Home / ubuntu / Questions / 1097368
Accepted
MarianoM
Asked: 2018-12-01 01:54:23 +0800 CST

Create a copy of MFT using DD and convert to CSV?

  • 772

I am looking for a way to save a copy of the NTFS file system MFT to analyze the dates of last access to the files and also the complete list of files. I have thought about the use of DD to avoid having to mount the unit and not modify the date of the last access to the MFT (this I need to know when the disc was last used).

If possible I would also like to see the list of deleted files or be able to filter it by means of a command.

Is it possible to do this? Can this method be more practical to investigate the dates of last access or is it better for me to make a complete copy of the disk and analyze it with some software?

filesystem ntfs

2 Answers

  1. Best Answer

    A quick google search leads to this:

    You will need a sleuthkit tool, and analyzeMFT pip module

    sudo apt install sleuthkit
sudo pip install analyzeMFT # install globally

    This will give us the mmls (not really needed) and icat tool

    Let assume that /dev/sdx is your disk. But you can adapt the command to run this on an image.

    sudo mmls /dev/sdx

    which will gives you the offset of the NTFS partition, say 1107968

    Then,

    sudo icat -o 1107968 /dev/sdx 0 > mft.raw

    Then,

    sudo analyzeMFT.py -f mft.raw -o mftanalyzed.csv

    In case you have a disk image of your NTFS partition, this would be enough

    icat -o 0 image.raw 0 > mft.raw
analyzeMFT.py -f mft.raw -o mftanalyzed.csv

    I guess

    Source

    • 2

  2. Is it possible to do this?

    Sure, you can do this with RecuperaBit. As a disclaimer, I shall clarify that I am the developer.

    After you've let it scan the drive or a disk image, type recoverable to get a list of partitions, including deleted ones that can be reconstructed. Let's say your partition has id 0 you can then issue:

    csv 0 results.csv

    For a CSV file, or:

    bodyfile 0 results.body

    For a body file which is compatible with mactime.

    • 1