Friday, February 26, 2016

Forensic Friday: Get-ForensicMftSlack


[This is a continuation of my Forensic Friday series.  Every Friday I provide a short post on a forensic topic of interest or PowerForensics functionality (such as cmdlet descriptions, use cases, and details about lesser known features). Subscribe to Invoke-IR so you don’t miss a Forensic Friday!]


Happy Friday and welcome to another installment of my Forensic Friday series. This week we are going to cover PowerForensics’ Get-ForensicMftSlack, a cmdlet that returns Master File Table (MFT) slack space. For those not familiar with the concept of slack space, it is simply defined as unused space on the disk. MFT slack is specifically the unused portion of a Master File Table record entry. By default, the Master File Table is composed of records that represent a partitions files and directories. Each MFT record has a set number of bytes reserved for it on the hard drive, typically 1024 bytes (the number of bytes reserved for the MFT record entry can be found in the Volume Boot Record). When a MFT record entry does not use all of the bytes that have been allocated to it, the remaining bytes are referred to as MFT slack space, an area on disk that attackers have been known to hide their tools.

Lets use PowerForensics to provide a specific example of MFT slack space. We start by using Get-ForensicFileRecord to get a specific FileRecord object (MFT record entry). Each FileRecord object has an AllocatedSize and a RealSize parameter. AllocatedSize represents the number of bytes that have been reserved for this particular MFT file entry, while RealSize represents the number of bytes that are actually being used by the entry.


Below you can see a hex dump of the MFT File Record. You can see the FILE0 signature and a couple human readable strings (such as “access.log”).


Now if we compare the output of Get-ForensicMftSlack, we see the same data that is at the bottom of the previous picture. This is the slack space! Sometimes slack space can contain contents of deleted files or file system structures.


The image below shows that the difference between AllocatedSize and RealSize is the same as the number of bytes returned by Get-ForensicMftSlack.


Common Use

Parse all Master File Table slack space for a given volume (Example using volume “C:”):

$bytes = Get-ForensicMftSlack -VolumeName C:


Parse MFT record based on Index/Record Number (Example with Index 0 on Volume N:):

Get-ForensicMftSlack -VolumeName N: -Index 0 | Format-Hex


49 comments:

  1. Without making your site perfect you cannot be getting more traffic or guest for your site. So, I would like to recommend you to Visit capitaldealersolutions blog from there you'll find all the exclusive information on this.

    ReplyDelete
  2. Very easily this site will most likely irrefutably perhaps end up being popular including numerous weblogs individuals, in order to it's persistent content pieces or possibly views. Graphics Designing

    ReplyDelete
  3. You should take part in a contest for one of the highest quality sites on the web.
    I’m going to recommend this website! 토토사이트

    ReplyDelete
  4. Magnificent beat ! I wish to apprentice while you amend your web site, how could i subscribe for a blog web site?
    The account aided me a acceptable deal. I had been a little bit acquainted
    of this your broadcast provided bright clear concept 경마

    ReplyDelete
  5. I am really impressed with your blog article, such great & useful information you mentioned here. I have read all your posts and all are very informative. Thanks for sharing and keep it up like this. 카지노사이트

    ReplyDelete
  6. Hi there! I could have sworn I’ve been to this site before but after browsing through some of the articles I realized it’s new to me.
    Nonetheless, I’m certainly happy I came across it and I’ll be bookmarking it
    and checking back regularly! 토토

    ReplyDelete
  7. I like what you guys tend to be up too. This kind of clever work and reporting! Keep up the very good works guys I’ve added you guys to our blogroll.

    Try to check my blog: 바카라
    (mm)

    ReplyDelete
  8. Hello, i feel that i noticed you visited
    my weblog thus i came to go back the prefer?.I am trying to in finding things to enhance my site!I assume its ok to make use of some of your ideas!!
    바카라

    wep

    ReplyDelete
  9. This is very interesting, You are a very skilled blogger. I've joined your rss feed and look forward to seeking more of your wonderful bong88. Also, I have shared your website in my social networks!

    ReplyDelete
  10. Pretty! This was an incredibly wonderful post.
    Thank you for providing this information.
    바카라사이트

    ReplyDelete
  11. 토토사이트 Hello There. I found your blog using msn. This is a really well
    written article. I’ll make sure to bookmark it and come back to read more of your
    useful info. Thanks for the post. I’ll definitely return.

    ReplyDelete
  12. 토토사이트 As I web-site possessor I believe the content matter here is
    rattling fantastic , appreciate it for your
    hard work. You should keep it up forever! Best of luck.

    ReplyDelete
  13. 카지노사이트 Excellent web site. Lots of useful info here. I am sending it to a few friends ans also sharing in delicious. And naturally, thank you in your effort!|

    ReplyDelete
  14. I was impressed by your writing. Your writing is impressive. I want to write like you.토토사이트 I hope you can read my post and let me know what to modify. My writing is in I would like you to visit my blog.

    ReplyDelete
  15. casino trực tuyếnNovember 15, 2021 at 11:52 PM

    This is the perfect post.casino trực tuyến It helped me a lot. If you have time, I hope you come to my site and share your opinions. Have a nice day.

    ReplyDelete
  16. I was impressed by your writing. Your writing is impressive. I want to write like you.안전놀이터 I hope you can read my post and let me know what to modify. My writing is in I would like you to visit my blog.


    ReplyDelete
  17. Hey what a brilliant post I have come across and believe me I have been searching out for this similar kind of post for past a week and hardly came across this. Thank you very much and will look for more postings from you. 먹튀검증 and I am very happy to see your post just in time and it was a great help. Thank you ! Leave your blog address below. Please visit me anytime!

    ReplyDelete
  18. Your ideas inspired me very much. 바카라사이트 It's amazing. I want to learn your writing skills. In fact, I also have a website. If you are okay, please visit once and leave your opinion. Thank you.


    ReplyDelete
  19. How can you think of this? I thought about this, but I couldn't solve it as well as you.안전놀이터I am so amazing and cool you are. I think you will help me. I hope you can help me.


    ReplyDelete
  20. When I read your article on this topic, the first thought seems profound and difficult. There is also a bulletin board for discussion of articles and photos similar to this topic on my site, but I would like to visit once when I have time to discuss this topic. sòng bạc


    ReplyDelete
  21. Your ideas inspired me very much. 메이저토토사이트모음 It's amazing. I want to learn your writing skills. In fact, I also have a website. If you are okay, please visit once and leave your opinion. Thank you.

    ReplyDelete
  22. 토토사이트추천December 9, 2021 at 10:07 PM

    That's a great article! The neatly organized content is good to see. Can I quote a blog and write it on my blog? My blog has a variety of communities including these articles. Would you like to visit me later? 토토사이트추천

    ReplyDelete
  23. I am a 오공슬롯 expert. I've read a lot of articles, but I'm the first person to understand as well as you. I leave a post for the first time. It's great!!

    ReplyDelete
  24. I visited last Monday, and in the meantime, I came back in baccarat anticipation that there might be other articles related to I know there is no regret and leave a comment. Your related articles are very good, keep going!!

    ReplyDelete
  25. It seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 바카라사이트. seems very easy, but it's a difficult kind of article, and it's perfect.

    ReplyDelete
  26. Your article was very impressive to me. It was unexpected information,but after reading it like this 온카지노, I found it very interesting.

    ReplyDelete
  27. I no uncertainty esteeming each and every bit of it. It is an amazing site and superior to anything normal give. I need to grateful. Marvelous work! Every one of you complete an unfathomable blog, and have some extraordinary substance. Keep doing stunning 메이저사이트순위

    ReplyDelete
  28. Hello to all, for the reason that I am truly eager of reading this weblog’s post to be updated regularly. 카지노사이트

    ReplyDelete
  29. Je ne suis pas vraiment un lecteur Internet pour être honnête mais vos blogs vraiment sympa, continue comme ça ! 에볼루션카지노 Je vais aller de l'avant et ajouter votre site à vos favoris pour revenir à l'avenir. advgamble.com

    ReplyDelete
  30. I found your this post while searching for some related information on blog search…Its a good post..keep posting and update the information 먹튀폴리스

    ReplyDelete
  31. We are looking for a lot of data on this item. In the meantime, this is the perfect article I was looking for . Please post a lot about items related to 메이저사이트추천 !!! I am waiting for your article. And when you are having difficulty writing articles, I think you can get a lot of help by visiting my .

    ReplyDelete
  32. Thanks for such a fantastic blog. Where else could anyone get that kind of info written in such a perfect way? I have a presentation that I am presently writhing on, and I have been on the look out for such great information. 메이저토토

    ReplyDelete
  33. I'm glad I found this web site, I couldn't find any knowledge on this matter prior to.Also operate a site and if you are ever interested in doing some visitor writing for me if possible feel free to let me know, im always look for people to check out my web site. www.weclub88.cc

    ReplyDelete
  34. Great things you’ve always shared with us. Just keep writing this kind of posts.The time which was wasted in traveling for tuition now it can be used for studies.Thanks ttjitu

    ReplyDelete
  35. Puchalski developed the FICA Spiritual History Tool to help practitioners better understand their
    마산출장안마

    ReplyDelete
  36. into spiritual care is an area with lots of room for growth.
    마산출장안마

    ReplyDelete
  37. "It's a relatively new, up-and-coming field," she said. "When it comes to looking at spiritual
    마산출장 마사지

    ReplyDelete
  38. words," King said. "We usually think of something like this is a deductive-reasoning task, which
    부산홈타이

    ReplyDelete
  39. "It's like a mental sketch pad where you hold the visual
    부산출장

    ReplyDelete
  40. Heinrichs: SeaLegacy is an organization I co-founded with my partners Paul
    메카출장안마 https://www.homemcms.com/

    ReplyDelete
  41. in uncontrolled loss of the planet through climate and through destructive fisheries.
    메카출장마사지 https://www.homemcms.com/

    ReplyDelete
  42. This is a great article, Given such a great amount of information in it, These kind of articles keeps the clients enthusiasm for the site, and continue sharing more ... antminer s19

    ReplyDelete
  43. This informative blog is really interesting. It is a good blog I read some posts I was looking article like these. Thanks for sharing such informative. 온라인바카라

    ReplyDelete
  44. It seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 메이저안전놀이터. seems very easy, but it's a difficult kind of article, and it's perfect.

    ReplyDelete
  45. Nice post. I was checking constantly this blog and I am impressed! Extremely helpful information specially the last part I care for such info a lot. I was seeking this particular information for a very long time. Thank you and good luck. slot gacor

    ReplyDelete
  46. It is a great website.. The Design looks very good.. Keep working like that!. slot online

    ReplyDelete

- Invoke-IR - By Jared Atkinson -