<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Anti-Forensics Detection

## Sleuth Kit — MFT Analysis

```bash
# Extract MFT
icat -o OFFSET evidence.dd 0 > MFT

# List files with timestamps
fls -r -m "/" -o OFFSET evidence.dd > bodyfile.txt
mactime -b bodyfile.txt > timeline.csv

# Extract specific file by inode
icat -o OFFSET evidence.dd INODE > extracted_file
```

## analyzeMFT

```bash
analyzeMFT.py -f MFT -o mft.csv
# Output columns include SI Created, SI Modified, FN Created, FN Modified
```

## log2timeline / plaso

```bash
log2timeline.py --storage-file timeline.plaso evidence.dd
psort.py -w timeline.csv timeline.plaso
psort.py -w timeline.json -o json_line timeline.plaso
```

## foremost / scalpel

```bash
foremost -t all -i evidence.dd -o ./carved/
foremost -t jpg,png,pdf -i evidence.dd -o ./carved/

scalpel evidence.dd -o ./scalpel_output/
# Configure /etc/scalpel/scalpel.conf for file types
```

## rkhunter / chkrootkit

```bash
rkhunter --check --sk --rwo
rkhunter --update
chkrootkit -r /mnt/evidence/
```

## ADS Tools

```bash
# Sleuth Kit
fls -r -o OFFSET evidence.dd | grep ":"

# Windows PowerShell
Get-Item -Path file.txt -Stream *
Get-Content -Path file.txt -Stream Zone.Identifier

# Linux (NTFS-3G mount)
getfattr -d -m ".*" /mnt/ntfs/file.txt
```

## Event Log Analysis

```python
import Evtx.Evtx as evtx
with evtx.Evtx('Security.evtx') as log:
    for record in log.records():
        xml = record.xml()
        # Event 1102 = Security log cleared
        # Event 104  = System log cleared
```

## System Binary Verification

```bash
rpm -Va 2>/dev/null             # RPM-based systems
debsums -c 2>/dev/null          # Debian-based systems
sha256sum /usr/bin/* > baseline_hashes.txt
```
