ntfstool

The undelete command scans an NTFS or Bitlocker volume to identify deleted files and directories. It calculates a recovery percentage for each file based on whether its data clusters have been reused (checked against the $BITMAP file).

Results can be displayed in a formatted table in the terminal or exported to a file in csv or json format.

Output Columns:

• Id: Sequential ID
• MFT Index: The hex MFT record index
• Type: File or Dir
• Filename: The full path of the deleted item
• Size: The size of the file (empty for directories)
• Deletion Date: The timestamp from $STANDARD_INFORMATION
• % Recoverable: The estimated percentage of data still intact

# Note: This is a conceptual usage based on the command logic.
# To list deleted files:
ntfstool undelete --disk <disk_name> --volume <volume_index>

# To export deleted files to JSON:
ntfstool undelete --disk <disk_name> --volume <volume_index> --format json --output results.json

The efs decrypt command allows you to decrypt files protected by Windows Encrypting File System (EFS) by providing a PKCS#12 (.pfx) archive containing the necessary certificate and private key. The tool identifies the correct decryption field within the NTFS $EFS stream by matching the certificate thumbprint from the PFX file with the entries in the file's metadata.

To successfully decrypt a file, you must provide:

1. A target disk or volume.
2. A pfx file path containing the certificate.
3. The password for the PFX file.
4. The path to the target file (via the standard file selection options used by the tool).

If no output path is specified, the tool will default to saving the decrypted content as <original_filename>.decrypted.

# Note: The exact CLI syntax depends on the global parser, but based on the dispatch logic, the required options are:
# ntfstool efs decrypt --disk <disk> --volume <volume> --pfx <path_to_pfx> --password <pfx_password> [file_options]

The extract command allows you to recover files from an NTFS disk or volume. It can extract standard files or specific NTFS streams. The tool attempts to preserve file metadata, including creation/read/alter times and file attributes, by reading the $STANDARD_INFORMATION attribute from the MFT record.

Key Features:

• Stream Support: You can specify a specific NTFS stream to extract using the --stream option.
• Metadata Preservation: Automatically attempts to set file timestamps and attributes on the output file.
• System File Shortcuts: If no source path is provided, using --sam or --system will automatically target c:\windows\system32\config\sam or c:\windows\system32\config\system respectively.
• Encryption Warning: If the file is encrypted (detected via the $STANDARD_INFORMATION attribute), the tool will notify you that the extracted data is not readable.

# Note: This is a CLI command. Usage depends on the specific CLI wrapper, but the logic follows:
# ntfstool extract --disk <disk> --volume <vol> --from <path> --output <path> [--stream <stream_name>]
# Or for system files:
# ntfstool extract --disk <disk> --volume <vol> --sam --output <path>

The EFS certificate command allows you to either list all certificates found in user directories or display the detailed properties of a specific certificate file using its inode. This is useful for forensic analysis of Encrypting File System (EFS) artifacts on NTFS volumes.

Modes of Operation

1. List Certificates: If no specific inode or file path is provided, the tool scans C:\Users\<User>\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates for all user certificates. It displays a table containing the User, File Name, MFT Record Index, Size, Creation Time, and certificate metadata (Friendly Name, Container, Provider, etc.).
2. Show Specific Certificate: If an inode or from path is provided, the tool targets that specific MFT record to extract and display its full certificate properties or export it.

Exporting Certificates

If you provide an --output path, instead of displaying the certificate properties in a table, the tool will attempt to export the certificate to a .pem file at the specified location.

# Note: Exact CLI syntax depends on the main entrypoint, but the logic follows:
# To list all certificates:
ntfstool efs certificate [disk_options] [volume_options]

# To show a specific certificate by inode:
ntfstool efs certificate --inode <inode_number>

# To export a certificate to a PEM file:
ntfstool efs certificate --inode <inode_number> --output <output_path>

The info command provides detailed metadata about physical disks, disk images, and their constituent volumes/partitions.

Usage Patterns

1. List all disks: Running info without specific disk or image options provides a summary table of all detected disks.
2. View specific disk details: Provide a disk index or a path to a disk image to see hardware/file metadata, geometry, and a partition table.
3. View specific volume details: Provide a disk index/image AND a volume index to see detailed information about a specific partition (e.g., filesystem, offset, size, Bitlocker status).

Information Provided

• Disks: Model, Type (SSD/HDD/Virtual), Partition Style (MBR/GPT), Size, and Geometry.
• Volumes: Filesystem, Label, Mountpoints, Offset, Size, Free Space, and Bitlocker status (Locked/Unlocked).
• Disk Images: For image files, it also provides file creation/modification/access timestamps and an option to calculate a SHA256 hash.

# Example: List all disks
ntfstool info

# Example: View details for disk index 0
ntfstool info --disk 0

# Example: View details for a disk image
ntfstool info --image /path/to/image.img

# Example: View details for volume 1 on disk 0
ntfstool info --disk 0 --volume 1

# Example: View details for volume 1 on a disk image
ntfstool info --image /path/to/image.img --volume 1