Friday, February 26, 2016

Forensic Friday: Get-ForensicMftSlack


[This is a continuation of my Forensic Friday series.  Every Friday I provide a short post on a forensic topic of interest or PowerForensics functionality (such as cmdlet descriptions, use cases, and details about lesser known features). Subscribe to Invoke-IR so you don’t miss a Forensic Friday!]


Happy Friday and welcome to another installment of my Forensic Friday series. This week we are going to cover PowerForensics’ Get-ForensicMftSlack, a cmdlet that returns Master File Table (MFT) slack space. For those not familiar with the concept of slack space, it is simply defined as unused space on the disk. MFT slack is specifically the unused portion of a Master File Table record entry. By default, the Master File Table is composed of records that represent a partitions files and directories. Each MFT record has a set number of bytes reserved for it on the hard drive, typically 1024 bytes (the number of bytes reserved for the MFT record entry can be found in the Volume Boot Record). When a MFT record entry does not use all of the bytes that have been allocated to it, the remaining bytes are referred to as MFT slack space, an area on disk that attackers have been known to hide their tools.

Lets use PowerForensics to provide a specific example of MFT slack space. We start by using Get-ForensicFileRecord to get a specific FileRecord object (MFT record entry). Each FileRecord object has an AllocatedSize and a RealSize parameter. AllocatedSize represents the number of bytes that have been reserved for this particular MFT file entry, while RealSize represents the number of bytes that are actually being used by the entry.


Below you can see a hex dump of the MFT File Record. You can see the FILE0 signature and a couple human readable strings (such as “access.log”).


Now if we compare the output of Get-ForensicMftSlack, we see the same data that is at the bottom of the previous picture. This is the slack space! Sometimes slack space can contain contents of deleted files or file system structures.


The image below shows that the difference between AllocatedSize and RealSize is the same as the number of bytes returned by Get-ForensicMftSlack.


Common Use

Parse all Master File Table slack space for a given volume (Example using volume “C:”):

$bytes = Get-ForensicMftSlack -VolumeName C:


Parse MFT record based on Index/Record Number (Example with Index 0 on Volume N:):

Get-ForensicMftSlack -VolumeName N: -Index 0 | Format-Hex


31 comments:

  1. Without making your site perfect you cannot be getting more traffic or guest for your site. So, I would like to recommend you to Visit capitaldealersolutions blog from there you'll find all the exclusive information on this.

    ReplyDelete
  2. Very easily this site will most likely irrefutably perhaps end up being popular including numerous weblogs individuals, in order to it's persistent content pieces or possibly views. Graphics Designing

    ReplyDelete
  3. You should take part in a contest for one of the highest quality sites on the web.
    I’m going to recommend this website! 토토사이트

    ReplyDelete
  4. Magnificent beat ! I wish to apprentice while you amend your web site, how could i subscribe for a blog web site?
    The account aided me a acceptable deal. I had been a little bit acquainted
    of this your broadcast provided bright clear concept 경마

    ReplyDelete
  5. I like what you guys tend to be up too. This kind of clever work and reporting! Keep up the very good works guys I’ve added you guys to our blogroll.

    Try to check my blog: 바카라
    (mm)

    ReplyDelete
  6. Hello, i feel that i noticed you visited
    my weblog thus i came to go back the prefer?.I am trying to in finding things to enhance my site!I assume its ok to make use of some of your ideas!!
    바카라

    wep

    ReplyDelete
  7. Pretty! This was an incredibly wonderful post.
    Thank you for providing this information.
    바카라사이트

    ReplyDelete
  8. 토토사이트 As I web-site possessor I believe the content matter here is
    rattling fantastic , appreciate it for your
    hard work. You should keep it up forever! Best of luck.

    ReplyDelete
  9. 카지노사이트 Excellent web site. Lots of useful info here. I am sending it to a few friends ans also sharing in delicious. And naturally, thank you in your effort!|

    ReplyDelete
  10. casino trực tuyếnNovember 15, 2021 at 11:52 PM

    This is the perfect post.casino trực tuyến It helped me a lot. If you have time, I hope you come to my site and share your opinions. Have a nice day.

    ReplyDelete
  11. I was impressed by your writing. Your writing is impressive. I want to write like you.안전놀이터 I hope you can read my post and let me know what to modify. My writing is in I would like you to visit my blog.


    ReplyDelete
  12. Your ideas inspired me very much. 바카라사이트 It's amazing. I want to learn your writing skills. In fact, I also have a website. If you are okay, please visit once and leave your opinion. Thank you.


    ReplyDelete
  13. How can you think of this? I thought about this, but I couldn't solve it as well as you.안전놀이터I am so amazing and cool you are. I think you will help me. I hope you can help me.


    ReplyDelete
  14. When I read your article on this topic, the first thought seems profound and difficult. There is also a bulletin board for discussion of articles and photos similar to this topic on my site, but I would like to visit once when I have time to discuss this topic. sòng bạc


    ReplyDelete
  15. Hello to all, for the reason that I am truly eager of reading this weblog’s post to be updated regularly. 카지노사이트

    ReplyDelete
  16. I found your this post while searching for some related information on blog search…Its a good post..keep posting and update the information 먹튀폴리스

    ReplyDelete
  17. I'm glad I found this web site, I couldn't find any knowledge on this matter prior to.Also operate a site and if you are ever interested in doing some visitor writing for me if possible feel free to let me know, im always look for people to check out my web site. www.weclub88.cc

    ReplyDelete
  18. Great things you’ve always shared with us. Just keep writing this kind of posts.The time which was wasted in traveling for tuition now it can be used for studies.Thanks ttjitu

    ReplyDelete
  19. Puchalski developed the FICA Spiritual History Tool to help practitioners better understand their
    마산출장안마

    ReplyDelete
  20. into spiritual care is an area with lots of room for growth.
    마산출장안마

    ReplyDelete
  21. "It's a relatively new, up-and-coming field," she said. "When it comes to looking at spiritual
    마산출장 마사지

    ReplyDelete
  22. words," King said. "We usually think of something like this is a deductive-reasoning task, which
    부산홈타이

    ReplyDelete
  23. "It's like a mental sketch pad where you hold the visual
    부산출장

    ReplyDelete
  24. Heinrichs: SeaLegacy is an organization I co-founded with my partners Paul
    메카출장안마 https://www.homemcms.com/

    ReplyDelete
  25. in uncontrolled loss of the planet through climate and through destructive fisheries.
    메카출장마사지 https://www.homemcms.com/

    ReplyDelete
  26. This is a great article, Given such a great amount of information in it, These kind of articles keeps the clients enthusiasm for the site, and continue sharing more ... antminer s19

    ReplyDelete
  27. Nice post. I was checking constantly this blog and I am impressed! Extremely helpful information specially the last part I care for such info a lot. I was seeking this particular information for a very long time. Thank you and good luck. slot gacor

    ReplyDelete
  28. It is a great website.. The Design looks very good.. Keep working like that!. slot online

    ReplyDelete

- Invoke-IR - By Jared Atkinson -