Python script to carve NTFS USN records from arbitrary binary data
The NTFS USN Change journal is a volume-specific log which records metadata changes to files. It is a treasure trove of information during a forensic investigation. As the change journal reaches its maximum size, clusters of the journal's disk space are marked unallocated by the operating system to be used when needed at a later time. As with many other artifacts, USN change journal records in unallocated space can be extremely valuable. Better yet, due to the compact nature of change journal records, I routinely find millions of records outside of the file system's allocated clusters.
This script will carve NTFS USN journal records from arbitrary binary data, and output to a file in binary format. The investigator can then parse these records with a tool of their own choosing. At this time the script only supports raw/dd input files.
Simply specify the input and output files:
dev@computer:$ python usncarve.py -f file.raw -o usn.raw
usage: usncarve.py [-h] -f FILE -o OUTFILE
optional arguments:
-h, --help show this help message and exit
-f FILE, --file FILE Carve USN records from the given file
-o OUTFILE, --outfile OUTFILE
Output to the given file
Using setup.py:
python setup.py install
Using pip:
pip install usncarve
| Travis-CI |
|---|
|