<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ntfs-artifacts
description: >-
  NTFS file system forensic analysis including $MFT parsing, $UsnJrnl change
  journal examination, $LogFile transaction analysis, alternate data streams
  detection, timestomping identification via $STANDARD_INFORMATION vs
  $FILE_NAME comparison, and file system timeline reconstruction.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - ntfs
  - mft
  - usn-journal
  - alternate-data-streams
  - timestomping
  - file-system-forensics
  - sleuth-kit
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1070.006", "T1564.004", "T1036"]
  nist-csf: ["RS.AN-3", "RS.AN-4"]
  frameworks: ["NIST SP 800-86"]
---

# Analyzing NTFS Artifacts

## Overview

NTFS stores rich metadata across multiple system files that persist evidence
of file creation, modification, deletion, and renaming. This skill covers
parsing the Master File Table ($MFT), examining the USN Change Journal
($UsnJrnl:$J), detecting alternate data streams (ADS), identifying
timestomping through $SI/$FN timestamp comparison, and extracting deleted
file entries for recovery.

## Prerequisites

- Sleuth Kit (`icat`, `fls`, `istat`, `mmls`)
- `analyzeMFT` or `MFTECmd` (Eric Zimmerman)
- `usn.py` or `MFTECmd --$J` for USN Journal parsing
- Python 3.10+ with `python-ntfs` library
- Mounted or raw NTFS image

```bash
sudo apt install sleuthkit
pip install analyzeMFT python-ntfs
```

## Key Concepts

### NTFS System Files

| File | MFT Entry | Purpose |
|------|-----------|---------|
| `$MFT` | 0 | Master File Table — metadata for every file |
| `$MFTMirr` | 1 | Backup of first 4 MFT entries |
| `$LogFile` | 2 | Transaction log for journaling |
| `$Volume` | 3 | Volume label and version |
| `$AttrDef` | 4 | Attribute definitions |
| `.` (root) | 5 | Root directory |
| `$Bitmap` | 6 | Cluster allocation bitmap |
| `$Boot` | 7 | Boot sector |
| `$BadClus` | 8 | Bad cluster tracking |
| `$Secure` | 9 | Security descriptors |
| `$UpCase` | 10 | Unicode uppercase mapping |
| `$Extend` | 11 | Extension directory ($UsnJrnl, $ObjId, $Quota) |

### MFT Entry Attributes

```
$STANDARD_INFORMATION (0x10): timestamps, flags, owner
$FILE_NAME (0x30):           timestamps, name, parent ref
$DATA (0x80):                file content (resident or non-resident)
$ATTRIBUTE_LIST (0x20):      list of attributes when entry spans MFT records
```

### Timestomping Detection

Attackers modify `$STANDARD_INFORMATION` timestamps (easily changed) but
cannot modify `$FILE_NAME` timestamps without raw disk access:

```
Legitimate file:
  $SI Created:  2026-01-15 10:00:00  ≈  $FN Created:  2026-01-15 10:00:00

Timestomped file:
  $SI Created:  2020-06-01 00:00:00  ≠  $FN Created:  2026-03-17 14:30:00
  → $FN is later than $SI = timestomping indicator
```

## Workflow

### Step 1: Extract $MFT from Image

```bash
# Find NTFS partition offset
mmls evidence.dd

# Extract $MFT (MFT entry 0, inode 0)
icat -o 2048 evidence.dd 0 > MFT_extracted

# Extract $UsnJrnl:$J
# First find the inode for $UsnJrnl:$J
fls -o 2048 evidence.dd | grep -i extend
icat -o 2048 evidence.dd 62-128-4 > usnjrnl.bin
```

### Step 2: Parse MFT Records

```bash
# analyzeMFT — CSV output
analyzeMFT.py -f MFT_extracted -o mft_parsed.csv

# MFTECmd (Eric Zimmerman) — more detailed
MFTECmd.exe -f MFT_extracted --csv . --csvf mft_output.csv
MFTECmd.exe -f MFT_extracted --body . --bodyf mft_body.csv --bdl C:
```

### Step 3: Detect Alternate Data Streams

```bash
# List all files including ADS
fls -r -o 2048 evidence.dd | grep -i "ads\|:"

# Extract ADS content
icat -o 2048 evidence.dd <inode>:<ads_name> > ads_content.bin

# Common malicious ADS patterns
# notepad.exe:malware.exe
# document.pdf:hidden_payload
# Desktop.ini:Zone.Identifier (legitimate — marks internet-downloaded files)
```

### Step 4: Detect Timestomping

```python
import csv
from datetime import datetime


def detect_timestomping(mft_csv: str) -> list[dict]:
    """Compare $SI and $FN timestamps to detect timestomping."""
    suspicious = []
    with open(mft_csv) as f:
        reader = csv.DictReader(f)
        for row in reader:
            si_created = row.get("SI_CTime", "")
            fn_created = row.get("FN_CTime", "")
            if not si_created or not fn_created:
                continue
            try:
                si_dt = datetime.fromisoformat(si_created)
                fn_dt = datetime.fromisoformat(fn_created)
                delta = abs((fn_dt - si_dt).total_seconds())
                if delta > 3600 and fn_dt > si_dt:
                    suspicious.append({
                        "file": row.get("Filename", ""),
                        "si_created": si_created,
                        "fn_created": fn_created,
                        "delta_seconds": delta,
                        "indicator": "FN_Created after SI_Created",
                    })
            except (ValueError, TypeError):
                continue
    return suspicious
```

### Step 5: Timeline from $UsnJrnl

```bash
# Parse USN Journal
usn.py -f usnjrnl.bin -o usn_parsed.csv

# Key USN reason codes:
# 0x00000100 — FILE_CREATE
# 0x00000200 — FILE_DELETE
# 0x00001000 — RENAME_OLD_NAME
# 0x00002000 — RENAME_NEW_NAME
# 0x80000000 — CLOSE
```

## Detection

```yaml
title: Ntfs Artifacts Detection
id: 268597e6-2366-47dc-aef7-768e7ae51f90
status: experimental
description: Detects suspicious activity related to analyzing ntfs artifacts techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*ntfs*"
  condition: selection
level: medium
tags:
  - attack.t1070.006
  - attack.t1564.004
  - attack.t1036
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] $MFT extracted and parsed with all attributes
- [ ] $SI vs $FN timestamp comparison completed for timestomping detection
- [ ] Alternate data streams enumerated and suspicious ones extracted
- [ ] $UsnJrnl parsed for file creation/deletion/rename events
- [ ] Deleted file entries identified in MFT (allocated flag = 0)
- [ ] File system timeline reconstructed with bodyfile and mactime

## References

- [Sleuth Kit — NTFS Analysis](https://wiki.sleuthkit.org/index.php?title=NTFS)
- [analyzeMFT](https://github.com/dkovar/analyzeMFT)
- [Eric Zimmerman Tools — MFTECmd](https://ericzimmerman.github.io/)
- [NTFS Documentation — libyal](https://github.com/libyal/libfsntfs)
- [MITRE T1070.006 — Timestomp](https://attack.mitre.org/techniques/T1070/006/)
