Package: parseMFT
Parse MFT=========parseMFT.py is designed to fully parse the MFT file from an NTFS filesystemand present the results as accurately as possible in multiple formats. It isintended to be safe to use. A large MFT can require many GB of RAM to fullyload into memory so by default an MFT is parsed in two passes: once loadingall record names into memory and building full file paths, and a second passloading only one record at a time and printing it out.Naturally a single pass is quicker: the amount of time required to processan MFT depends in part on the output format, but a single pass takes abouthalf the time of the standard two pass method. In order to take advantageof the speed increase use the --inmemory option. However, if parseMFT thinksthat doing so might require more than the maximum allowed memory (4 GB bydefault) it will abort and report how much memory it thinks could berequired to process.Note that the actual memory requirement may be substantially less: theestimates are intentionally conservative and -- especially for huge MFTs --may substantially overestimate the actual memory requirement.Installation============You should soon be able to install parseMFT with pip:pip install parseMFTAlternatively:git clone https://github.com/thoromyr/parseMFT.gitcd parseMFTpython setup.py install (or, just run it from that directory)Usage=====<pre>usage: parseMFT.py [-h] (-c | -j | -b | -g | -t) [-o FILE] [-e] [-i INDENT][-s] [-l] [-k] [--legacy_l2t_date] [-f] [-x STRING] [-w][--max_memory MAX_MEMORY] [-a] [-m][--estimate_memory_only] [-p] [-d] [-v] [-q] [-V]MFT_FILEParse Windows MFT and output timelinepositional arguments:MFT_FILE              read MFT from FILEoptional arguments:-h, --help            show this help message and exit-c, --csv             CSV format output-j, --json            JSON format output [use --inmemory to get all data]-b, --bodyfile        Bodyfile format output-g, --timesketch      Timesketch compatible output-t, --timeline        Plaso/log2timeline compatible output-o FILE, --output FILEwrite results to FILE [default is STDOUT]-e, --excel           Make output Excel friendly, normally used with -c-i INDENT, --indent INDENTNumber of spaces to indent in json output; onlymeaningful when used with -j-s, --stdinfo         Prefer STD_INFO timestamps to FILENAME timestamps-l, --localtz         Report times using local timezone-k, --keep_fractional_secondsKeep fractional seconds in date/time stamps--legacy_l2t_date     Use legacy l2t "MM/DD/YYYY" date format-f, --fullpath        Bodyfile uses full path rather than just filename;ignored without -b-x STRING, --invalid_data STRINGText to use for an invalid or missing data, e.g., whentime is zero (1601-01-01 00:00:00) [default is anempty string]-w, --windows_path    File paths should use the windows path separatorinstead of linux--max_memory MAX_MEMORYSet the maximum memory for --inmemory [default is 4GB]-a, --anomaly         Turn on anomaly detection-m, --inmemory        Load in a single pass. Faster but uses more memory.--estimate_memory_onlyTerminate after estimating the amount of memoryrequired.-p, --progress        Show systematic progress reports-d, --debug           Turn on debugging output [implies -vvv, use -q tosuppress verbose output]-v, --verbose         Show non-fatal errors-q, --quiet           Suppress error messages-V, --version         show program's version number and exitTo avoid unicode errors in the console: "export PYTHONIOENCODING=UTF-8"</pre>Output======parseMFT can produce output in JSON, CSV or bodyfile format and conform toplaso/l2t or timesketch.CSV output----------Although JSON is considered to be the authoritative output format, CSV is morecommonly used. While technically CSV stands for "comma separate values" theformat is generalized and other characters, such as pipes, can be used as valuedelimiters. Looked at through this lense, the bodyfile format is a CSV witha pipe delimiter and a particular set of fields.The 'csv' output format is then just a default set of fields (and delimiter)that happens to differ from that of 'bodyfile', 'timeline' and 'timesketch'.Update History==============[See CHANGES.txt]- Version 0.2: csv, plaso/l2t and timesketch working correctly- Version 0.1: bodyfile output working correctly- Version 0.0: rework so that internal representation can be dumped as JSONInspiration===========For an initial incident response triage was pulling the MFT but needed a quickway to parse it for analysis. To this end wanted something quicker/simpler thanplaso but also that could be dumped into timesketch.The analyzeMFT project looked good, but had a muddled internal format thatcouldn't be cleanly dumped to JSON, plus some architectural issues that madethe prospect of extending it a non-starter. But it still served as a good basis.An effort has been made to retain the same options, but some (such as using -vfor --version instead of --verbose) have been changed to better adhere tocommon conventions.Future work===========- further improvements to internal representation- fully implement options- fix JSON output- read from STDIN- validate outputUseful Documentation====================1) http://dubeyko.com/development/FileSystems/NTFS/ntfsdoc.pdf