williballenthin/INDXParse — pull request #6 by ajnelson (2013-04-06 19:08:50+00:00)
Title: Add other indx types

This patch series implements parsing of NTFS's $Secure indices, re-using some of INDXParse.py's data structures. The object hierarchy changed slightly, making the directory IDNX type one of three parsed INDX types. We've tested this data on some publicly available data noted on the Forensics Wiki - in particular, the CFREDS "hacking" image and XP and Vista "M57-Patents" images.

We just finished code review late yesterday, and see that some partial security parsing is in the new SDS.py. Hopefully our index parsing fits well with your security analysis code.