mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-18 21:49:40 +03:00
mukul975
47 lines
1.0 KiB
Markdown
47 lines
1.0 KiB
Markdown
# Workflows - MFT Deleted File Recovery
|
|
|
|
## Workflow 1: Basic Deleted File Discovery
|
|
```
|
|
Extract $MFT from forensic image
|
|
|
|
|
Parse with MFTECmd to CSV
|
|
|
|
|
Filter for InUse = False (deleted records)
|
|
|
|
|
Analyze ParentPath, FileName, FileSize
|
|
|
|
|
Cross-reference with USN Journal for deletion timestamps
|
|
|
|
|
Document findings with original paths and timestamps
|
|
```
|
|
|
|
## Workflow 2: MFT Slack Space Recovery
|
|
```
|
|
Extract raw $MFT binary
|
|
|
|
|
Parse each 1024-byte record
|
|
|
|
|
Compare used_size vs allocated_size (1024)
|
|
|
|
|
Extract slack bytes between used and allocated
|
|
|
|
|
Search for attribute headers (0x10, 0x30, 0x80)
|
|
|
|
|
Reconstruct partial file metadata from slack data
|
|
```
|
|
|
|
## Workflow 3: Timeline Reconstruction
|
|
```
|
|
Parse $MFT for all timestamps ($SI and $FN)
|
|
|
|
|
Parse $J (USN Journal) for change records
|
|
|
|
|
Parse $LogFile for transaction records
|
|
|
|
|
Merge into unified timeline
|
|
|
|
|
Identify file creation, modification, deletion sequences
|
|
|
|
|
Flag timestomping indicators ($SI Created < $FN Created)
|
|
```
|