New Technology File System

• In NTFS, the Master File Table (MFT) is at the heart of the file system. A structured database that stores metadata entries for every file and folder.
• Every object gets an entry within the MFT. Each entry is usually 1024 bytes long. Contains a series of attributes that fully describe the object.

MFT entries contain attributes

Windows.Forensics. FilenameSearch

• Apply yara on the MFT
  • fast yara
  • simple string based
  • filename / top level folder only
  • comma separated
• Crude and less control
• Verbose results

Windows.NTFS.MFT

• Parses MFT
• Easy to use
• Filters
  • Path
  • File name
  • Drive
  • Time bounds
  • Size
• Performance optimised

Exercise - Generate test data

To automatically prep your machine run this script:

### NTFS exercise setup

## 1. download some files to test various content and add ADS to simulate manual download from a browser

$downloads = (
    "https://live.sysinternals.com/PsExec64.exe",
    "https://live.sysinternals.com/procdump64.exe",
    "https://live.sysinternals.com/sdelete64.exe"
)

foreach ( $url in $downloads){
    "Downloading " + $Url
    $file = Split-Path $Url -Leaf
    $dest = "C:\PerfLogs\" +$file
    $ads =  "[ZoneTransfer]`r`nZoneId=3`r`nReferrerUrl=https://18.220.58.123/yolo/`r`nHostUrl=https://18.220.58.123/yolo/" + $file + "`r`n"

    Remove-Item -Path $dest -force -ErrorAction SilentlyContinue
    Invoke-WebRequest -Uri $Url -OutFile $dest -UseBasicParsing
    Set-Content -Path $dest":Zone.Identifier" $ads
}

More setup

## 2.Create a PS1 file in staging folder (any text will do but this is powershell extension)
echo "Write-Host ‘this is totally a resident file’" > C:\Perflogs\test.ps1

## 3.Modify shortname on a file
fsutil file setshortname C:\PerfLogs\psexec64.exe fake.exe

## 4. Create a process dumpOpen calculator (calc.exe)
calc.exe ; start-sleep 2
C:\PerfLogs\procdump64.exe -accepteula -ma win32calc C:\PerfLogs\calc.dmp
get-process | where-object { $_.Name -like "*win32calc*" } | Stop-Process

## 5. Create a zip file in staging folder
Compress-Archive -Path C:\PerfLogs\* -DestinationPath C:\PerfLogs\exfil.zip -CompressionLevel Fastest

## 6. Delete dmp,zip and ps1 files - deleted file discovery is important for later!
Remove-Item -Path C:\PerfLogs\*.zip, C:\PerfLogs\*.dmp, C:\PerfLogs\*.ps1

Exercise

• Find contents of C:\Perflogs

• Review metadata of objects

• Explore leveraging filters

  • to target specific files or file types
  • to find files limited to a time frame

• Can you find the deleted files?

  • You may get lucky and have an unallocated file show.
  • Try Windows.Forensics.Usn with filters looking for suspicious extensions in our staging location!

USN Journal

• Records are appended to the file at the end
• The file is sparse - periodically NTFS will remove the range at the start of the file to make it sparse
• Therefore the file will report a huge size but will actually only take about 30-40mb on disk.
• When collecting the journal file, Velociraptor will collect the sparse file.

Exercise - Windows.Forensics.Usn

Target C:\PerfLogs with the PathRegex field.

• typically the USN journal only records filename and MFTId and ParentMFTId record. Velociraptor automatically reconstructs the expected path so the user can filter on path.
• This artifact uses FullPath results with “/”.

Exercise - UsnJ solution

Advanced NTFS: Alternate Data Stream

• Most browsers attach an ADS to files downloaded from the internet.
• Use the VFS viewer to view the ADS of downloaded files.
• Use ADS Hunter to discover more interesting ADS
• Use Windows.Analysis. EvidenceOfDownload to identify downloaded files and unpacked ZIP files.