Printable View
Hello,
I'm just starting to get into the security field, and I've just been browsing around. I was using a DiskExplorer and it was able to show me the contents of the NTFS and MFT. I was wondering if anyone could offer any assistance on how I would be able to retrieve the MFT metadata (stuff like the last MFT modification time/access time/creation time etc..)
Any help would be greatly appreciated!
macdaddy?
http://www.opensourceforensics.org/tools/unix.html
Title: mac-daddy Author: Rob Lee
Description: MAC Time collector for forensic incident response. This toolset is a modified version of the two programs tree.pl and mactime from the Coroner's Toolkit by Dan Farmer and Venema Weiste. This program is portable and can be run directly from a floppy or a cdrom with a perl interpreter that can also be on the floppy or cdrom.
Website: http://www.xxxxxxxxxx [Site has been removed]
Source: http://www.xxxxxxxxxxx [Site has been removed]
Moderator's Note: The links have been censored because they lead to a pr0n site:eek:
Title: mac-robber Author: Brian Carrier
Description: mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files. Its output can be used as input to the 'mactime' tool in The Sleuth Kit to make a time line of file activity.
Website: http://www.sleuthkit.org/mac-robber
Source: http://www.sleuthkit.org/mac-robber/download.php
Just keep in mind there are plenty of tools available to timestomp/mangle the MACs and make it alot harder....
There are some free forensics tools here:
http://www.pinpointlabs.com/free_tools/metaviewer/
Metaviewer looks promising?
:)
I have moved this thread into the forensics forum in the hope that you get a better response.
EDIT: Free tool for looking at index.dat files:
http://www.systenance.com/indexdat.php
More free stuff here:
http://www.theabsolute.net/sware/
"Disk Investigator" is pretty good ;)
LOL, sorry about that, guess he let his domain name go :), shame, it was a useful tool...
Here is some links to software that can be used for forensic purpses:
http://www.forensics.nl/tools
http://www.forinsect.de/
http://www.cftt.nist.gov/
http://www.gmgsystemsinc.com/fau/
http://www.foundstone.com/us/resourc...sc/bintext.htm
Most of them are free
nirsoft (by Nir Sofer) and sysinternals (by Mark Russinovich) has also lot of free utilities for audit of computer and retrive different kind of information