AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

File Systems

File Systems Tools

ToolDescription
Active Disk EditorBtrFS SuperBlock, exFAT, Ext2/Ext3 Superblock, NTFS, ReFS, XFS
Indx2CsvAn advanced parser for INDX records.
INDXParseTool suite for inspecting NTFS artifacts.
INDXRipperCarve file metadata from NTFS index ($I30) attributes.
ISO BusterCD, DVD, Blu Ray, UDF, ISO9660, Joilet, IFO, BUP, VOB file systems
KAPEKroll Artifact Parser And Extractor (KAPE)
MFTECmdEric Zimmeran Tool - $MFT, $Boot, $J, $SDS, $I30, and $LogFile (coming soon) parser. Handles locked files.
X-Ways

File Systems Artifacts

File SystemArtifactResource
FAT32File CarvingFAT32 File Carving
HFS+MacOS File Movements
HFS+HFS+ Overview
NTFS$I30 Files13Cubed - Windows NTFS Index Attributes ($I30 Files)
NTFS$I30 Files$I30 Parsers Output False Entries. Here's Why - RAT in Mi Kitchen
NTFS$JUSN Journal: Where have you been all my life
NTFS$JThe Windows USN Journal
NTFS$JCarving $USN journal entries
NTFS$J13Cubed - NTFS Journal Forensics
NTFS$JInvestigating USN Journal - Forensafe
NTFS$MFTParsing the $MFT NTFS metadata file
NTFS$MFTResolving File Paths Using The MFT - RAT in Mi Kitchen
NTFS$MFT Bring Out The Body File - TrustedSec
NTFS$SecurityExploring Windows Artifacts : $Security Artifact
NTFSAlternate Data Streams[CQURElabs] Alternate Data Streams
NTFSAlternate Data StreamsAlternate Data Streams (ADS)
NTFSMACB Timestamps13Cubed - Windows MACB Timestamps (NTFS Forensics)
NTFSNTFS Attributes$STANDARD_INFORMATION vs. $FILE_NAME
NTFSNTFS Attributes What I wish someone had told me when I started learning about File System Forensics
NTFSShort File NamesDeceptive NTFS short file names
NTFSThe “\$Extend\$Deleted” directory
NTFS/FAT32/exFATTimestampsFilesystem Timestamps: What Makes Them Tick?
VariousMaster Boot Record Beginning File System Forensics - learning about the disk and the Master Boot Record (MBR)