, ax\n 0002 : 8ed0 : mov ss, ax\n 0004 : bc007c : mov sp, 0x7c00\n 0007 : 8ec0 : mov es, ax\n 0009 : 8ed8 : mov ds, ax\n 000b : be007c : mov si, 0x7c00\n 000e : bf0006 : mov di, 0x600\n 0011 : b90002 : mov cx, 0x200\n\t... \n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### GPT\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003egpt disk=1\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Signature : EFI PART\n Revision : 1.0\n Header Size : 92\n Header CRC32 : cc72e4d3\n Reserved : 00000000\n Current LBA : 1\n Backup LBA : 3907029167\n First Usable LBA : 34\n Last Usable LBA : 3907029134\n GUID : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}\n Entry LBA : 2\n Entries Num : 128\n Entries Size : 128\n Partitions CRC32 : 0c9a0a25\n\n Partition table : 2 entries\n +------------------------------------------------------------------------------------------------------------------------+\n | Id | Name | GUID | First sector | Last sector | Flags |\n +------------------------------------------------------------------------------------------------------------------------+\n | 1 | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34 | 262177 | 000000000000 |\n | 2 | Basic data partition | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192 | 3907028991 | 000000000000 |\n +------------------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### VBR\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003evbr disk=3 volume=1\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Structure :\n Jump : eb5890 (jmp 0x7c5a)\n OEM id : -FVE-FS-\n BytePerSector : 512\n SectorPerCluster : 8\n Reserved Sectors : 0\n Number of FATs : 0\n Root Max Entries : 0\n Total Sectors : 0\n Media Type : f8\n SectorPerFat : 8160\n SectorPerTrack : 63\n Head Count : 255\n FS Offset : 1\n Total Sectors : 0\n FAT Flags : 0000\n FAT Version : 0000\n Root Cluster : 0\n FS Info Sector : 1\n Backup BootSector: 6\n Reserved : 00000000\n Reserved : 00000000\n Reserved : 00000000\n Drive Number : 80\n Reserved : 00\n Ext. Boot Sign : 29\n Serial Number : 00000000\n Volume Name : NO NAME\n FileSystem Type : FAT32\n Volume GUID : {4967d63b-2e29-4ad8-8399-f6a339e3d001}\n FVE Block 1 : 0000000002100000\n FVE Block 2 : 00000000059e4000\n FVE Block 3 : 00000000092c8000\n End marker : 55aa\n\n Strings:\n [00] : Remove disks or other media. \n [1f] : Disk error \n [2c] : Press any key to restart\n\n Disassemble Bootstrap Code [y/N] ? y\n\n 7c5a : eb58 : jmp 0x7cb4\n 7c5c : 90 : nop\n 7c5d : 2d4656 : sub ax, 0x5646\n 7c60 : 45 : inc bp\n 7c61 : 2d4653 : sub ax, 0x5346\n 7c64 : 2d0002 : sub ax, 0x200\n ...\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### Extract\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eextract disk=0 volume=4 inode=0 output=d:\\mymft\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [-] Record Num : 0 (00000000h)\n [-] Destination : d:\\mymft\n [+] File extracted (5123541 bytes written)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eextract disk=3 volume=1 from=\\bob.txt output=d:\\bob.txt\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{00023d5d-0000-0000-0002-000000000000}\\\n [-] Record Num : 47 (0000002fh)\n [-] Destination : d:\\bob.txt\n [+] File extracted (42 bytes written)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eextract disk=0 volume=4 --system output=d:\\system\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [-] Record Num : 623636 (00098414h)\n [-] Destination : d:\\system\n [+] File extracted (19398656 bytes written)\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### Image\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eimage disk=2 volume=2 output=d:\\imagevol.raw\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\\\n [-] Size : 33520128 (31.97 MiBs)\n [-] BlockSize: 4096\n [+] Copying : [################################] 100% 0s\n [+] Done\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eimage disk=2 output=d:\\image.raw\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\.\\PhysicalDrive2\n [-] Size : 67108864 (64.00 MiBs)\n [-] BlockSize: 4096\n [+] Copying : [################################] 100% 0s\n [+] Done\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### MFT-dump\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003emft.dump disk=2 volume=2 output=d:\\mft.raw\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] $MFT size : 1.00 MiB\n [-] Record size : 1024\n [-] Record count: 1024\n [+] Creating d:\\mft.raw\n [+] Processing data: 1.00 MiB\n [+] Closing volume\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003emft.dump disk=2 volume=2 output=d:\\mft.csv format=csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] $MFT size : 1.00 MiB\n [-] Record size : 1024\n [-] Record count: 1024\n [+] Creating d:\\mft.csv\n [+] Processing data: 1.00 MiB\n [+] Closing volume\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eSample of mft.csv (check the end of the last line for Zone.Identifier data)\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\u003cpre\u003eRecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl\n0,\"True\",\"File\",\"$MFT\",\"\",1048576,\"5\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",0,1,\"\",\"\",\"\",\"\"\n1,\"True\",\"File\",\"$MFTMirr\",\"\",4096,\"5\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",0,1,\"\",\"\",\"\",\"\"\n2,\"True\",\"File\",\"$LogFile\",\"\",67108864,\"5\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",0,1,\"\",\"\",\"\",\"\"\n3,\"True\",\"File\",\"$Volume\",\"\",0,\"5\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"2022-03-17 01:25:10\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"True\",\"False\",0,1,\"\",\"\",\"\",\"\"\n...\n397,\"True\",\"File\",\"vswhere.exe\",\".exe\",457824,\"103911\",\"2020-10-19 18:42:19\",\"2019-06-11 10:07:50\",\"2019-06-11 10:07:52\",\"2021-12-27 14:54:49\",\"True\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",\"False\",35944347632,1,\"Zone.Identifier\",\"3\",\"https://github.com/microsoft/vswhere/releases\",\"https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256\u0026X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request\u0026X-Amz-Date=20190611T100747Z\u0026X-Amz-Expires=300\u0026X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4\u0026X-Amz-SignedHeaders=host\u0026actor_id=40250307\u0026response-content-disposition=attachment%3B%20filename%3Dvswhere.exe\u0026response-content-type=application%2Foctet-stream\"\u003c/pre\u003e\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### MFT-record\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003emft.record disk=2 volume=1 inode=5 (root folder)\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n Signature : FILE\n Update Offset : 48\n Update Number : 3\n $LogFile LSN : 274035114\n Sequence Number : 5\n Hardlink Count : 1\n Attribute Offset : 56\n Flags : In_use | Directory\n Real Size : 704\n Allocated Size : 1024\n Base File Record : 0\n Next Attribute ID : 56\n MFT Record Index : 5\n Update Seq Number : 4461\n Update Seq Array : 00000000\n\n Attributes:\n -----------\n\n +------------------------------------------------------------------------------------------------------------------+\n | Id | Type | Non-resident | Length | Overview |\n +------------------------------------------------------------------------------------------------------------------+\n | 1 | $STANDARD_INFORMATION | False | 72 | File Created Time : 2009-12-02 02:03:31 |\n | | | | | Last File Write Time : 2020-02-24 19:42:23 |\n | | | | | FileRecord Changed Time : 2020-02-24 19:42:23 |\n | | | | | Last Access Time : 2020-02-24 19:42:23 |\n | | | | | Permissions : |\n | | | | | read_only : 0 |\n | | | | | hidden : 1 |\n | | | | | system : 1 |\n | | | | | device : 0 |\n | | | | | normal : 0 |\n | | | | | temporary : 0 |\n | | | | | sparse : 0 |\n | | | | | reparse_point : 0 |\n | | | | | compressed : 0 |\n | | | | | offline : 0 |\n | | | | | not_indexed : 1 |\n | | | | | encrypted : 0 |\n | | | | | Max Number of Versions : 0 |\n | | | | | Version Number : 0 |\n +------------------------------------------------------------------------------------------------------------------+\n | 2 | $FILE_NAME | False | 68 | Parent Dir Record Index : 5 |\n | | | | | Parent Dir Sequence Num : 5 |\n | | | | | File Created Time : 2009-12-02 02:03:31 |\n | | | | | Last File Write Time : 2011-12-24 03:13:12 |\n | | | | | FileRecord Changed Time : 2011-12-24 03:13:12 |\n | | | | | Last Access Time : 1970-01-01 00:59:59 |\n | | | | | Allocated Size : 0 |\n | | | | | Real Size : 0 |\n | | | | | ------ |\n | | | | | Name : . |\n +------------------------------------------------------------------------------------------------------------------+\n | 3 | $OBJECT_ID | False | 16 | Object Unique ID : {cce8fec5-9a29-11df-be68-0017f29 |\n | | | | | 8268d} |\n +------------------------------------------------------------------------------------------------------------------+\n | 4 | $INDEX_ROOT | False | 152 | Attribute Type : 00000030h |\n | | | | | Collation Rule : 1 |\n | | | | | Index Alloc Entry Size : 4096 |\n | | | | | Cluster/Index Record : 1 |\n | | | | | ----- |\n | | | | | First Entry Offset : 16 |\n | | | | | Index Entries Size : 136 |\n | | | | | Index Entries Allocated : 136 |\n | | | | | Flags : Large Index |\n +------------------------------------------------------------------------------------------------------------------+\n | 5 | $INDEX_ALLOCATION | True | 12288 | Index |\n | | | | | 0000000000000004 : $AttrDef |\n | | | | | 0000000000000008 : $BadClus |\n | | | | | 0000000000000006 : $Bitmap |\n | | | | | 0000000000000007 : $Boot |\n | | | | | 000000000000000b : $Extend |\n | | | | | 0000000000000002 : $LogFile |\n | | | | | 0000000000000000 : $MFT |\n | | | | | 0000000000000001 : $MFTMirr |\n | | | | | 000000000000002d : $RECYCLE.BIN |\n | | | | | 0000000000000009 : $Secure |\n | | | | | 000000000000000a : $UpCase |\n | | | | | 0000000000000003 : $Volume |\n | | | | | 0000000000000005 : . |\n | | | | | 000000000000240c : Dir1 |\n | | | | | 0000000000000218 : Dir2 |\n | | | | | 000000000000212a : Dir3 |\n | | | | | 0000000000000024 : Dir4 |\n | | | | | 0000000000000def : RECYCLER |\n | | | | | 000000000000001b : System Volume Information |\n | | | | | 000000000000001b : SYSTEM~1 |\n +------------------------------------------------------------------------------------------------------------------+\n | 6 | $BITMAP | False | 8 | Index Node Used : 2 |\n +------------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### MFT-btree\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003emft.btree disk=0 volume=1 inode=5 (root folder)\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n Attributes:\n -----------\n \n +-------------------------------------------------------------------------------------------+\n | Id | Type | Non-resident | Length | Overview |\n +-------------------------------------------------------------------------------------------+\n | 1 | $INDEX_ROOT | False | 56 | Attribute Type : Filename |\n | | | | | Collation Rule : 1 |\n | | | | | Index Alloc Entry Size : 4096 |\n | | | | | Cluster/Index Record : 1 |\n | | | | | ----- |\n | | | | | First Entry Offset : 16 |\n | | | | | Index Entries Size : 40 |\n | | | | | Index Entries Allocated : 40 |\n | | | | | Flags : Large Index |\n +-------------------------------------------------------------------------------------------+\n | 2 | $INDEX_ALLOCATION | True | 20480 | First VCN : 0x000000000000 |\n | | | | | Last VCN : 0x000000000004 |\n +-------------------------------------------------------------------------------------------+\n \n $INDEX_ALLOCATION entries:\n --------------------------\n \n +--------------------------------------------------------------------------------------------+\n | VCN | Raw address | Size | Entries |\n +--------------------------------------------------------------------------------------------+\n | 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef |\n | | | | 000000000008: $BadClus |\n | | | | 000000000006: $Bitmap |\n \t\t\t\t\t\t...\n | | | | 000000000009: $Secure |\n | | | | 00000000000a: $UpCase |\n | | | | 000000000003: $Volume |\n +--------------------------------------------------------------------------------------------+\n | 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |\n | | | | 000000000097: randomfile - Copie (5).bat |\n | | | | 000000000095: randomfile - Copie (5).psd |\n | | | | 000000000096: randomfile - Copie (5).txt |\n | | | | 00000000009b: randomfile - Copie (6).accdb |\n \t\t\t\t\t\t...\n | | | | 000000000083: randomfile.accdb |\n | | | | 000000000082: randomfile.bat |\n | | | | 000000000084: randomfile.psd |\n | | | | 000000000081: randomfile.txt |\n | | | | 000000000024: System Volume Information |\n +--------------------------------------------------------------------------------------------+\n | 000000000002h | 0000007d6000h | 000000001000h | |\n +--------------------------------------------------------------------------------------------+\n | 000000000003h | 0000007d7000h | 000000001000h | 000000000005: . |\n | | | | 000000000092: randomfile - Copie (4).txt |\n +--------------------------------------------------------------------------------------------+\n | 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder |\n | | | | 00000000008c: randomfile - Copie (2).accdb |\n | | | | 00000000008b: randomfile - Copie (2).bat |\n | | | | 000000000089: randomfile - Copie (2).psd |\n \t\t\t\t\t\t...\n | | | | 00000000008e: randomfile - Copie (3).txt |\n | | | | 000000000094: randomfile - Copie (4).accdb |\n | | | | 000000000093: randomfile - Copie (4).bat |\n | | | | 000000000091: randomfile - Copie (4).psd |\n +--------------------------------------------------------------------------------------------+\n \n B-tree index:\n -------------\n \n Root\n |- 000000000000:\n |---- VCN: 3\n \t |- 000000000005: .\n \t |---- VCN: 0\n \t\t |- 000000000004: $AttrDef\n \t\t |- 000000000008: $BadClus\n \t\t |- 000000000006: $Bitmap\n \t\t ....\n \t\t |- 000000000009: $Secure\n \t\t |- 00000000000a: $UpCase\n \t\t |- 000000000003: $Volume\n \t |- 000000000092: randomfile - Copie (4).txt\n \t |---- VCN: 4\n \t\t |- 000000000027: random folder\n \t\t |- 00000000008c: randomfile - Copie (2).accdb\n \t\t |- 00000000008b: randomfile - Copie (2).bat\n \t\t |- 000000000089: randomfile - Copie (2).psd\n \t\t ....\n \t\t |- 000000000094: randomfile - Copie (4).accdb\n \t\t |- 000000000093: randomfile - Copie (4).bat\n \t\t |- 000000000091: randomfile - Copie (4).psd\n \t |- 000000000000 (*)\n \t |---- VCN: 1\n \t\t |- 000000000098: randomfile - Copie (5).accdb\n \t\t |- 000000000097: randomfile - Copie (5).bat\n \t\t |- 000000000095: randomfile - Copie (5).psd\n \t\t ....\n \t\t |- 000000000084: randomfile.psd\n \t\t |- 000000000081: randomfile.txt\n \t\t |- 000000000024: System Volume Information\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### Bitlocker-Info\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003ebitlocker.info disk=3 volume=1\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n FVE Version : 2\n State : ENCRYPTED\n Size : 536870400 (512.00 MiBs)\n Encrypted Size : 536870400 (512.00 MiBs)\n Algorithm : AES-XTS-128\n Timestamp : 2020-02-26 16:39:17\n\n Volume Master Keys:\n -------------------\n\n +--------------------------------------------------------------------------------------------------------------------+\n | Id | Type | GUID | Details |\n +--------------------------------------------------------------------------------------------------------------------+\n | 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | Nonce : 01d5ecbb00f7155000000003 |\n | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |\n | | | | Encrypted Key : b76281568419ec3bee89d1eddccf3169 |\n | | | | 59c466b6b392f40f0875e58168d868d7 |\n | | | | 0788bd366bec117b11a9fd6e |\n | | | | |\n | | | | JtR Hash : $bitlocker$1$16$daea96439babc5d1 |\n | | | | e7f20c8860ff1ee9$1048576$12$5015 |\n | | | | f700bbecd50103000000$60$175ec23c |\n | | | | d799e2bde9d24bf3697919feb7628156 |\n | | | | 8419ec3bee89d1eddccf316959c466b6 |\n | | | | b392f40f0875e58168d868d70788bd36 |\n | | | | 6bec117b11a9fd6e |\n +--------------------------------------------------------------------------------------------------------------------+\n | 2 | Recovery Password | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | Nonce : 01d5ecbb00f7155000000006 |\n | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |\n | | | | Encrypted Key : 97a43d40c695c6d190eba3956ac7c7b1 |\n | | | | f5fdbbc7f9a61a77c914fa347479c7ac |\n | | | | 6124ff46865e805367f7bef1 |\n | | | | |\n | | | | JtR Hash : $bitlocker$1$16$b9963d29e1bad1f4 |\n | | | | 2e60c3bfb6e3bef5$1048576$12$5015 |\n | | | | f700bbecd50106000000$60$3a06a06f |\n | | | | db044d850ecd6faf5cf2aec997a43d40 |\n | | | | c695c6d190eba3956ac7c7b1f5fdbbc7 |\n | | | | f9a61a77c914fa347479c7ac6124ff46 |\n | | | | 865e805367f7bef1 |\n +--------------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003ebitlocker.info disk=3 volume=1 password=badpassword\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n FVE Version : 2\n State : ENCRYPTED\n Size : 536870400 (512.00 MiBs)\n Encrypted Size : 536870400 (512.00 MiBs)\n Algorithm : AES-XTS-128\n Timestamp : 2020-02-26 16:39:17\n\n Tested Password:\n ----------------\n\n +--------------------------------------------------------------------------------+\n | Id | Type | GUID | Password | Result |\n +--------------------------------------------------------------------------------+\n | 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | badpassword | Invalid |\n +--------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003ebitlocker.info disk=3 volume=1 password=123456789\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n FVE Version : 2\n State : ENCRYPTED\n Size : 536870400 (512.00 MiBs)\n Encrypted Size : 536870400 (512.00 MiBs)\n Algorithm : AES-XTS-128\n Timestamp : 2020-02-26 16:39:17\n\n Tested Password:\n ----------------\n\n +--------------------------------------------------------------------------------------------------------------+\n | Id | Type | GUID | Password | Result |\n +--------------------------------------------------------------------------------------------------------------+\n | 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 123456789 | Valid |\n | | | | | |\n | | | | | VMK : 751bf363db63ba6f1b36fb2ecd5ff1d8 |\n | | | | | f5eab77e8754a848f2743978c7615f9f |\n | | | | | FVEK : 35b8197e6d74d8521f49698d5f556589 |\n | | | | | 2cf286ae5323c65631965c905a9d7da4 |\n +--------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### Bitlocker-Decrypt\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003ebitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{09a02598-0000-0000-0002-000000000000}\\\n [+] Reading Bitlocker VBR\n [-] Volume State : ENCRYPTED\n [-] Size : 536870400 (512.00 MiBs)\n [-] Encrypted Size : 536870400 (512.00 MiBs)\n [-] Algorithm : AES-XTS-128\n [+] Decrypting sectors\n [-] Processed data size : 512.00 MiBs (100%)\n [+] Duration : 7535ms\n [+] Closing Volume\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### Bitlocker-FVE\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003ebitlocker.fve disk=3 volume=1 fve_block=2\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n Signature : -FVE-FS-\n Size : 57\n Version : 2\n Current State : ENCRYPTED (4)\n Next State : ENCRYPTED (4)\n Encrypted Size : 536870400 (512.00 MiBs)\n Convert Size : 0\n Backup Sectors : 16\n FVE Block 1 : 0000000002100000\n FVE Block 2 : 00000000059e4000\n FVE Block 3 : 00000000092c8000\n Backup Sectors Offset : 0000000002110000\n\n FVE Metadata Header\n -------------------\n\n Size : 840\n Version : 1\n Header Size : 48\n Copy Size : 840\n Volume GUID : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}\n Next Counter : 10\n Algorithm : AES-XTS-128 (8004)\n Timestamp : 2020-02-26 16:39:17\n\n FVE Metadata Entries (5)\n ------------------------\n\n +----------------------------------------------------------------------------------------------------------------+\n | Id | Version | Size | Entry Type | Value Type | Value |\n +----------------------------------------------------------------------------------------------------------------+\n | 1 | 1 | 72 | Drive Label | Unicode | String : TWN NTFSDRIVE 26/02/2020 |\n +----------------------------------------------------------------------------------------------------------------+\n | 2 | 1 | 224 | VMK | VMK | Key ID : {2dd368f3-37d7-414f-94e6-3c5b86f |\n | | | | | | add50} |\n | | | | | | Last Change : 2020-02-26 16:40:00 |\n | | | | | | Protection : Password |\n | | | | | | |\n | | | | | | Property #1 - Stretch Key - 108 |\n | | | | | | -------- |\n | | | | | | Encryption : STRETCH KEY |\n | | | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |\n | | | | | | |\n | | | | | | Property #1.1 - AES-CCM - 80 |\n | | | | | | -------- |\n | | | | | | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000002 |\n | | | | | | MAC : 1dfebdc79a966e72ca806d6a83d8c7ba |\n | | | | | | Key : eb51a188df981b54f51698c76d76a8bb |\n | | | | | | d22afbbe27603ea6afc34c077726262e |\n | | | | | | 5ba07482053d3c36fdecf80f |\n | | | | | | |\n | | | | | | Property #2 - AES-CCM - 80 |\n | | | | | | -------- |\n | | | | | | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000003 |\n | | | | | | MAC : 175ec23cd799e2bde9d24bf3697919fe |\n | | | | | | Key : b76281568419ec3bee89d1eddccf3169 |\n | | | | | | 59c466b6b392f40f0875e58168d868d7 |\n | | | | | | 0788bd366bec117b11a9fd6e |\n +----------------------------------------------------------------------------------------------------------------+\n | 3 | 1 | 316 | VMK | VMK | Key ID : {19b4a3e2-94b3-452f-a614-6212fae |\n | | | | | | b1b9d} |\n | | | | | | Last Change : 2020-02-26 16:40:07 |\n | | | | | | Protection : Recovery Password |\n | | | | | | |\n | | | | | | Property #1 - Stretch Key - 172 |\n | | | | | | -------- |\n | | | | | | Encryption : STRETCH KEY |\n | | | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |\n | | | | | | |\n | | | | | | Property #1.1 - AES-CCM - 64 |\n | | | | | | -------- |\n | | | | | | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000004 |\n | | | | | | MAC : 8064d679c7d8d1fa8ae548b0844882c7 |\n | | | | | | Key : 18d21021d40e3dc99d38c8dd84faed10 |\n | | | | | | 370c32095f4f63261ad8ec40 |\n | | | | | | |\n | | | | | | Property #1.2 - AES-CCM - 80 |\n | | | | | | -------- |\n | | | | | | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000005 |\n | | | | | | MAC : 3d40f2b5fc0091b894b438763fcdf4cd |\n | | | | | | Key : a0af0aeda32d977d26ac76f9fc429668 |\n | | | | | | 955d2a6a49fe4e2323751924e47e6c39 |\n | | | | | | 8c22f7fcd2d4272003cb7a4e |\n | | | | | | |\n | | | | | | Property #2 - AES-CCM - 80 |\n | | | | | | -------- |\n | | | | | | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000006 |\n | | | | | | MAC : 3a06a06fdb044d850ecd6faf5cf2aec9 |\n | | | | | | Key : 97a43d40c695c6d190eba3956ac7c7b1 |\n | | | | | | f5fdbbc7f9a61a77c914fa347479c7ac |\n | | | | | | 6124ff46865e805367f7bef1 |\n | | | | | | |\n | | | | | | Property #3 - Recovery Backup - 28 |\n | | | | | | -------- |\n | | | | | | Location : File |\n | | | | | | Start : 2022-04-03 12:52:50 |\n | | | | | | End : 2022-04-03 12:52:50 |\n +----------------------------------------------------------------------------------------------------------------+\n | 4 | 1 | 80 | FKEV | AES-CCM | Nonce as Hex : 01d5ecbb00f71550 |\n | | | | | | Nonce as Time : 2020-02-26 16:39:59 |\n | | | | | | Nonce Counter : 00000008 |\n | | | | | | MAC : 2ff7d7f79920e3509fb8d20cb15b62c8 |\n | | | | | | Key : 097169b9a5c41420ed2353a4a4210763 |\n | | | | | | a8833d1a4a88c6f7c0c45ec7c0959f25 |\n | | | | | | 2c8eac3f306e9fd1e693784a |\n +----------------------------------------------------------------------------------------------------------------+\n | 5 | 1 | 100 | Volume Header Block | Offset and Size | Offset : 0000000002110000 |\n | | | | | | Size : 0000000000002000 |\n +----------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### EFS-backup\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eefs.backup disk=0 volume=4 password=123456\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Listing user directories\n 8 directories found\n [+] Searching for certificates\n - 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B\n [+] Finding corresponding private keys\n - 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a\n [+] Finding corresponding masterkeys\n - 9ac19509-54d3-48bc-8c67-4cfb01d73498\n [+] Exporting 1 certificates and keys (pass: backup)\n - ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok\n Exported to 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### EFS-decrypt\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eefs.decrypt disk=0 volume=4 from=c:\\cat.png pfx=z:\\my_backup.pfx password=backup output=c:\\socute.png\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Loading PKCS12 input file\n [-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b\n [-] Reading record: 13525\n [+] Parsing $EFS streams\n [-] 1 data decryption field(s) found\n [+] Decrypting FEK\n [-] FEK\n +----------------------------------------------------------------------------------+\n | Property | Value |\n +----------------------------------------------------------------------------------+\n | Entropy | 32 |\n | Algorithm | CALG_AES_256 |\n | Key (256bits) | 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |\n +----------------------------------------------------------------------------------+\n [+] Decrypting file\n [-] Decrypted file written to c:\\socute.png (1.94 MiB)\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### EFS-certificate\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eefs.certificate disk=0 volume=4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Listing user directories\n 8 directories found\n [+] Searching for certificates\n 8 certificate(s) found\n [+] Certificates\n +-----------------------------------------------------------------------------------------------------------------------------------+\n | Id | User | File | Certificate |\n +-----------------------------------------------------------------------------------------------------------------------------------+\n | 0 | Bobby | Name : 02728B6DF5573C5955A4DFF22319441C889C367B | Friendly Name : APNS certificate Direct |\n | | | Record : 00000001d2d5h | |\n | | | Size : 850.00 bytes | |\n | | | | |\n | | | Creation : 2019-05-11 15:59:29 | |\n +-----------------------------------------------------------------------------------------------------------------------------------+\n | 1 | Bobby | Name : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Friendly Name : APNS certificate |\n | | | Record : 00000000b5a4h | |\n | | | Size : 824.00 bytes | |\n | | | | |\n | | | Creation : 2021-03-03 18:02:33 | |\n +-----------------------------------------------------------------------------------------------------------------------------------+\n | 2 | Bobby | Name : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Container : ef456e5b-36e4-4eda-a80b-e234611306d4 |\n | | | Record : 00000000ab23h | Provider : Microsoft Enhanced Cryptographic Provider v1.0 |\n | | | Size : 1.15 KiB | Type : PROV_RSA_FULL |\n | | | | KeySpec : AT_KEYEXCHANGE |\n | | | Creation : 2020-08-17 13:20:03 | |\n +-----------------------------------------------------------------------------------------------------------------------------------+\n ..........\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eefs.certificate disk=0 volume=4 inode=0xb5a4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading certificate file record: 46500\n [+] Certificate\n +--------------------------------------------------------------------------------------------------------------------------+\n | Id | Property | Value |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 0 | File | Creation : 2021-03-03 18:02:33 |\n | | | Size : 824.00 bytes |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 1 | SHA1_HASH_PROP_ID | 14A67663C51C66FF5CAD89B4DC34495864338C67 |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 2 | FRIENDLY_NAME_PROP_ID | APNS certificate |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 3 | KEY_IDENTIFIER_PROP_ID | 82B87AE4F2251242252A2644D98169F34F909CA8 |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 4 | SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID | DB532C4794A15E5D0392C7C605FCBCA8 |\n +--------------------------------------------------------------------------------------------------------------------------+\n | 5 | CERTIFICATE_FILE | Data: |\n | | | Version: 3 (0x2) |\n | | | Serial Number: |\n | | | 01:20:cb:ab:28:8a:97:ee:99:cc |\n | | | Signature Algorithm: sha1WithRSAEncryption |\n | | | Issuer: C=US, O=Apple Inc., OU=Apple iPhone, CN=Apple iPhone Device CA |\n | | | Validity |\n | | | Not Before: Mar 3 15:57:33 2021 GMT |\n | | | Not After : Mar 3 16:02:33 2022 GMT |\n | | | Subject: CN=1A6032AA-91A2-4B1D-B6AF-5509FC173686 |\n | | | Subject Public Key Info: |\n | | | Public Key Algorithm: rsaEncryption |\n | | | RSA Public-Key: (1024 bit) |\n | | | Modulus: |\n | | | 00:a2:75:db:69:8d:c9:b3:fd:96:4d:28:b9:43:94: |\n | | | db:7d:73:53:88:c9:79:e9:fa:de:e4:12:14:2c:de: |\n ...\n | | | a7:6b:d0:01:9e:dc:66:27:ef:2e:20:7e:e5:2a:42: |\n | | | 9e:6f:85:9c:b6:8f:be:d3:05 |\n | | | Exponent: 65537 (0x10001) |\n | | | X509v3 extensions: |\n | | | X509v3 Authority Key Identifier: |\n | | | keyid:B2:FE:21:23:44:86:95:6A:79:D5:81:26:8E:73:10:D8:A7:4C:8E:74 |\n | | | X509v3 Subject Key Identifier: |\n | | | 82:B8:7A:E4:F2:25:12:42:25:2A:26:44:D9:81:69:F3:4F:90:9C:A8 |\n | | | X509v3 Basic Constraints: critical |\n | | | CA:FALSE |\n | | | X509v3 Key Usage: critical |\n | | | Digital Signature, Key Encipherment |\n | | | X509v3 Extended Key Usage: critical |\n | | | TLS Web Server Authentication, TLS Web Client Authentication |\n | | | 1.2.840.113635.100.6.10.6: |\n | | | .. |\n | | | Signature Algorithm: sha1WithRSAEncryption |\n | | | 28:54:6c:d9:4e:97:f5:dd:1f:79:4a:6a:74:42:ad:6e:a1:11: |\n ...\n | | | 27:58:3b:d5:1e:c3:71:af:6b:bd:fe:5d:ad:4d:bd:82:fa:53: |\n | | | ff:0c |\n +--------------------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eefs.certificate disk=0 volume=4 inode=0xb5a4 output=mycert\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading certificate file record: 46500\n [+] Certificate exported to mycert.pem\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### EFS-key\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eefs.key disk=0 volume=4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n\t[+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\n\t[+] Listing user directories: \n\t 8 directories found\n\t[+] Searching for keys\n\t 9713 key(s) found\n\t[+] Keys\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| Id | User | Keyfile | Name | Creation Date |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 0 | User1 | Name : 0004f7ed30db...017ee8d52ca6 | {15676EB3-D258-410F-85CB-9AB29E642CB3} | 2021-05-19 14:10:15 |\n\t| | | Record : 0000000246c5h | | |\n\t| | | Size : 4.00 KiBs | | |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 1 | User1 | Name : 0016875547ba...f7a9606b4177 | {BA4B66DC-8C1D-4FDF-A1EF-78B64411D1AD} | 2020-02-03 19:37:39 |\n\t| | | Record : 000000019f19h | | |\n\t| | | Size : 4.00 KiBs | | |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 2 | User1 | Name : 002a02ec680e...9a0a8d52ca67 | {3A3E1CF2-5AC2-4717-8006-D7C0F2936435} | 2019-06-26 15:50:50 |\n ..........\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eefs.key disk=0 volume=4 inode=742107\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n\t[+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n\t[+] Reading key file record: 742107\n\t[+] Key\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| Id | Property | Value |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 0 | File | Creation : 2021-09-23 22:16:43 |\n\t| | | Size : 4.00 KiBs |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 1 | Version | 0 |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 2 | Name | ef456e5b-43e4-4eda-a80b-e234611306d4 |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 3 | Flags | 00000000h |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 4 | PublicKey | Magic : 31415352h (RSA1) |\n\t| | | Size : 2048 |\n\t| | | Exponent : 65537 |\n\t| | | |\n\t| | | Permissions : CRYPT_ENCRYPT |\n\t| | | CRYPT_DECRYPT |\n\t| | | CRYPT_EXPORT |\n\t| | | CRYPT_READ |\n ...\n\t| | | |\n\t| | | Modulus : 96883F07FF78DA8354D037A94F897BD7 |\n\t\t\t\t\t\t\t ...\n\t| | | FA77A3D04DD10D044761E65355B335B5 |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 5 | Encrypted PrivateKey | Version : 1 |\n\t| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |\n\t| | | MasterKey Version : 1 |\n\t| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |\n\t| | | |\n\t| | | Description : Clé privée CryptoAPI |\n\t| | | Flags : 00000000h |\n\t| | | |\n\t| | | Encryption Alg : CALG_AES_256 |\n\t| | | Hash Alg : CALG_SHA_512 |\n\t| | | |\n\t| | | Salt : ABABD5324CCE0254BC726C3BF5A777D38BC4D75CACC2360EF3276EB4DC42FF6A |\n\t| | | |\n\t| | | HMAC : - |\n\t| | | HMAC2 : D24F0B0AF684AE986F1328EAAFC01DA346D2BADE2B84CBE3C94CCB338D449EA6 |\n\t| | | |\n\t| | | Encrypted Data : D7DAD9229C91DBC9608852A4411527D7 |\n\t| | | 58DB27E19596DD118F2D70F68CC7913C |\n\t\t\t\t\t\t\t ...\n\t| | | 7870F6C68DA1B9139BF6E39725F4E72E |\n\t| | | 4EC435C947F127CA3E333CB5E2F43978 |\n\t| | | |\n\t| | | Signature Data : 6077C027E6714A81C2710C5D334758F9AD463117DA4CBA8D0D05B5845A662E8F |\n\t| | | 5E38DCCAB05DA5DD6C8328F5CF925F378F229790D30A2BCC91D5E3370AE50FED |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 6 | Hash | 0000000000000000000000000000000000000000 |\n\t+------------------------------------------------------------------------------------------------------------------+\n\t| 7 | ExportFlag | Version : 1 |\n\t| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |\n\t| | | MasterKey Version : 1 |\n\t| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |\n\t| | | |\n\t| | | Description : Export Flag |\n\t| | | Flags : 00000000h |\n\t| | | |\n\t| | | Encryption Alg : CALG_AES_256 |\n\t| | | Hash Alg : CALG_SHA_512 |\n\t| | | |\n\t| | | Salt : 772935C3582F625367716CE87D9626A524F15B9B7FF07166BB2C704B1223CB06 |\n\t| | | |\n\t| | | HMAC : - |\n\t| | | HMAC2 : 3BCA74ED2C83767F06D9FF907817FE85FBA65FDB72A94E9D8F2C7CF1D8E7DCA2 |\n\t| | | |\n\t| | | Encrypted Data : 875A6429226F11DFD3690D43BE633287 |\n\t| | | |\n\t| | | Signature Data : FD97F69A214C37D0DA968B5AA18EE7C80D475F72F650C8DCAE887C97E850DCD6 |\n\t| | | 9FA17D397A2375E362DE6F17193E3D084C06B0DCDB38E6C746150C1056145178 |\n\t+------------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e efs.key disk=0 volume=4 inode=742107 masterkey=34fac126105ce30...178c5bff4979eb\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading key file record: 742107\n [-] Key\n\t Encryption Algorithm : CALG_AES_256\n\t Hash Algorithm : CALG_SHA_512\n\t Salt : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A\n [+] Decrypting key\n [+] Key successfully decrypted\n [+] Export flags : 00000001 (ALLOW_EXPORT_FLAG)\n [+] Clear key (2048bits) :\n\t +----------------------------------------------------------+\n\t | Id | Property | Value |\n\t +----------------------------------------------------------+\n\t | 0 | Magic | RSA2 |\n\t +----------------------------------------------------------+\n\t | 1 | Bitsize | 2048 |\n\t +----------------------------------------------------------+\n\t | 2 | Exponent | 65537 |\n\t +----------------------------------------------------------+\n\t | 3 | Modulus | 96883F07FF78DA8354D037A94F897BD7 |\n ...\n\t | | | FA77A3D04DD10D044761E65355B335B5 |\n\t +----------------------------------------------------------+\n\t | 4 | Prime1 | C02F585644ED6326FF82368B0AD9ECD4 |\n ...\n\t | | | 65F7DE6D173FEBEF95BE491FB222E07B |\n\t +----------------------------------------------------------+\n\t | 5 | Prime2 | C884376BBC50C2A14C495894FBF980DE |\n ...\n\t | | | 6759E812B6385B9151EBED8DCD65238F |\n\t +----------------------------------------------------------+\n\t | 6 | Exponent1 | 0E33B17876918051427271EB667AE238 |\n ...\n\t | | | 69349EF83ACE9B75D20004D155CDA3FF |\n\t +----------------------------------------------------------+\n\t | 7 | Exponent2 | 5BF265077E1EFA60C47E8DA423B751A4 |\n ...\n\t | | | E7008F2EA5684A74E4BFEEFAAB48C979 |\n\t +----------------------------------------------------------+\n\t | 8 | Coefficient | 7D68AA3844F096959C23BD59E4BE3147 |\n ...\n\t | | | 592ABC1BEDEBA6F5B4BDE3D0F9BEF7C5 |\n\t +----------------------------------------------------------+\n\t | 9 | Private Exponent | 2462A061AD85A7C3B0DF7764CC5DDDFA |\n\t | | | 40D83B3FBF0D9D016C419E6B6744AD73 |\n ...\n\t | | | 47685BDEB0FABDC21AF5CABBA13D138D |\n\t | | | F39FC063F1F20323E3220229E29FA42D |\n\t +----------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e efs.key disk=0 volume=4 inode=742107 masterkey=34...eb output=mykey\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading key file record: 742107\n [-] Key\n Encryption Algorithm : CALG_AES_256\n Hash Algorithm : CALG_SHA_512\n Salt : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A\n [+] Decrypting key\n [+] Key successfully decrypted\n [+] Public key exported to mykey.pub.pem.\t \n [+] Private key exported to mykey.priv.pem.\t \n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### EFS-masterkey\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eefs.masterkey disk=0 volume=4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Listing user directories\n 8 directories found\n [+] Searching for keys\n 19 key(s), 2 preferred file(s) found\n [+] MasterKeys\n +--------------------------------------------------------------------------------------------------------------------------------------------------+\n | Id | User | Keyfile | Key(s) | Creation Date |\n +--------------------------------------------------------------------------------------------------------------------------------------------------+\n | 0 | DefaultAppPool | Name : e4ed144f-6522-4471-8893-a6e29e175ba6 | MasterKey | 2021-08-17 14:54:41 |\n | | | Record : 000000031848h | Version : 2 | |\n | | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |\n | | | | Salt : FA737C82899CC3F61A3B332B15FDC241 | |\n | | | | Rounds : 8000 | |\n | | | | BackupKey | |\n | | | | Version : 2 | |\n | | | | Algo : CALG_SHA_512 - CALG_AES_256 | |\n | | | | Salt : DF0651C903763132BC3043BF144A7DDD | |\n | | | | Rounds : 8000 | |\n | | | | CredHist | |\n | | | | Version : 3 | |\n | | | | GUID : {00000000-0000-0000-0000-000000000000} | |\n +--------------------------------------------------------------------------------------------------------------------------------------------------+\n | 1 | DefaultAppPool | Name : Preferred | Preferred | 2021-08-17 14:54:41 |\n | | | Record : 00000003184ah | GUID : {e4ed144f-6522-4471-8893-a6e29e175ba6} | |\n | | | Size : 24.00 bytes | Renew : 2021-11-15 12:54:41 | |\n +--------------------------------------------------------------------------------------------------------------------------------------------------+\n | 2 | Bob | Name : 26bd8b3d-e87f-4df3-a1af-18f434788090 | MasterKey | 2021-03-05 01:16:42 |\n | | | Record : 000000004f4ah | Version : 2 | |\n | | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |\n | | | | Salt : 39B575D1816DE8224B9E11C38E35EB34 | |\n | | | | Rounds : 8000 | |\n | | | | BackupKey | |\n ..........\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eefs.masterkey disk=0 volume=4 inode=0x80544\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading masterkey file record: 525636\n [+] MasterKey\n +--------------------------------------------------------------------+\n | Id | Property | Value |\n +--------------------------------------------------------------------+\n | 0 | File | Creation : 2020-07-06 05:56:06 |\n | | | Size : 468.00 bytes |\n +--------------------------------------------------------------------+\n | 1 | Version | 2 |\n +--------------------------------------------------------------------+\n | 2 | GUID | 9ac19509-54d3-48bc-8c67-4cfb01d73498 |\n +--------------------------------------------------------------------+\n | 3 | Policy | 00000005h |\n +--------------------------------------------------------------------+\n | 4 | MasterKey | Version : 2 |\n | | | Salt : 3ED4CDBCC4073D6724A512061D0597E1 |\n | | | Rounds : 8000 |\n | | | Hash Alg : CALG_SHA_512 |\n | | | Enc Alg : CALG_AES_256 |\n | | | Enc Key : 3610946FE1A7B9099D0AFA7658325014 |\n | | | 296D1F0E5BA93249858BE3ACCC8FD7A8 |\n | | | F62DB6808833FC303095C6588BDE3826 |\n | | | 80ABF391222CD77661BCCB637DDAC490 |\n | | | B5FC02C854EF45490EE10851EF524DE2 |\n | | | 85DD508F905216D528D3DC3336830FF9 |\n | | | 690472730A03D64CF892E06B9AA35692 |\n | | | AB7679E908D487119030B73CB87E6F9F |\n | | | 731F65609CB8ACA972BCC9042B27B9B4 |\n +--------------------------------------------------------------------+\n | 5 | BackupKey | Version : 2 |\n | | | Salt : B60E21F9578D02A97964D7B10151BE69 |\n | | | Rounds : 8000 |\n | | | Hash Alg : CALG_SHA_512 |\n | | | Enc Alg : CALG_AES_256 |\n | | | Enc Key : CD5D3684873D6A1D66520FB1642779E1 |\n | | | D78A649F02DDFE7C069F9B5F8FF9F005 |\n | | | 7DC01E0A6AA9A815C8887BC1BF5B88E6 |\n | | | E797DC5F4A3A0535B3217BADC7FAD38E |\n | | | 798C1846423C8631DE472D790B308B2D |\n | | | F15340B87FCD55A98DAEE92196235CF9 |\n | | | B328FAF475C05A911DF19C99D54D5A3C |\n +--------------------------------------------------------------------+\n | 6 | CredHist | Version : 3 |\n | | | GUID : {20e0b482-797f-429e-b4a0-30020731ef0a} |\n +--------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e efs.masterkey disk=0 volume=4 inode=0x80544 sid=\"S-1-5-21-1521398...3175218-1001\" password=\"ntfst00l\"\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\t\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading masterkey file record: 525636\n [-] Masterkey\n Encryption Algorithm : CALG_AES_256\n Hash Algorithm : CALG_SHA_512\n Rounds : 8000\n Salt : 3ED4CDBCC4073D6724A512061D0597E1\n [+] Decrypting masterkey\n [+] Clear masterkey (256bits):\n 34FAC126105CE302421A0FC7E3933FEC5639AA6BFF95000E6DA83AE67522EAB6\n 0AF58A27D834883B65611878B258AAAECD8983E3718E00F276178C5BFF4979EB\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### Reparse\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003ereparse disk=0 volume=4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Reading $Extend\\$Reparse\n [+] 104 entries found\n +----------------------------------------------------------------------------------------------------------------+\n | Id | MFT Index | Filename | Type | Target/Data |\n +----------------------------------------------------------------------------------------------------------------+\n | 0 | 00000eb3 | debian.exe | AppExecLink | TheDebianProject.DebianGNULinux_ |\n | | | | | 76v4gfsz19hv4 |\n | | | | | |\n | | | | | TheDebianProject.DebianGNULinux_ |\n | | | | | 76v4gfsz19hv4!debian |\n | | | | | |\n | | | | | C:\\Program Files\\WindowsApps\\The |\n | | | | | DebianProject.DebianGNULinux_1.2 |\n | | | | | .0.0_x64__76v4gfsz19hv4\\debian.e |\n | | | | | xe |\n +----------------------------------------------------------------------------------------------------------------+\n ...\n +----------------------------------------------------------------------------------------------------------------+\n | 13 | 000007f9 | BaseLayer | Mount Point | \\??\\Volume{629458e4-0000-0000-00 |\n | | | | | 00-010000000000}\\ |\n +----------------------------------------------------------------------------------------------------------------+\n | 14 | 00013e24 | Watchdog | Mount Point | \\??\\C:\\Program Files\\NVIDIA Corp |\n | | | | | oration\\NvContainer\\Watchdog |\n +----------------------------------------------------------------------------------------------------------------+\n ...\n +----------------------------------------------------------------------------------------------------------------+\n | 102 | 00035861 | C2R64.dll | Symbolic Link | \\??\\C:\\Program Files\\Common File |\n | | | | | s\\Microsoft Shared\\ClickToRun\\C2 |\n | | | | | R64.dll |\n +----------------------------------------------------------------------------------------------------------------+\n | 103 | 000986b0 | All Users | Symbolic Link | \\??\\C:\\ProgramData |\n +----------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### Logfile-dump\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003elogfile.dump disk=4 volume=1 output=logfile.csv format=csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n [+] Opening \\\\?\\Volume{00000001-0000-0000-0000-000000000000}\\\n [+] Reading $LogFile record\n [-] $LogFile size : 4.14 MiBs\n [+] Parsing $LogFile Restart Pages\n [-] Newest Restart Page LSN : 5274485\n [-] Volume marked as cleanly unmounted\n [-] Client found : [1] NTFS\n [+] Parsing $LogFile Record Pages\n [-] $LogFile Record Page Count: 86\n [+] Parsing $LogFile Records: 601\n [+] Closing volume\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eSample of logfile.csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\u003cpre\u003eLSN,ClientPreviousLSN,UndoNextLSN,ClientID,RecordType,TransactionID,RedoOperation,UndoOperation,MFTClusterIndex,TargetVCN,TargetLCN\n5269000,5268967,5268967,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700\n5269019,5269000,5269000,0,1,24,UpdateNonresidentValue,Noop,0,0,37594\n5269044,5269019,5269019,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700\n5269063,5269044,5269044,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700\n5269082,5269063,5269063,0,1,24,UpdateNonresidentValue,Noop,0,0,37594\n5269103,5269082,5269082,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700\n5269122,5269103,0,0,1,24,ForgetTransaction,CompensationLogRecord,0,0,18446744073709551615\n5269133,0,0,0,1,24,UpdateResidentValue,UpdateResidentValue,2,13,43703\u003c/pre\u003e\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### USN-analyze\n\u003ctable\u003e\n\t\u003ctr\u003e\u003ctd\u003eFrom dump : usn.analyze from=usn_dump rules=d:\\rules.json output=d:\\usn_analyze_results.csv format=csv\u003c/td\u003e\u003c/tr\u003e\n\t\u003ctr\u003e\u003c/tr\u003e\n\t\u003ctr\u003e\u003ctd\u003eFrom running system : usn.analyze disk=4 volume=1 rules=d:\\rules.json output=d:\\usn_analyze_results.csv format=csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n\n\n [+] Loading rules from: d:\\rules.json\n [-] 4 rules loaded\n [+] Creating d:\\usn_analyze_results.csv\n [-] Mode: fast\n [+] Opening \\\\?\\Volume{498eed94-0000-0000-007e-000000000000}\\\n [+] Searching for $Extend\\$UsnJrnl\n [-] Found in file record: 116\n [-] $J stream size: 31.70 KiBs (could be sparse)\n [+] Processing USN records: 192 (31.70 KiBs) - 9 matches\n [+] Closing volume\n [+] Summary:\n +------------------------------------------------------+\n | Index | Category | Value | % |\n +------------------------------------------------------+\n | 0 | file creation | 125 | 65.10 |\n | 1 | file deletion | 0 | 0.00 |\n | 2 | file rename | 8 | 4.17 |\n | 3 | latest | 2022-03-28 23:23:12 | |\n | 4 | oldest | 2022-03-28 13:20:08 | |\n | 5 | records count | 192 | 100.00 |\n +------------------------------------------------------+\n [+] Rules results:\n +------------------------------------------+\n | Index | Rule ID | Count | % |\n +------------------------------------------+\n | 0 | executable-create | 9 | 4.69 |\n | 1 | ccleaner | 2 | 1.04 |\n | 2 | lsass-dump | 1 | 0.52 |\n +------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n### USN-dump\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eusn.dump disk=4 volume=1 output=usn.csv format=csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] Finding $Extend\\$UsnJrnl record\n [+] Found in file record: 88008\n [+] $J stream size: 60.24 GiBs (could be sparse)\n [+] Creating d:\\mft_c.csv\n [+] Loading $MFT records\n [+] Processing $MFT records: 1.37 GiB\n [+] 1436928 record loaded\n [+] Processing entry: 322667 (34.12 MiBs)\n [+] Closing volume\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eSample of usn.csv\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\u003cpre\u003eMajorVersion,MinorVersion,FileReferenceNumber,FileReferenceSequenceNumber,ParentFileReferenceNumber,ParentFileReferenceSequenceNumber,Usn,Timestamp,Reason,SourceInfo,SecurityId,FileAttributes,Filename\n2,0,53,4,5,5,0,2020-02-26 21:43:36,FILE_CREATE,0,0,DIRECTORY,volume:\\Nouveau dossier\n2,0,53,4,5,5,96,2020-02-26 21:43:36,FILE_CREATE+CLOSE,0,0,DIRECTORY,volume:\\Nouveau dossier\n2,0,53,4,5,5,192,2020-02-26 21:43:38,RENAME_OLD_NAME,0,0,DIRECTORY,volume:\\Nouveau dossier\n2,0,53,4,5,5,288,2020-02-26 21:43:38,RENAME_NEW_NAME,0,0,DIRECTORY,volume:\\test\n2,0,53,4,5,5,360,2020-02-26 21:43:38,RENAME_NEW_NAME+CLOSE,0,0,DIRECTORY,volume:\\test\n2,0,53,4,5,5,432,2020-02-26 21:43:39,OBJECT_ID_CHANGE,0,0,DIRECTORY,volume:\\test\n2,0,53,4,5,5,504,2020-02-26 21:43:39,OBJECT_ID_CHANGE+CLOSE,0,0,DIRECTORY,volume:\\test\n2,0,54,2,53,4,576,2020-02-26 21:43:41,FILE_CREATE,0,0,ARCHIVE,volume:\\test\\Nouveau document texte.txt\u003c/pre\u003e\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Shadow\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003eshadow disk=0 volume=4\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [+] VSS header found at 0x1e00\n\n +---------------------------------------------------------------------------------------------------------------+\n | SetID/ID | Count | Date | Details |\n +---------------------------------------------------------------------------------------------------------------+\n | {857c9ac4-ee4f-4bc6-b822-59e935a7120f} | 1 | 2020-09-21 00:15:38 | Service Machine : WORK-PC10 |\n | | | | Originating Machine: WORK-PC10 |\n | {3d102db1-8de2-4e7d-8ba5-e0dd4f67740d} | | | State : Created |\n | | | | Flags : 0x0042000d |\n | | | | - Persistent |\n | | | | - Client Accessible |\n | | | | - No Auto Release |\n | | | | - Differential |\n | | | | - Auto Recover |\n +---------------------------------------------------------------------------------------------------------------+\n | {83bc8af4-8802-4466-ae38-717f6474616a} | 1 | 2020-09-22 06:10:00 | Service Machine : WORK-PC10 |\n | | | | Originating Machine: WORK-PC10 |\n | {e668c329-66a2-4ebd-beef-3c6bca81cbf7} | | | State : Created |\n | | | | Flags : 0x0042000d |\n | | | | - Persistent |\n | | | | - Client Accessible |\n | | | | - No Auto Release |\n | | | | - Differential |\n | | | | - Auto Recover |\n +---------------------------------------------------------------------------------------------------------------+\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/table\u003e\n\n### Streams\n\u003ctable\u003e\n\u003ctr\u003e\u003ctd\u003estreams disk=0 volume=4 from=c:\\test.pdf\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003e\n \n [+] Opening \\\\?\\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\\\n [-] Source : c:\\test.pdf\n [-] Record Num : 13525 (000034d5h)\n [+] Alternate data stream(s):\n +-----------------------------+\n | Id | Na","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthewhiteninja%2Fntfstool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthewhiteninja%2Fntfstool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthewhiteninja%2Fntfstool/lists"}