Awesome
NTFS-Linker
Author: Zack Weger
Copyright (c) 2015, Stroz Friedberg, LLC
Status: Alpha
License: LGPLv3
Description
NTFS Linker uses the $MFT
, $LogFile
, and $UsnJrnl
to generate a "linked"
history of file system activity on an NTFS volume. $LogFile
and $UsnJrnl
track
changes to files and folders over time. Linking the records in these logs with
$MFT
allows for the construction of a timeline of activity:
creates, moves/renames, and deletes. NTFS Linker produces records that can
easily be filtered to review different types of activity. In addition,
NTFS-Linker is able to run across all Volume Shadow Copies (VSCs) on a volume,
and produce output in a unified and deduplicated manner.
Usage
ntfs-linker, Copyright (c) Stroz Friedberg, LLC
Version 0.1.1
Usage: ntfs_linker ntfs-dir output [options]
Allowed options:
--ntfs-dir arg If no image specified, location of root directory
containing input files. Otherwise, root directory in
which to dump files extracted from image. See the docs
for info about ntfs-dir structure.
--output arg directory in which to dump output files
--image arg Path to image file(s)
--overwrite overwrite files in the output directory. Default:
append
--extra Outputs supplemental lower-level parsed data from
$UsnJrnl and $LogFile
--help display help and exit
--version display version number and exit
Output
NTFS-Linker produces three TSV reports: events.txt, log.txt, and usn.txt.
-
log.txt: contains listing of log record headers. Does not contain the redo/undo operation data, so this report is of limited use.
-
usn.txt: contains a "raw" view of
$UsnJrnl
entries in more detail than what events.txt provides, including all of the Reason flags. -
events.txt: contains a unified view of all file system events, as parsed from both $UsnJrnl and $LogFile, ordered by event time from most recent to oldest (approximately--see below).
NTFS-Linker also produces a SQLite database containing all of the above data. The database schema is designed for ease of querying, not full normalization.
Installation
The source is in C++ and uses autotools for building. C++11 compiler support is required. On a sane Unix, this should work:
./bootstrap.sh
./configure
make
sudo make install
NTFS-linker has dependencies on
SQLite,
Boost,
libtsk,
libewf,
libbfio,
libcerror,
and libvshadow. The configure
script
should detect these dependencies on your system and warn you if any are missing.
libewf
should be installed before building and installing libtsk
.
Note that libvshadow must be compiled with libbfio enabled, and The Sleuthkit
must be compiled with --disable-multithreading
(which is only available in
version 4.3).
After installing the dependencies you may need to run:
sudo ldconfig
With sufficient wizardry, NTFS-linker can be built for Windows using mingw. For the impatient, prebuilt binaries can be downloaded.