by Mark Stam
The Master File Table or MFT can be considered one of the most important files in the NTFS file system, as it keeps records of all files in a volume, the physical location of the files on the drive and file metadata. One of the most important tasks of a computer forensics expert is making file artifacts and metadata visible.
What you will learn:
What you should know:
This article describes, in a straightforward manner, the process of extracting NTFS file system data from a physical device. NTFS uses the Master File Table (MFT) as a database to keep track of files. We can use the MFT to investigate data and find detailed information about files. In this example I use FTK Imager 126.96.36.199 to find a picture (JPEG file) in Windows 7.
STARTING FTK IMAGER
Open the Physical Drive of my computer in FTK Imager. The contents of the Physical Drive appear in the Evidence Tree Pane. Click the root of the file system and several files are listed in the File List Pane, notice the MFT. Click this file to show the contents in the Viewer Pane.
SEARCH FOR INTERESTING FILES
Click the Viewer Pane and press the CTRL + F keys to open up the Find function. Search for pictures and perhaps decide to enter the common term “IMG”.
In a short while FTK Imager finds a result. In this case, the search hit belongs to a file named IMG00264_20100109-1450.jpg. This JPEG file has more information, for instance; each MFT record has a record header, FILE0, also known as magic marker. Carefully consider the options as this magic marker is some lines above the search hit.
At byte offset 80 after the magic marker, shows the file creation time, which is 8 bytes in length. In order to find byte offset 80, press CTRL + G (from current position).
At byte offset 80 after the magic marker, select 8 bytes and the Hex Value Interpreter shows the creation time of the file is 14-12-2012 10:42:42 UTC.
The next 8 bytes show the file alternation time (UTC)
MFT CHANGE TIME
The next 8 bytes show the MFT change time (UTC)
FILE READ TIME
The next 8 bytes show the File Read Time (UTC)
Recover this picture for further analysis.
HOW TO RECOVER DATA
One of the MFT attributes is the $DATA section. It starts with code 0 x 80 00 00 00.
Go back to the magic marker FILE0 and use CTRL + F and do a Binary(hex) search for 80000000. This will point directly to to the $DATA section of the specific MFT record.
Notice the length of the $DATA section is 0 x 48 00 00 00.
The 4 bytes behind 0 x 80 00 00 00 shows the length of the $DATA section. In this case it is 0 x 48 00 00 00. The Hex Value Interpreter converts this to 72 decimal.
DELETED OR NOT
The code right next to 0 x 48 00 00 00 is 0 x 01 00.
01 00 means existing file
00 00 means deleted file
03 00 means existing folder
04 00 means deleted folder
The picture to be recovered has not been deleted from the hard drive. Information about the actual location of the picture on the hard drive is available in data runs, which start at byte offset 32 of the $DATA section.
In this case, byte offset 32 of the $DATA section is 0 x 40. The Hex Value Interpreter converts this to 64 decimal.
Now, go to byte offset 64 from the beginning of the $DATA section where you will find the data run with information about the first cluster of the picture data. At many times the data run starts with 0 x 31 and ends with 0 x 0, but this is not always the case. In this case, the data run starts with 0 x 31.
The code next to 0 x 31 (in this case 0 x 5E) shows the amount of clusters belonging to the picture data.
The Hex Value Interpreter converts this to 94 decimal, which means the data of the picture fills 94 clusters.
The next 3 bytes (0 x AB A4 7B) show the number of the cluster. The Hex Value Interpreter converts this to 8103083 decimal.
Click on the Volume name in the Evidence Tree Pane and the Properties tab (next to the Hex Value Interpreter) show the size of one cluster is 4096 bytes.
Some simple math
94 x 4096 = 385024
Now you know:
The starting cluster is 8103083
The size of the photo is 385024 bytes.
Click the Volume name in the Evidence Tree Pane and right click the Viewer Pane.
Select “go to sector / cluster” and enter cluster number 8103083.
The file header of a JPEG file (ÿØÿà..JFIF) appears in the Viewer Pane.
Right click the Viewer Pane and enter 385024 in “Set Selection Length...”
Right click the selected data and use “Save Selection ...” in order to save the picture data as a file.
NTFS Forensics: A Programmers View of Raw Filesystem Data Extraction
Jason Medeiros, Grayscale Research 2008
Computer and Information Security Handbook
John R. Vacca, Elsevier 2013
NTFS uses the Master File Table (MFT) as a database to keep track of files. We can use FTK Imager to analyze the MFT and find interesting file artifacts and metadata.
About the author----------------------------------------------------------------------------------------------
Mark Stam is a digital forensics investigator who works at the National Police in The Netherlands. He specializes in Social Network Analysis and has given several presentations including at Data Expert’s Digital Experience 2011 and 2013 in The Netherlands. Mark maintains a weblog at http://stam.blogs.com. A more complete profile can be accessed over at http://nl.linkedin.com/pub/mark-stam/1/410/9a0/