Anthropic-Cybersecurity-Skills/skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md

Workflows - MFT Deleted File Recovery

Workflow 1: Basic Deleted File Discovery

Extract $MFT from forensic image
    |
Parse with MFTECmd to CSV
    |
Filter for InUse = False (deleted records)
    |
Analyze ParentPath, FileName, FileSize
    |
Cross-reference with USN Journal for deletion timestamps
    |
Document findings with original paths and timestamps

Workflow 2: MFT Slack Space Recovery

Extract raw $MFT binary
    |
Parse each 1024-byte record
    |
Compare used_size vs allocated_size (1024)
    |
Extract slack bytes between used and allocated
    |
Search for attribute headers (0x10, 0x30, 0x80)
    |
Reconstruct partial file metadata from slack data

Workflow 3: Timeline Reconstruction

Parse $MFT for all timestamps ($SI and $FN)
    |
Parse $J (USN Journal) for change records
    |
Parse $LogFile for transaction records
    |
Merge into unified timeline
    |
Identify file creation, modification, deletion sequences
    |
Flag timestomping indicators ($SI Created < $FN Created)