<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing NTFS Artifacts

## Sleuth Kit — NTFS Commands

### icat — Extract file content by inode

```bash
# Extract $MFT (inode 0)
icat -o <sector_offset> image.dd 0 > MFT_extracted

# Extract $UsnJrnl:$J (inode 62, attribute 128, data stream 4)
icat -o <sector_offset> image.dd 62-128-4 > usnjrnl.bin

# Extract $LogFile (inode 2)
icat -o <sector_offset> image.dd 2 > logfile.bin

# Extract specific file by inode
icat -o <sector_offset> image.dd 12345 > recovered_file.bin
```

### fls — List files and directories

```bash
# Recursive file listing
fls -r -o <sector_offset> image.dd

# List deleted files only
fls -r -d -o <sector_offset> image.dd

# Long format with timestamps
fls -r -l -o <sector_offset> image.dd

# Generate bodyfile for timeline
fls -r -m "C:" -o <sector_offset> image.dd > bodyfile.txt
```

### istat — Display inode metadata

```bash
# Show full MFT entry details (timestamps, attributes, data runs)
istat -o <sector_offset> image.dd 12345
```

Output includes: `$STANDARD_INFORMATION` timestamps, `$FILE_NAME` timestamps,
`$DATA` attribute runs, and attribute list.

### mactime — Generate timeline from bodyfile

```bash
mactime -b bodyfile.txt -d 2026-03-01..2026-03-17 > timeline.csv
mactime -b bodyfile.txt -z UTC > full_timeline.csv
```

## analyzeMFT

```bash
# Parse $MFT to CSV
analyzeMFT.py -f MFT_extracted -o mft.csv

# Include full paths
analyzeMFT.py -f MFT_extracted -o mft.csv -p
```

**CSV columns:** Record Number, Good, Active, Record type, Sequence Number,
Parent Folder Record Number, SI Created, SI Modified, SI Accessed, SI Entry,
FN Created, FN Modified, FN Accessed, FN Entry, Filename, ...

## MFTECmd (Eric Zimmerman)

```bash
# Parse MFT to CSV
MFTECmd.exe -f MFT_extracted --csv . --csvf mft_output.csv

# Parse MFT and generate bodyfile
MFTECmd.exe -f MFT_extracted --body . --bodyf body.csv --bdl C:

# Parse $J (USN Journal)
MFTECmd.exe -f MFT_extracted --$J usnjrnl.bin --csv . --csvf usn_output.csv
```

## USN Journal Reason Codes

| Code | Meaning |
|------|---------|
| `0x00000001` | DATA_OVERWRITE |
| `0x00000002` | DATA_EXTEND |
| `0x00000004` | DATA_TRUNCATION |
| `0x00000100` | FILE_CREATE |
| `0x00000200` | FILE_DELETE |
| `0x00000400` | EA_CHANGE |
| `0x00000800` | SECURITY_CHANGE |
| `0x00001000` | RENAME_OLD_NAME |
| `0x00002000` | RENAME_NEW_NAME |
| `0x00004000` | INDEXABLE_CHANGE |
| `0x00010000` | BASIC_INFO_CHANGE |
| `0x00020000` | HARD_LINK_CHANGE |
| `0x00040000` | COMPRESSION_CHANGE |
| `0x00080000` | ENCRYPTION_CHANGE |
| `0x80000000` | CLOSE |

## NTFS Attribute Type IDs

| ID | Name | Description |
|----|------|-------------|
| `0x10` | $STANDARD_INFORMATION | Timestamps, flags, owner |
| `0x20` | $ATTRIBUTE_LIST | Multi-record attribute list |
| `0x30` | $FILE_NAME | Name and parent reference |
| `0x40` | $OBJECT_ID | Unique object identifier |
| `0x50` | $SECURITY_DESCRIPTOR | ACL and ownership |
| `0x60` | $VOLUME_NAME | Volume label |
| `0x70` | $VOLUME_INFORMATION | Version info |
| `0x80` | $DATA | File content |
| `0x90` | $INDEX_ROOT | Directory B-tree root |
| `0xA0` | $INDEX_ALLOCATION | Directory B-tree nodes |
| `0xB0` | $BITMAP | Allocation bitmap |
| `0xC0` | $REPARSE_POINT | Symbolic links, junctions |
