Find index entries in $INDEX_ALLOCATION attributes

Overview

INDXRipper

Find index entries in $INDEX_ALLOCATION attributes

screenshot

Timeline created using mactime.pl on the combined output of INDXRipper and fls.
See: sleuthkit

Motivation

$INDEX_ALLOCATION attributes are used by NTFS directories to store index entries for the files in the directory.

A file's index entry contains the following information:

  • File name
  • File size
  • Allocated size of file (size on disk)
  • A set of MACB timestamps

The slack space of these attributes may contain index entries of deleted files, even after thier MFT record was recycled. Finding these index entries may help you prove a file existed on a system.

How it works

INDXRipper scans the MFT for records of directories that have an $INDEX_ALLOCATION attribute. If it finds such a record, it searches the attribute for file references to this record. Since the index entries in the attribute represent children of the directory, the $FILE_NAME attributes in them must contain this file reference.

This way, It is able to find entries most other tools aren't.
Finding the full paths of directories is done by using the parent directory reference in $FILE_NAME attributes inside the MFT records.

Features and Details

These are pretty standard but here's a list anyways

  • Applies fixups for index records and mft records.
  • Supports $INDEX_ALLOCATION and $FILE_NAME attributes in extension records
  • Supports unicode filenames
  • Index entries from orphan directories are listed under "/$Orphan"
  • Provides bodyfile output for supertimeline creation
  • Works on live windows systems using the "\\.\" notation
  • All times outputted are UTC times

Installation

Python 3.8 or above is required.
Use the package manager pip to install construct.

pip install construct==2.10.56

Alternatively, you can use the Windows standalone executable.

Usage

# process dead disk image, get all index entries
python INDXRipper.py ntfs.part.001 output.csv

# process live system, slack space only, bodyfile output, append "C:" to all the paths
python INDXRipper.py -m C: --slack-only --bodyfile \\.\C: output.bodyfile

Limitations

Entries that are partially overitten may not be found. If they are found, though, the tool may give you false information

What this tool doesn't do

  • This tool doesn't process $INDEX_ROOT attributes. You won't see an output for every file on the volume
  • This tool doesn't carve $INDEX_ALLOCATION attributes. It won't find attributes that thier MFT entry was recycled.

License

MIT

You might also like...
Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes

Bleach Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. Bleach can also linkify text safely, appl

Tweak the form field rendering in templates, not in python-level form definitions. CSS classes and HTML attributes can be altered.

django-widget-tweaks Tweak the form field rendering in templates, not in python-level form definitions. Altering CSS classes and HTML attributes is su

Allow foreign key attributes in list_display with '__'

django-related-admin Allow foreign key attributes in Django admin change list list_display with '__' This is based on DjangoSnippet 2996 which was mad

Tweak the form field rendering in templates, not in python-level form definitions. CSS classes and HTML attributes can be altered.

django-widget-tweaks Tweak the form field rendering in templates, not in python-level form definitions. Altering CSS classes and HTML attributes is su

Fader Networks: Manipulating Images by Sliding Attributes - NIPS 2017
Fader Networks: Manipulating Images by Sliding Attributes - NIPS 2017

FaderNetworks PyTorch implementation of Fader Networks (NIPS 2017). Fader Networks can generate different realistic versions of images by modifying at

Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes

Bleach Bleach is an allowed-list-based HTML sanitizing library that escapes or strips markup and attributes. Bleach can also linkify text safely, appl

This is an example of how to automate Ridit Analysis for a dataset with large amount of questions and many item attributes

This is an example of how to automate Ridit Analysis for a dataset with large amount of questions and many item attributes

dta Convert Dict To Attributes!

dta (Dict to Attributes) dta is very small dict (or json) to attributes converter. It is only have 1 files and applied to every python versions.

SAN for Product Attributes Prediction
SAN for Product Attributes Prediction

SAN Heterogeneous Star Graph Attention Network for Product Attributes Prediction This repository contains the official PyTorch implementation for ADVI

It is a Blender Tool which can convert the Object Data Attributes in face corner to the UVs or Vertex Color.

Blender_ObjectDataAttributesConvertTool It is a Blender Tool which can convert the Object Data Attributes in face corner to the UVs or Vertex Color. D

Two predictive attributes (Speed and Angle) and one attribute target (Power)

Two predictive attributes (Speed and Angle) and one attribute target (Power). A container crane has the function of transporting containers from one point to another point. The difficulty of this task lies in the fact that the container is connected to the bridge crane by cables causing an opening angle while the container is being transported, interfering with the operation at high speeds due to oscillation that occurs at the end point, which could cause accidents.

Pcos-prediction - Predicts the likelihood of Polycystic Ovary Syndrome based on patient attributes and symptoms
Pcos-prediction - Predicts the likelihood of Polycystic Ovary Syndrome based on patient attributes and symptoms

PCOS Prediction 🥼 Predicts the likelihood of Polycystic Ovary Syndrome based on

A very simple tool to rewrite parameters such as attributes and constants for OPs in ONNX models. Simple Attribute and Constant Modifier for ONNX.
A very simple tool to rewrite parameters such as attributes and constants for OPs in ONNX models. Simple Attribute and Constant Modifier for ONNX.

sam4onnx A very simple tool to rewrite parameters such as attributes and constants for OPs in ONNX models. Simple Attribute and Constant Modifier for

Foreign exchange rates, Bitcoin price index and currency conversion using ratesapi.io

forex-python Forex Python is a Free Foreign exchange rates and currency conversion. Note: Install latest forex-python==1.1 to avoid RatesNotAvailableE

The Python Package Index
The Python Package Index

Warehouse Warehouse is the software that powers PyPI. See our development roadmap, documentation, and architectural overview. Getting Started You can

Get Air Quality Index for your city/country 😷
Get Air Quality Index for your city/country 😷

Air Quality Index CLI Get Air Quality index for your City. Installation $ pip install air-quality-cli Contents Air Quality Index CLI Installation Cont

A Python media index

pyvideo https://pyvideo.org is simply an index of Python-related media records. The raw data being used here comes out of the pyvideo/data repo. Befor

Scan, index, and archive all of your paper documents
Scan, index, and archive all of your paper documents

[ en | de | el ] Important news about the future of this project It's been more than 5 years since I started this project on a whim as an effort to tr

A Python media index

pyvideo https://pyvideo.org is simply an index of Python-related media records. The raw data being used here comes out of the pyvideo/data repo. Befor

Comments
  • Issue running on SIFT: ModuleNotFoundError: No module named 'construct'

    Issue running on SIFT: ModuleNotFoundError: No module named 'construct'

    When running INDXParser.py against both a single E01 and a series of split E01 files, I am presented with the following error:

    INDXRipper: error: invalid volume boot record
    

    All of the following command produce the same error Single E01:

    python3.9 ../tools/INDXRipper/INDXRipper.py /mnt/hgfs/testing/Disk1.E01 outfile
    

    Split E01, with offset (2048)

    python3.9 ../tools/INDXRipper/INDXRipper.py -o 2048 /mnt/hgfs/testing/Disk2-Collection/Disk2.E01 outfile
    

    Split E01, with calculated offset (2048x512)

    python3.9 ../tools/INDXRipper/INDXRipper.py -o 1048576 /mnt/hgfs/testing/Disk2-Collection/Disk2.E01 outfile
    
    help wanted 
    opened by ezaspy 8
  • construct.core.StreamError: Error in path (parsing)

    construct.core.StreamError: Error in path (parsing)

    I have followed the updated instructions for setting up a venv and have ran into the following error:

    $ sudo venv/bin/python tools/INDXRipper/INDXRipper.py -w csv -o 576716800 /mnt/i30_disk1.E01/ewf1 outfile
    Traceback (most recent call last):
      File "/opt/elrond/elrond/tools/INDXRipper/INDXRipper.py", line 309, in <module>
        main()
      File "/opt/elrond/elrond/tools/INDXRipper/INDXRipper.py", line 300, in main
        vbr = get_boot_sector(raw_image, args.o * args.b)
      File "/opt/elrond/elrond/tools/INDXRipper/ntfs.py", line 160, in get_boot_sector
        return BOOT_SECTOR.parse_stream(raw_image)
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 300, in parse_stream
        return self._parsereport(stream, context, "(parsing)")
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 312, in _parsereport
        obj = self._parse(stream, context, path)
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 2120, in _parse
        subobj = sc._parsereport(stream, context, path)
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 312, in _parsereport
        obj = self._parse(stream, context, path)
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 4101, in _parse
        stream_read(stream, pad, path)
      File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 91, in stream_read
        raise StreamError("stream read less than specified amount, expected %d, found %d" % (length, len(data)), path=path)
    construct.core.StreamError: Error in path (parsing)
    stream read less than specified amount, expected 3, found 0
    

    I have two offsets for the disk:

    • 2048 (x512) = 1048576
    • 1126400 (x512) = 576716800

    And I can't not run it as sudo, as the mount point permissions for /mnt/i30_disk1/ewf1 cannot be altered:

    chmod: changing permissions of '/mnt/i30_disk1.E01': Function not implemented
    chmod: changing permissions of '/mnt/i30_disk1.E01/ewf1': Function not implemented
    
    opened by ezaspy 2
Releases(v5.2.7)
Owner
Forensic Analyst
null
PyPIContents is an application that generates a Module Index from the Python Package Index (PyPI) and also from various versions of the Python Standard Library.

PyPIContents is an application that generates a Module Index from the Python Package Index (PyPI) and also from various versions of the Python Standar

Collage Labs 10 Nov 19, 2022
PyPI package for scaffolding out code for decision tree models that can learn to find relationships between the attributes of an object.

Decision Tree Writer This package allows you to train a binary classification decision tree on a list of labeled dictionaries or class instances, and

null 2 Apr 23, 2022
A simple tool to update bib entries with their official information (e.g., DBLP or the ACL anthology).

Rebiber: A tool for normalizing bibtex with official info. We often cite papers using their arXiv versions without noting that they are already PUBLIS

(Bill) Yuchen Lin 2k Jan 1, 2023
Journey is a journaling app where users can create their own journal and entries in it!

Journey is a journaling app where users can create their own journal and entries in it!

Hieu Ma 8 Dec 12, 2021
Autofill HZDR Zeitman entries

Zeitman_autofill Filling out Zeitman is boring. This script might make some of the pain go away. Requirements The selenium package and Chrome webdrive

Tim Callow 8 Mar 14, 2022
A Flask web application that manages student entries in a SQL database

Student Database App This is a Flask web application that manages student entries in a SQL database. Users can upload a CSV into the SQL database, mak

rebecca 1 Oct 20, 2021
Mini Tool to lovers of debe from eksisozluk (one of the most famous website -reffered as collaborative dictionary like reddit- in Turkey) for pushing debe (Most Liked Entries of Yesterday) to kindle every day via Github Actions.

debe to kindle Mini Tool to lovers of debe from eksisozluk (one of the most famous website -refered as collaborative dictionary like reddit- in Turkey

null 11 Oct 11, 2022
Trace all method entries and exits, the exit also prints the return value, if it is of basic type

Trace all method entries and exits, the exit also prints the return value, if it is of basic type. The apk must have set the android:debuggable="true" flag.

Kurt Nistelberger 7 Aug 10, 2022
An open source raffle bot made to increase the chance of winning limited sneaker raffles by automating entries.

?? SyneziaRaffles An open source raffle bot made to increase the chance of winning limited sneaker raffles by automating entries. ??‍♂️ Quick Start Pr

Alexis M. 29 Dec 22, 2022