NTFS MFT 与 USN 痕迹解析

---
name: mftecmd
version: 1.0.0
description: Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.
metadata:
  tool-name: MFTECmd
  tool-vendor: Eric Zimmerman
---

# MFTECmd Skill

MFTECmd is Eric Zimmerman's command-line tool for parsing NTFS file system artifacts. It processes the Master File Table ($MFT), USN Journal ($J), boot sector ($Boot), security descriptors ($SDS), and directory indexes ($I30), producing structured output. Forensic interpretation of MFT data (timestomping analysis, deleted file recovery workflows, etc.) belongs in a separate analysis skill.

## Command Syntax

```
MFTECmd.exe -f <file> [--csv <dir> | --json <dir> | --body <dir>] [other options]
```

Single-letter options use a single dash (`-`). Multi-character options use double dashes (`--`).

## Input

| Flag | Description |
|------|-------------|
| `-f` | File to process (`$MFT`, `$J`, `$Boot`, `$SDS`, or `$I30`). Required. |
| `-m` | Path to `$MFT` file when `-f` points to `$J`. Resolves parent paths in USN Journal output. |

## Output Formats

| Flag | Description |
|------|-------------|
| `--csv` | Directory to write CSV output |
| `--csvf` | Custom filename for CSV output (overrides default) |
| `--json` | Directory to write JSON output |
| `--jsonf` | Custom filename for JSON output (overrides default) |
| `--body` | Directory to write bodyfile format output |
| `--bodyf` | Custom filename for bodyfile output (overrides default) |
| `--bdl` | Drive letter (e.g. `C`) for bodyfile. Required with `--body`. |

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `--dt` | Custom date/time format string | `yyyy-MM-dd HH:mm:ss.fffffff` |
| `--sn` | Include DOS (8.3) filename types in output | FALSE |
| `--fl` | Generate condensed file listing (requires `--csv`) | FALSE |
| `--at` | Include all 0x30 attribute timestamps, not just when they differ from 0x10 | FALSE |
| `--rs` | Recover slack space from FILE records | FALSE |
| `--ir` | Include resident data in JSON/CSV output | FALSE |
| `--re` | Extensions to include for resident data (e.g. `.txt,.ps1`) | all (when omitted) |
| `--rm` | Maximum resident data size in bytes | 1024 |
| `--blf` | Use LF instead of CRLF for newlines in output | FALSE |
| `--de` | Dump full details for a specific entry/sequence (e.g. `5` or `624-5`) | |
| `--dd` | Directory to export a raw $MFT FILE record to | |
| `--do` | Offset of $MFT FILE record to export (decimal or hex) | |
| `--dr` | Export resident files to a subdirectory | FALSE |
| `--fls` | Display directory contents from a $MFT entry | FALSE |
| `--ds` | Dump a specific Security ID from $SDS | |
| `--vss` | Process Volume Shadow Copies on the drive | FALSE |
| `--dedupe` | Deduplicate files via SHA-1 | FALSE |
| `--debug` | Show debug information | FALSE |
| `--trace` | Show trace information | FALSE |

## Common Output Fields — $MFT (CSV)

Output columns depend on tool version. Common columns when parsing $MFT:

| Column | Description |
|--------|-------------|
| **EntryNumber** | MFT entry number |
| **SequenceNumber** | Entry sequence number (increments on reuse) |
| **InUse** | Whether the MFT record is active or free |
| **ParentEntryNumber** | MFT entry number of the parent directory |
| **ParentSequenceNumber** | Sequence number of the parent directory |
| **ParentPath** | Full path to the parent directory |
| **FileName** | Name of the file or directory |
| **Extension** | File extension (empty for directories) |
| **FileSize** | File size in bytes |
| **ReferenceCount** | Number of unique parent MFT references |
| **ReparseTarget** | Target path for reparse points (symlinks, junctions) |
| **IsDirectory** | Whether the entry is a directory |
| **HasAds** | Whether the entry has alternate data streams |
| **IsAds** | Whether the entry itself is an alternate data stream |
| **Created0x10** | Created timestamp from Standard_Information attribute |
| **Created0x30** | Created timestamp from File_Name attribute |
| **LastModified0x10** | Last modified from Standard_Information |
| **LastModified0x30** | Last modified from File_Name |
| **LastRecordChange0x10** | MFT record change from Standard_Information |
| **LastRecordChange0x30** | MFT record change from File_Name |
| **LastAccess0x10** | Last access from Standard_Information |
| **LastAccess0x30** | Last access from File_Name |
| **UpdateSequenceNumber** | USN for this record |
| **LogfileSequenceNumber** | $LogFile sequence number |
| **SecurityId** | Security descriptor ID |
| **ObjectIdFileDroid** | Object ID GUID |
| **SiFlags** | Standard_Information attribute flags |
| **NameType** | Filename type (Win32, DOS, POSIX, Win32+DOS) |
| **SI<FN** | TRUE when a File_Name (0x30) timestamp is later than the corresponding Standard_Information (0x10) timestamp |
| **uSecZeros** | TRUE when a timestamp has subseconds zeroed out (`.0000000`) |
| **Copied** | TRUE when SI timestamps suggest the file was copied |
| **LoggedUtilStream** | Logged utility stream data |
| **ZoneIdContents** | Zone.Identifier ADS content (download origin) |

## Common Output Fields — $J USN Journal (CSV)

| Column | Description |
|--------|-------------|
| **UpdateTimestamp** | UTC timestamp of the journal entry |
| **EntryNumber** | MFT entry number of the affected file |
| **ParentEntryNumber** | MFT entry number of the parent directory |
| **ParentPath** | Full parent path (only populated when `-m` provides the $MFT) |
| **Name** | Filename |
| **UpdateReasons** | Pipe-separated list of change reasons (e.g. `FileCreate`, `DataExtend`, `RenameNewName`) |

## Workflow Examples

### Parse $MFT to CSV

```
MFTECmd.exe -f "C:\Cases\Evidence\$MFT" --csv "C:\Cases\Output" --csvf MFT_parsed.csv
```

### Parse $MFT with all timestamps

```
MFTECmd.exe -f "C:\Cases\Evidence\$MFT" --csv "C:\Cases\Output" --at
```

### Parse USN Journal with path resolution

```
MFTECmd.exe -f "C:\Cases\Evidence\$J" -m "C:\Cases\Evidence\$MFT" --csv "C:\Cases\Output"
```

### Parse USN Journal without $MFT (no parent paths)

```
MFTECmd.exe -f "C:\Cases\Evidence\$J" --csv "C:\Cases\Output"
```

### Generate bodyfile output

```
MFTECmd.exe -f "C:\Cases\Evidence\$MFT" --body "C:\Cases\Output" --bdl C
```

### Extract resident file data

```
MFTECmd.exe -f "C:\Cases\Evidence\$MFT" --csv "C:\Cases\Output" --ir --re ".txt,.ps1,.bat,.cmd"
```

### Parse $SDS

```
MFTECmd.exe -f "C:\Cases\Evidence\$SDS" --csv "C:\Cases\Output"
```

### Parse $I30 directory index

```
MFTECmd.exe -f "C:\Cases\Evidence\$I30" --csv "C:\Cases\Output"
```