WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-08 02:37:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Relative Offset MFT Header

Browse Source
This commit is contained in:
KevTheHermit
2022-01-15 20:54:22 +00:00
parent a8f5b03816
commit c5987a45d2
2 changed files with 33 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/mftscan.py
+4 -9
View File
@@ -44,13 +44,14 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
# get each of the individual Field Sets
mft_object = symbol_table + constants.BANG + "MFT_ENTRY"
attribute_object = symbol_table + constants.BANG + "ATTRIBUTE"
header_object = symbol_table + constants.BANG + "ATTR_HEADER"
si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY"
fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY"
# Get the Enums
attr_types = self.context.symbol_space.get_enumeration(symbol_table + constants.BANG + "AttrTypeEnum")
namespave_enum = self.context.symbol_space.get_enumeration(symbol_table + constants.BANG + "NameSpaceEnum")
namespace_enum = self.context.symbol_space.get_enumeration(symbol_table + constants.BANG + "NameSpaceEnum")
mft_flags = self.context.symbol_space.get_enumeration(symbol_table + constants.BANG + "MFTFlagsEnum")
permission_flags = self.context.symbol_space.get_enumeration(symbol_table + constants.BANG +
"PermissionFlagEnum")
@@ -69,9 +70,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
attr_header = self.context.object(header_object,
offset = offset + attr_base_offset,
layer_name = layer.name)
attr_resident_header = self.context.object(header_object,
offset = offset + attr_base_offset + 16,
layer_name = layer.name)
vollog.debug(f"Attr Type: {attr_header.AttrType}")
@@ -80,7 +78,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
break
# Offset past the headers to the attribute data
attr_data_offset = offset + attr_base_offset + 24
attr_data_offset = offset + attr_base_offset + self.context.symbol_space.get_type(
attribute_object).relative_child_offset("Attr_Data")
# MFT Flags determine the file type or dir
if mft_record.Flags in mft_flags.choices.values():
@@ -134,10 +133,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
for row in self._generator():
if row[-1] != 'N/A':
filename = row[-1]
created = f'File {row[-1]} Created'
updated = f'File {row[-1]} Updated'
modified = f'File {row[-1]} Modified'
accessed = f'File {row[-1]} Accessed'
yield (f'File {filename} created', timeliner.TimeLinerType.CREATED, row[7])
yield (f'File {filename} modified', timeliner.TimeLinerType.MODIFIED, row[8])
yield (f'File {filename} updated', timeliner.TimeLinerType.CHANGED, row[9])
volatility3/framework/symbols/windows/mft.json
+29 -1
View File
@@ -223,7 +223,35 @@
},
"kind": "struct",
"size": 1024
},"ATTR_HEADER": {
},
"ATTRIBUTE": {
"fields":{
"Attr_Header": {
"offset": 0,
"type": {
"kind": "struct",
"name": "mft!ATTR_HEADER"
}
},
"Resident_Header": {
"offset": 16,
"type": {
"kind": "struct",
"name": "mft!RESIDENT_HEADER"
}
},
"Attr_Data": {
"offset": 24,
"type": {
"kind": "struct",
"name": "mft!ATTR_HEADER"
}
}
},
"kind": "struct",
"size": 96
},
"ATTR_HEADER": {
"fields": {
"AttrType": {
"offset": 0,