www.it-connect.fr
Windows Forensics Part 11: Analyzing the MFT with KAPE and MFTECmd
The MFT (Master File Table) is the central registry of the NTFS file system: every file and folder on a volume has an entry there, including deleted ones. After the USN Journal, it is the second essential NTFS artifact in digital forensics. In this article, we will look at what the MFT contains, how to extract the $MFT file from a running Windows machine with KAPE, and then how to analyze it with MFTECmd to trace a malicious tool.
This article is the eleventh part of our series dedicated to Windows forensics. It directly follows the previous part focused on the USN Journal.
The MFT, the heart of the NTFS file system
In the previous article about the USN Journal, we saw that NTFS relies on several metadata files to operate. Among them, two artifacts are particularly useful in digital forensics: the MFT ($MFT) and the USN Journal ($UsnJrnl).
Each file or folder has an entry in the MFT, called an MFT record (or file record), which contains its name, size, attributes, timestamps, and the information needed for NTFS to manage it (data location on disk, security descriptor, and so on).
In other words, the USN Journal tells what happened to a file, while the MFT describes what that file is. These two artifacts complement each other and are the main sources of information during a forensic analysis of an NTFS volume.
MFT structure
The MFT is a system file named $MFT, located at the root of each NTFS volume. It is a hidden and protected file, invisible in File Explorer. It appears as a table made up of fixed-size records. On Windows, the size of an MFT record is generally 1,024 bytes.
Each record begins with the signature FILE and contains several attributes describing the file or folder in question.
Even after a file is deleted, its record may remain present in the MFT until it is reused by NTFS. This sometimes makes it possible to recover the name, path, and metadata of a file that is no longer visible in the system
Extracting the MFT file
As in the previous article about the USN Journal, we will use MFTECmd to analyze the artifact. However, we first need to collect the $MFT file. Since it is protected and in use by the system, a standard copy is generally not possible from a running Windows system. It is therefore necessary to use a tool capable of collecting locked files.
Several tools can be used for this operation, including RawCopy and KAPE. In this article, we will use KAPE (Kroll Artifact Parser and Extractor), a collection and processing tool for artifacts developed by Eric Zimmerman. You can find it on this page: ericzimmerman.github.io
Download KAPE, then extract all of its contents into a folder.
Next, launch the gkape.exe graphical interface with administrative privileges. These privileges are essential: without them, KAPE cannot access the disk in raw mode to read the $MFT file.
Once the tool is launched, check the Use Target Options box.
- In the field corresponding to the source, specify the root of the volume to analyze, for example:
C - Then specify the directory where the collected artifacts should be saved.
- In the Targets search bar, type MFT, then select the target that collects the Windows
$MFTfile - Finally, click Execute to start the extraction.
A command window opens and displays the collection progress. Once the operation is complete, press any key to close the window.
The $MFT file is now available in the destination directory. KAPE recreates the original folder structure, so the file is located in a subfolder named after the volume, for example C:\Collecte\C\$MFT.
Analyzing the $MFT file with MFTECmd
We will now convert the MFT content into a CSV file using MFTECmd. This tool, also developed by Eric Zimmerman, can analyze several NTFS metadata files: $MFT, $J (USN Journal), $Boot, $SDS, and $LogFile.
Open a Command Prompt, move to the folder containing the tool, then run the following command, adjusting the paths as needed:
MFTECmd.exe -f "C:\Collecte\C\$MFT" --csv "C:\Collecte\Rapport"Two options are used here:
-f: specifies the file to analyze (here, the$MFTfile collected by KAPE).--csv: defines the directory where the CSV report should be generated.
Wait until the analysis is complete, then open the resulting CSV file with a CSV editor.
The generated table contains many useful columns, including:
- The MFT entry number
- The sequence number
- The file name
- Its path
- Its extension
- Its size
- Its active or deleted state
- Its various timestamps
- The attributes associated with the record.
In our example, filtering by extension allowed us to find a file associated with SharpHound, the BloodHound collector, a tool used to map an Active Directory environment in order to identify attack paths.
The important information here is the last access and modification dates, which can provide useful clues for correlating different artifacts.
Conclusion
The MFT is one of the richest artifacts in the NTFS file system. It references all files and folders on the volume and retains a wealth of information about their name, size, location, status, and timestamps.
Analyzing it also makes it possible to recover traces of deleted files, as long as their records have not been reused by NTFS. It can therefore reveal the past presence of tools, scripts, or documents of forensic interest, as the SharpHound example showed.
As always in digital forensics, the results must be correlated with the USN Journal and the other artifacts presented in this series in order to build a coherent and well-supported timeline.
