ntfstool is a forensic tool designed for in-depth analysis of NTFS volumes. It aims to provide a comprehensive suite of functionalities for examining partition structures, file system metadata, and encryption mechanisms. The tool supports reading and parsing various NTFS components, including the Master File Table (MFT), Bitlocker encrypted volumes, and files protected by EFS. A core use case is to recover deleted files by analyzing the USN journal.
ntfstool stands out due to its comprehensive support for various NTFS features, including detailed MFT analysis, extensive Bitlocker handling (including key extraction), and robust EFS support for decryption and key management. It offers a command-line interface and a limited shell for interactive exploration. The tool is cross-platform, supporting both 32-bit and 64-bit Windows systems.
- MFT Parsing: Displays detailed information about MFT records, including attributes and B-tree structure.
- Bitlocker Support: Handles Bitlocker encrypted volumes, including VMK and FVE extraction, password checking, and decryption.
- EFS Decryption: Decrypts EFS-encrypted files using backup keys and certificates.
- USN Journal Analysis: Analyzes USN journal records to detect file system changes and recover deleted files.
- Command-Line Interface: Provides a command-line interface for various forensic operations (info, mft.dump, bitlocker.info, etc.).
- Limited Shell: Includes a limited shell for interacting with the file system and executing commands.
- Extensibility: Supports parsing and extracting data streams from alternate data streams.
ntfstool is an actively maintained project with recent commits and regular updates. While documentation is incomplete, the project provides clear examples and a command-line help system. The focus on specific NTFS features suggests focused development, and the community is encouraged to contribute to feature development and documentation.
ntfstool benefits digital forensics investigators needing to analyze NTFS volumes for evidence. It addresses the need for a versatile tool capable of examining a wide range of NTFS features, providing insights into file system structure, encryption status, and file modifications. It offers an alternative to manual analysis or higher-cost commercial solutions.