thewhiteninja/ntfstoolHerramienta forense para NTFS (analizador, mft, bitlocker, archivos eliminados)
NTFSTool es una herramienta forense centrada en volúmenes NTFS. Permite leer información de partición (MBR, tabla de particiones, VBR) así como información sobre Master File Table, volúmenes cifrados con Bitlocker, archivos cifrados con EFS, diario USN y más.
Descarga los últimos binarios en AppVeyor o revisando los últimos artefactos de GitHub.
¡Mira a continuación algunos ejemplos de las funcionalidades!
Una documentación alternativa realizada por deepwiki está disponible aquí: https://deepwiki.com/thewhiteninja/ntfstool/
NTFSTool muestra la estructura completa del registro de arranque maestro, registro de arranque de volumen, tabla de particiones y el registro de archivo $MFT. También es posible volcar cualquier archivo (incluso $MFT o SAM) o analizar USN journal, LogFile incluyendo flujos de Alternate Data Stream (ADS). $MFT se puede volcar como csv o json con el análisis de Zone.Identifier para identificar rápidamente archivos descargados. El comando undelete buscará cualquier registro de archivo marcado como "no en uso" y le permitirá recuperar el archivo (o parte de él si ya fue sobrescrito). Acepta entrada desde archivos de imagen, disco en vivo o virtual como VeraCrypt y TrueCrypt, pero también puede usar herramientas como OSFMount para montar su imagen de disco. También se admiten archivos dispersos y comprimidos (lznt1, xpress).
Para particiones protegidas con BitLocker, puede mostrar registros FVE, verificar una contraseña y clave (bek, password, recovery key), extraer VMK y FVEK. No hay función de fuerza bruta porque el descifrado basado en GPU es mejor (ver Bitcracker y Hashcat), pero puede obtener el hash para estas herramientas.
Las claves maestras, claves privadas y certificados se pueden listar, mostrar y descifrar utilizando las entradas necesarias (SID, contraseña). Los certificados con claves privadas se pueden exportar usando el comando backup.
¡Reimporte la copia de seguridad en otra máquina para poder leer su archivo cifrado nuevamente!
O puede usar el comando efs.decrypt para descifrar un archivo usando la clave respaldada.
Más información en Mimikatz Wiki
Los registros del diario USN se pueden analizar utilizando reglas personalizadas para detectar programas y acciones sospechosas, así como para tener una visión general del diario (% de archivos eliminados, creados ...)
Reglas predeterminadas: Rules/default.json``` { "id": "lsass-dump", "description": "Dumped LSASS.exe process.", "severity": "high", "rule": { "filename": "lsass(\.(dmp|dump))?" } }
Vea un ejemplo de ejecución aquí: [usn.analyze](#usn-analyze)
### Shell
Hay un shell limitado con pocos comandos (exit, cd, ls, cat, pwd, cp, quit, rec).
El comando `rec` muestra los detalles del registro MFT.
## Ayuda y ejemplos
El comando help muestra la descripción y ejemplos para cada comando.
Las opciones se pueden ingresar como número decimal o hexadecimal con el prefijo "0x" (ej: inode).
ntfstool help [command]
| Comando | Descripción |
| --- | --- |
| [info](#info) | Muestra información de todos los discos y volúmenes |
| [mbr](#mbr) | Muestra la estructura MBR, código y particiones de un disco |
| [gpt](#gpt) | Muestra la estructura GPT, código y particiones de un disco |
| [vbr](#vbr) | Muestra la estructura VBR y código de un volumen especificado (soporta ntfs, fat32, fat1x, bitlocker) |
| [extract](#extract) | Extrae un archivo de un volumen. |
| [image](#image) | Crea un archivo de imagen de un disco o volumen. |
| [mft.dump](#mft-dump) | Vuelca el archivo $MFT en el formato especificado: csv, json, raw. |
| [mft.record](#mft-record) | Muestra los detalles del registro FILE para un inodo MFT especificado. Soporta casi todos los tipos de atributos |
| [mft.btree](#mft-btree) | Muestra el contenido VCN y el índice Btree de un inodo |
| [bitlocker.info](#bitlocker-info) | Muestra información y hash ($bitlocker$) de todos los VMK. Prueba una contraseña o clave de recuperación. |
| [bitlocker.decrypt](#bitlocker-decrypt) | Descifra un volumen a un archivo usando contraseña, clave de recuperación o bek. |
| [bitlocker.fve](#bitlocker-fve) | Muestra información para el bloque FVE especificado. |
| [efs.backup](#efs-backup) | Exporta claves EFS en formato PKCS12 (pfx). |
| [efs.decrypt](#efs-decrypt) | Descifra un archivo cifrado con EFS usando claves en formato PKCS12 (pfx). |
| [efs.certificate](#efs-certificate) | Lista, muestra y exporta certificados del sistema (SystemCertificates/My/Certificates). |
| [efs.key](#efs-key) | Lista, muestra, descifra y exporta claves privadas (Crypto/RSA). |
| [efs.masterkey](#efs-masterkey) | Lista, muestra y descifra claves maestras (Protect). |
| [reparse](#reparse) | Analiza y muestra puntos de reanálisis desde \$Extend\$Reparse. |
| [logfile.dump](#logfile-dump) | Vuelca el archivo $LogFile en el formato especificado: csv, json, raw. |
| [usn.analyze](#usn-analyze) | Analiza el archivo $UsnJrnl con reglas especificadas. Salida: csv o json. |
| [usn.dump](#usn-dump) | Vuelca el archivo $UsnJrnl en el formato especificado: csv, json, raw. |
| [shadow](#shadow) | Lista instantáneas de sombra de volumen del disco y volumen seleccionados. |
| [streams](#streams) | Muestra flujos de datos alternativos |
| [undelete](#undelete) | Busca y extrae archivos eliminados de un volumen. |
| [shell](#shell-1) | Inicia un shell limitado tipo Unix |
| [smart](#smart) | Muestra datos S.M.A.R.T |
## Limitaciones
- Algunos casos no soportados. WIP.
- Sin documentación :no_mouth:.
¡Siéntase libre de abrir un issue o solicitar una nueva función!
## Build
- Instale [Visual Studio 2022](https://visualstudio.microsoft.com/fr/vs/)
- Instale vcpkg (para las bibliotecas de terceros requeridas) como se describe aquí: [vcpkg#getting-started](https://github.com/microsoft/vcpkg#getting-started)
```
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat
```
- Intégrelo a su entorno de VisualStudio:
```
vcpkg integrate install
```
En tiempo de compilación, VisualStudio detectará el archivo `vcpkg.json` e instalará los paquetes requeridos automáticamente.
Bibliotecas de terceros:
- [openssl](https://www.openssl.org/): OpenSSL es un proyecto de código abierto que proporciona un kit de herramientas robusto, de calidad comercial y completo para los protocolos Transport Layer Security (TLS) y Secure Sockets Layer (SSL).
- [nlohmann-json](https://github.com/nlohmann/json): JSON para C++ moderno
- [distorm](https://github.com/gdabah/distorm): Potente biblioteca de desensamblador para x86/AMD64
- [cppcoro](https://github.com/lewissbaker/cppcoro): Una biblioteca de abstracciones de corrutinas C++ para el TS de corrutinas.
- [re2](https://github.com/google/re2): RE2 es una alternativa rápida, segura y amigable con subprocesos a los motores de expresiones regulares de retroceso.
## Ejemplos
### Info
<table>
<tr><td>info</td></tr>
<tr><td>
+-------------------------------------------------------------------------------------+
| Id | Model | Type | Partition | Size |
+-------------------------------------------------------------------------------------+
| 0 | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT | 500107862016 (465.76 GiBs) |
| 1 | ST2000DM001-1ER164 | Fixed HDD | GPT | 2000398934016 (1.82 TiB) |
| 2 | 15EADS External | Fixed HDD | MBR | 1500301910016 (1.36 TiB) |
| 3 | osfdisk | Fixed HDD | MBR | 536870912 (512.00 MiBs) |
+-------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3</td></tr>
<tr><td>
Model : osfdisk
Version : 1
Serial :
Media Type : Fixed HDD
Size : 536870912 (512.00 MiBs)
Geometry : 512 bytes * 63 sectors * 255 tracks * 65 cylinders
Volume : MBR
+--------------------------------------------------------------------------------------------------+
| Id | Boot | Label | Mounted | Filesystem | Offset | Size |
+--------------------------------------------------------------------------------------------------+
| 1 | No | NTFSDRIVE | F:\ | Bitlocker | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |
+--------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3 volume=1</td></tr>
<tr><td>
Serial Number : 0000aa60-00002eae
Filesystem : Bitlocker
Bootable : False
Type : Fixed
Label : NTFSDRIVE
Offset : 512 (512.00 bytes)
Size : 536870400 (512.00 MiBs)
Free : 519442432 (495.38 MiBs)
Mounted : True (F:\)
Bitlocker : True (Unlocked)
</td></tr>
</table>
### MBR
<table>
<tr><td>mbr disk=2</td></tr>
<tr><td>
Disk signature : e4589462
Reserved bytes : 0000
Partition table :
+---------------------------------------------------------------------------------------------------+
| Id | Boot | Flags | Filesystem | First sector | Last sector | Offset | Sectors | Size |
+---------------------------------------------------------------------------------------------------+
| 1 | No | Principal | NTFS / exFAT | 0 2 3 | 255 254 255 | 128 | 16771072 | 8.00 GiBs |
+---------------------------------------------------------------------------------------------------+
MBR signature : 55aa
Strings:
[63] : Invalid partition table
[7b] : Error loading operating system
[9a] : Missing operating system
Disassemble Bootstrap Code [y/N] ? y
0000 : 33c0 : xor ax, ax
0002 : 8ed0 : mov ss, ax
0004 : bc007c : mov sp, 0x7c00
0007 : 8ec0 : mov es, ax
0009 : 8ed8 : mov ds, ax
000b : be007c : mov si, 0x7c00
000e : bf0006 : mov di, 0x600
0011 : b90002 : mov cx, 0x200
...
</td></tr>
</table>
### GPT
<table>
<tr><td>gpt disk=1</td></tr>
<tr><td>
Signature : EFI PART
Revision : 1.0
Header Size : 92
Header CRC32 : cc72e4d3
Reserved : 00000000
Current LBA : 1
Backup LBA : 3907029167
First Usable LBA : 34
Last Usable LBA : 3907029134
GUID : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}
Entry LBA : 2
Entries Num : 128
Entries Size : 128
Partitions CRC32 : 0c9a0a25
Partition table : 2 entries
+------------------------------------------------------------------------------------------------------------------------+
| Id | Name | GUID | First sector | Last sector | Flags |
+------------------------------------------------------------------------------------------------------------------------+
| 1 | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34 | 262177 | 000000000000 |
| 2 | Basic data partition | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192 | 3907028991 | 000000000000 |
+------------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### VBR
<table>
<tr><td>vbr disk=3 volume=1</td></tr>
<tr><td>
Structure :
Jump : eb5890 (jmp 0x7c5a)
OEM id : -FVE-FS-
BytePerSector : 512
SectorPerCluster : 8
Reserved Sectors : 0
Number of FATs : 0
Root Max Entries : 0
Total Sectors : 0
Media Type : f8
SectorPerFat : 8160
SectorPerTrack : 63
Head Count : 255
FS Offset : 1
Total Sectors : 0
FAT Flags : 0000
FAT Version : 0000
Root Cluster : 0
FS Info Sector : 1
Backup BootSector: 6
Reserved : 00000000
Reserved : 00000000
Reserved : 00000000
Drive Number : 80
Reserved : 00
Ext. Boot Sign : 29
Serial Number : 00000000
Volume Name : NO NAME
FileSystem Type : FAT32
Volume GUID : {4967d63b-2e29-4ad8-8399-f6a339e3d001}
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
End marker : 55aa
Strings:
[00] : Remove disks or other media.
[1f] : Disk error
[2c] : Press any key to restart
Disassemble Bootstrap Code [y/N] ? y
7c5a : eb58 : jmp 0x7cb4
7c5c : 90 : nop
7c5d : 2d4656 : sub ax, 0x5646
7c60 : 45 : inc bp
7c61 : 2d4653 : sub ax, 0x5346
7c64 : 2d0002 : sub ax, 0x200
...
</td></tr>
</table>
### Extract
<table>
<tr><td>extract disk=0 volume=4 inode=0 output=d:\mymft</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 0 (00000000h)
[-] Destination : d:\mymft
[+] File extracted (5123541 bytes written)
</td></tr>
<tr><td>extract disk=3 volume=1 from=\bob.txt output=d:\bob.txt</td></tr>
<tr><td>
[+] Opening \\?\Volume{00023d5d-0000-0000-0002-000000000000}\
[-] Record Num : 47 (0000002fh)
[-] Destination : d:\bob.txt
[+] File extracted (42 bytes written)
</td></tr>
<tr><td>extract disk=0 volume=4 --system output=d:\system</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 623636 (00098414h)
[-] Destination : d:\system
[+] File extracted (19398656 bytes written)
</td></tr>
</table>
### Image
<table>
<tr><td>image disk=2 volume=2 output=d:\imagevol.raw</td></tr>
<tr><td>
[+] Opening \\?\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\
[-] Size : 33520128 (31.97 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
<tr><td>image disk=2 output=d:\image.raw</td></tr>
<tr><td>
[+] Opening \\.\PhysicalDrive2
[-] Size : 67108864 (64.00 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
</table>
### MFT-dump
<table>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.raw</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.raw
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.csv format=csv</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.csv
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>Muestra de mft.csv (verifique el final de la última línea para datos de Zone.Identifier)</td></tr>
<tr><td><pre>RecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl
0,"True","File","$MFT","",1048576,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
1,"True","File","$MFTMirr","",4096,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
2,"True","File","$LogFile","",67108864,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
3,"True","File","$Volume","",0,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
...
397,"True","File","vswhere.exe",".exe",457824,"103911","2020-10-19 18:42:19","2019-06-11 10:07:50","2019-06-11 10:07:52","2021-12-27 14:54:49","True","False","False","False","False","False","False","False","False","False","False","False","False",35944347632,1,"Zone.Identifier","3","https://github.com/microsoft/vswhere/releases","https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190611T100747Z&X-Amz-Expires=300&X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4&X-Amz-SignedHeaders=host&actor_id=40250307&response-content-disposition=attachment%3B%20filename%3Dvswhere.exe&response-content-type=application%2Foctet-stream"</pre>
</td></tr>
</table>
### MFT-record
<table>
<tr><td>mft.record disk=2 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Signature : FILE
Update Offset : 48
Update Number : 3
$LogFile LSN : 274035114
Sequence Number : 5
Hardlink Count : 1
Attribute Offset : 56
Flags : In_use | Directory
Real Size : 704
Allocated Size : 1024
Base File Record : 0
Next Attribute ID : 56
MFT Record Index : 5
Update Seq Number : 4461
Update Seq Array : 00000000
Attributes:
-----------+------------------------------------------------------------------------------------------------------------------+
| Id | Tipo | No residente | Longitud | Resumen |
+------------------------------------------------------------------------------------------------------------------+
| 1 | $STANDARD_INFORMATION | False | 72 | Fecha de creación del archivo : 2009-12-02 02:03:31 |
| | | | | Última escritura del archivo : 2020-02-24 19:42:23 |
| | | | | Fecha de cambio del registro de archivo : 2020-02-24 19:42:23 |
| | | | | Último acceso : 2020-02-24 19:42:23 |
| | | | | Permisos : |
| | | | | solo_lectura : 0 |
| | | | | oculto : 1 |
| | | | | sistema : 1 |
| | | | | dispositivo : 0 |
| | | | | normal : 0 |
| | | | | temporal : 0 |
| | | | | disperso : 0 |
| | | | | punto_de_reanálisis : 0 |
| | | | | comprimido : 0 |
| | | | | sin conexión : 0 |
| | | | | no indexado : 1 |
| | | | | cifrado : 0 |
| | | | | Número máximo de versiones : 0 |
| | | | | Número de versión : 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | $FILE_NAME | False | 68 | Índice de registro del directorio padre : 5 |
| | | | | Número de secuencia del directorio padre : 5 |
| | | | | Fecha de creación del archivo : 2009-12-02 02:03:31 |
| | | | | Última escritura del archivo : 2011-12-24 03:13:12 |
| | | | | Fecha de cambio del registro de archivo : 2011-12-24 03:13:12 |
| | | | | Último acceso : 1970-01-01 00:59:59 |
| | | | | Tamaño asignado : 0 |
| | | | | Tamaño real : 0 |
| | | | | ------ |
| | | | | Nombre : . |
+------------------------------------------------------------------------------------------------------------------+
| 3 | $OBJECT_ID | False | 16 | ID único del objeto : {cce8fec5-9a29-11df-be68-0017f29 |
| | | | | 8268d} |
+------------------------------------------------------------------------------------------------------------------+
| 4 | $INDEX_ROOT | False | 152 | Tipo de atributo : 00000030h |
| | | | | Regla de intercalación : 1 |
| | | | | Tamaño de entrada de asignación de índice : 4096 |
| | | | | Registro de clúster/índice : 1 |
| | | | | ----- |
| | | | | Desplazamiento de la primera entrada : 16 |
| | | | | Tamaño de entradas de índice : 136 |
| | | | | Entradas de índice asignadas : 136 |
| | | | | Banderas : Índice grande |
+------------------------------------------------------------------------------------------------------------------+
| 5 | $INDEX_ALLOCATION | True | 12288 | Índice |
| | | | | 0000000000000004 : $AttrDef |
| | | | | 0000000000000008 : $BadClus |
| | | | | 0000000000000006 : $Bitmap |
| | | | | 0000000000000007 : $Boot |
| | | | | 000000000000000b : $Extend |
| | | | | 0000000000000002 : $LogFile |
| | | | | 0000000000000000 : $MFT |
| | | | | 0000000000000001 : $MFTMirr |
| | | | | 000000000000002d : $RECYCLE.BIN |
| | | | | 0000000000000009 : $Secure |
| | | | | 000000000000000a : $UpCase |
| | | | | 0000000000000003 : $Volume |
| | | | | 0000000000000005 : . |
| | | | | 000000000000240c : Dir1 |
| | | | | 0000000000000218 : Dir2 |
| | | | | 000000000000212a : Dir3 |
| | | | | 0000000000000024 : Dir4 |
| | | | | 0000000000000def : RECYCLER |
| | | | | 000000000000001b : System Volume Information |
| | | | | 000000000000001b : SYSTEM~1 |
+------------------------------------------------------------------------------------------------------------------+
| 6 | $BITMAP | False | 8 | Nodo de índice usado : 2 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### MFT-árbol B
<table>
<tr><td>mft.btree disk=0 volume=1 inode=5 (carpeta raíz)</td></tr>
<tr><td>
Atributos:
-----------
+-------------------------------------------------------------------------------------------+
| Id | Tipo | No residente | Longitud | Resumen |
+-------------------------------------------------------------------------------------------+
| 1 | $INDEX_ROOT | False | 56 | Tipo de atributo : Nombre de archivo |
| | | | | Regla de intercalación : 1 |
| | | | | Tamaño de entrada de asignación de índice : 4096 |
| | | | | Registro de clúster/índice : 1 |
| | | | | ----- |
| | | | | Desplazamiento de la primera entrada : 16 |
| | | | | Tamaño de entradas de índice : 40 |
| | | | | Entradas de índice asignadas : 40 |
| | | | | Banderas : Índice grande |
+-------------------------------------------------------------------------------------------+
| 2 | $INDEX_ALLOCATION | True | 20480 | Primer VCN : 0x000000000000 |
| | | | | Último VCN : 0x000000000004 |
+-------------------------------------------------------------------------------------------+
Entradas de $INDEX_ALLOCATION:
--------------------------
+--------------------------------------------------------------------------------------------+
| VCN | Dirección bruta | Tamaño | Entradas |
+--------------------------------------------------------------------------------------------+
| 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef |
| | | | 000000000008: $BadClus |
| | | | 000000000006: $Bitmap |
...
| | | | 000000000009: $Secure |
| | | | 00000000000a: $UpCase |
| | | | 000000000003: $Volume |
+--------------------------------------------------------------------------------------------+
| 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |
| | | | 000000000097: randomfile - Copie (5).bat |
| | | | 000000000095: randomfile - Copie (5).psd |
| | | | 000000000096: randomfile - Copie (5).txt |
| | | | 00000000009b: randomfile - Copie (6).accdb |
...
| | | | 000000000083: randomfile.accdb |
| | | | 000000000082: randomfile.bat |
| | | | 000000000084: randomfile.psd |
| | | | 000000000081: randomfile.txt |
| | | | 000000000024: System Volume Information |
+--------------------------------------------------------------------------------------------+
| 000000000002h | 0000007d6000h | 000000001000h | |
+--------------------------------------------------------------------------------------------+
| 000000000003h | 0000007d7000h | 000000001000h | 000000000005: . |
| | | | 000000000092: randomfile - Copie (4).txt |
+--------------------------------------------------------------------------------------------+
| 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder |
| | | | 00000000008c: randomfile - Copie (2).accdb |
| | | | 00000000008b: randomfile - Copie (2).bat |
| | | | 000000000089: randomfile - Copie (2).psd |
...
| | | | 00000000008e: randomfile - Copie (3).txt |
| | | | 000000000094: randomfile - Copie (4).accdb |
| | | | 000000000093: randomfile - Copie (4).bat |
| | | | 000000000091: randomfile - Copie (4).psd |
+--------------------------------------------------------------------------------------------+
Índice B-tree:
-------------
Raíz
|- 000000000000:
|---- VCN: 3
|- 000000000005: .
|---- VCN: 0
|- 000000000004: $AttrDef
|- 000000000008: $BadClus
|- 000000000006: $Bitmap
....
|- 000000000009: $Secure
|- 00000000000a: $UpCase
|- 000000000003: $Volume
|- 000000000092: randomfile - Copie (4).txt
|---- VCN: 4
|- 000000000027: random folder
|- 00000000008c: randomfile - Copie (2).accdb
|- 00000000008b: randomfile - Copie (2).bat
|- 000000000089: randomfile - Copie (2).psd
....
|- 000000000094: randomfile - Copie (4).accdb
|- 000000000093: randomfile - Copie (4).bat
|- 000000000091: randomfile - Copie (4).psd
|- 000000000000 (*)
|---- VCN: 1
|- 000000000098: randomfile - Copie (5).accdb
|- 000000000097: randomfile - Copie (5).bat
|- 000000000095: randomfile - Copie (5).psd
....
|- 000000000084: randomfile.psd
|- 000000000081: randomfile.txt
|- 000000000024: System Volume Information
</td></tr>
</table>
### Información-BitLocker
<table>
<tr><td>bitlocker.info disk=3 volume=1</td></tr>
<tr><td>
Versión FVE : 2
Estado : CIFRADO
Tamaño : 536870400 (512.00 MiBs)
Tamaño cifrado : 536870400 (512.00 MiBs)
Algoritmo : AES-XTS-128
Marca de tiempo : 2020-02-26 16:39:17
Claves maestras del volumen:
-------------------
+--------------------------------------------------------------------------------------------------------------------+
| Id | Tipo | GUID | Detalles |
+--------------------------------------------------------------------------------------------------------------------+
| 1 | Contraseña | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | Nonce : 01d5ecbb00f7155000000003 |
| | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | Clave cifrada : b76281568419ec3bee89d1eddccf3169 |
| | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | 0788bd366bec117b11a9fd6e |
| | | | |
| | | | Hash JtR : $bitlocker$1$16$daea96439babc5d1 |
| | | | e7f20c8860ff1ee9$1048576$12$5015 |
| | | | f700bbecd50103000000$60$175ec23c |
| | | | d799e2bde9d24bf3697919feb7628156 |
| | | | 8419ec3bee89d1eddccf316959c466b6 |
| | | | b392f40f0875e58168d868d70788bd36 |
| | | | 6bec117b11a9fd6e |
+--------------------------------------------------------------------------------------------------------------------+
| 2 | Contraseña de recuperación | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | Nonce : 01d5ecbb00f7155000000006 |
| | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | Clave cifrada : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | 6124ff46865e805367f7bef1 |
| | | | |
| | | | Hash JtR : $bitlocker$1$16$b9963d29e1bad1f4 |
| | | | 2e60c3bfb6e3bef5$1048576$12$5015 |
| | | | f700bbecd50106000000$60$3a06a06f |
| | | | db044d850ecd6faf5cf2aec997a43d40 |
| | | | c695c6d190eba3956ac7c7b1f5fdbbc7 |
| | | | f9a61a77c914fa347479c7ac6124ff46 |
| | | | 865e805367f7bef1 |
+--------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=badpassword</td></tr>
<tr><td>
Versión FVE : 2
Estado : CIFRADO
Tamaño : 536870400 (512.00 MiBs)
Tamaño cifrado : 536870400 (512.00 MiBs)
Algoritmo : AES-XTS-128
Marca de tiempo : 2020-02-26 16:39:17
Contraseña probada:
----------------### Bitlocker-Descifrado
<table>
<tr><td>bitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{09a02598-0000-0000-0002-000000000000}\
[+] Leyendo VBR de Bitlocker
[-] Estado del volumen : CIFRADO
[-] Tamaño : 536870400 (512.00 MiBs)
[-] Tamaño cifrado : 536870400 (512.00 MiBs)
[-] Algoritmo : AES-XTS-128
[+] Descifrando sectores
[-] Tamaño de datos procesados : 512.00 MiBs (100%)
[+] Duración : 7535ms
[+] Cerrando volumen
</td></tr>
</table>
### Bitlocker-FVE
<table>
<tr><td>bitlocker.fve disk=3 volume=1 fve_block=2</td></tr>
<tr><td>
Firma : -FVE-FS-
Tamaño : 57
Versión : 2
Estado actual : CIFRADO (4)
Siguiente estado : CIFRADO (4)
Tamaño cifrado : 536870400 (512.00 MiBs)
Tamaño de conversión : 0
Sectores de respaldo : 16
Bloque FVE 1 : 0000000002100000
Bloque FVE 2 : 00000000059e4000
Bloque FVE 3 : 00000000092c8000
Desplazamiento de sectores de respaldo : 0000000002110000
Cabecera de metadatos FVE
-------------------
Tamaño : 840
Versión : 1
Tamaño de cabecera : 48
Tamaño de copia : 840
GUID del volumen : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}
Siguiente contador : 10
Algoritmo : AES-XTS-128 (8004)
Marca de tiempo : 2020-02-26 16:39:17
Entradas de metadatos FVE (5)
------------------------
+----------------------------------------------------------------------------------------------------------------+
| Id | Versión | Tamaño | Tipo de entrada | Tipo de valor | Valor |
+----------------------------------------------------------------------------------------------------------------+
| 1 | 1 | 72 | Etiqueta de unidad | Unicode | Cadena : TWN NTFSDRIVE 26/02/2020 |
+----------------------------------------------------------------------------------------------------------------+
| 2 | 1 | 224 | VMK | VMK | ID de clave : {2dd368f3-37d7-414f-94e6-3c5b86f |
| | | | | | add50} |
| | | | | | Último cambio : 2020-02-26 16:40:00 |
| | | | | | Protección : Contraseña |
| | | | | | |
| | | | | | Propiedad #1 - Stretch Key - 108 |
| | | | | | -------- |
| | | | | | Cifrado : STRETCH KEY |
| | | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | | | |
| | | | | | Propiedad #1.1 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000002 |
| | | | | | MAC : 1dfebdc79a966e72ca806d6a83d8c7ba |
| | | | | | Clave : eb51a188df981b54f51698c76d76a8bb |
| | | | | | d22afbbe27603ea6afc34c077726262e |
| | | | | | 5ba07482053d3c36fdecf80f |
| | | | | | |
| | | | | | Propiedad #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000003 |
| | | | | | MAC : 175ec23cd799e2bde9d24bf3697919fe |
| | | | | | Clave : b76281568419ec3bee89d1eddccf3169 |
| | | | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | | | 0788bd366bec117b11a9fd6e |
+----------------------------------------------------------------------------------------------------------------+
| 3 | 1 | 316 | VMK | VMK | ID de clave : {19b4a3e2-94b3-452f-a614-6212fae |
| | | | | | b1b9d} |
| | | | | | Último cambio : 2020-02-26 16:40:07 |
| | | | | | Protección : Contraseña de recuperación |
| | | | | | |
| | | | | | Propiedad #1 - Stretch Key - 172 |
| | | | | | -------- |
| | | | | | Cifrado : STRETCH KEY |
| | | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | | | |
| | | | | | Propiedad #1.1 - AES-CCM - 64 |
| | | | | | -------- |
| | | | | | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000004 |
| | | | | | MAC : 8064d679c7d8d1fa8ae548b0844882c7 |
| | | | | | Clave : 18d21021d40e3dc99d38c8dd84faed10 |
| | | | | | 370c32095f4f63261ad8ec40 |
| | | | | | |
| | | | | | Propiedad #1.2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000005 |
| | | | | | MAC : 3d40f2b5fc0091b894b438763fcdf4cd |
| | | | | | Clave : a0af0aeda32d977d26ac76f9fc429668 |
| | | | | | 955d2a6a49fe4e2323751924e47e6c39 |
| | | | | | 8c22f7fcd2d4272003cb7a4e |
| | | | | | |
| | | | | | Propiedad #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000006 |
| | | | | | MAC : 3a06a06fdb044d850ecd6faf5cf2aec9 |
| | | | | | Clave : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | | | 6124ff46865e805367f7bef1 |
| | | | | | |
| | | | | | Propiedad #3 - Copia de seguridad de recuperación - 28 |
| | | | | | -------- |
| | | | | | Ubicación : Archivo |
| | | | | | Inicio : 2022-04-03 12:52:50 |
| | | | | | Fin : 2022-04-03 12:52:50 |
+----------------------------------------------------------------------------------------------------------------+
| 4 | 1 | 80 | FKEV | AES-CCM | Nonce como Hex: 01d5ecbb00f71550 |
| | | | | | Nonce como Hora: 2020-02-26 16:39:59 |
| | | | | | Contador de Nonce: 00000008 |
| | | | | | MAC : 2ff7d7f79920e3509fb8d20cb15b62c8 |
| | | | | | Clave : 097169b9a5c41420ed2353a4a4210763 |
| | | | | | a8833d1a4a88c6f7c0c45ec7c0959f25 |
| | | | | | 2c8eac3f306e9fd1e693784a |
+----------------------------------------------------------------------------------------------------------------+
| 5 | 1 | 100 | Bloque de cabecera de volumen | Desplazamiento y Tamaño | Desplazamiento: 0000000002110000 |
| | | | | | Tamaño : 0000000000002000 |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### EFS-copia de seguridad
<table>
<tr><td>efs.backup disk=0 volume=4 password=123456</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listando directorios de usuario
8 directorios encontrados
[+] Buscando certificados
- 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B
[+] Buscando claves privadas correspondientes
- 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a
[+] Buscando claves maestras correspondientes
- 9ac19509-54d3-48bc-8c67-4cfb01d73498
[+] Exportando 1 certificado y clave (pass: backup)
- ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok
Exportado a 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx
</td></tr>
</table>
### EFS-descifrado
<table>
<tr><td>efs.decrypt disk=0 volume=4 from=c:\cat.png pfx=z:\my_backup.pfx password=backup output=c:\socute.png</td></tr>
<tr><td>
[+] Cargando archivo de entrada PKCS12
[-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b
[-] Leyendo registro: 13525
[+] Analizando flujos $EFS
[-] 1 campo(s) de descifrado de datos encontrado(s)
[+] Descifrando FEK
[-] FEK
+----------------------------------------------------------------------------------+
| Propiedad | Valor |
+----------------------------------------------------------------------------------+
| Entropía | 32 |
| Algoritmo | CALG_AES_256 |
| Clave (256bits)| 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |
+----------------------------------------------------------------------------------+
[+] Descifrando archivo
[-] Archivo descifrado escrito en c:\socute.png (1.94 MiB)
</td></tr>
</table>
### EFS-certificado
<table>
<tr><td>efs.certificate disk=0 volume=4</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listando directorios de usuario
8 directorios encontrados
[+] Buscando certificados
8 certificado(s) encontrado(s)
[+] Certificados
+-----------------------------------------------------------------------------------------------------------------------------------+
| Id | Usuario | Archivo | Certificado |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 0 | Bobby | Nombre : 02728B6DF5573C5955A4DFF22319441C889C367B | Nombre descriptivo : APNS certificate Direct |
| | | Registro : 00000001d2d5h | |
| | | Tamaño : 850.00 bytes | |
| | | | |
| | | Creación : 2019-05-11 15:59:29 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 1 | Bobby | Nombre : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Nombre descriptivo : APNS certificate |
| | | Registro : 00000000b5a4h | |
| | | Tamaño : 824.00 bytes | |
| | | | |
| | | Creación : 2021-03-03 18:02:33 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bobby | Nombre : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Contenedor : ef456e5b-36e4-4eda-a80b-e234611306d4 |
| | | Registro : 00000000ab23h | Proveedor : Microsoft Enhanced Cryptographic Provider v1.0 |
| | | Tamaño : 1.15 KiB | Tipo : PROV_RSA_FULL |
| | | | Especificación de clave : AT_KEYEXCHANGE |
| | | Creación : 2020-08-17 13:20:03 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
..........
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4</td></tr>
<tr><td>[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de certificado: 46500
[+] Certificado
+--------------------------------------------------------------------------------------------------------------------------+
| Id | Propiedad | Valor |
+--------------------------------------------------------------------------------------------------------------------------+
| 0 | Archivo | Creación : 2021-03-03 18:02:33 |
| | | Tamaño : 824.00 bytes |
+--------------------------------------------------------------------------------------------------------------------------+
| 1 | SHA1_HASH_PROP_ID | 14A67663C51C66FF5CAD89B4DC34495864338C67 |
+--------------------------------------------------------------------------------------------------------------------------+
| 2 | FRIENDLY_NAME_PROP_ID | certificado APNS |
+--------------------------------------------------------------------------------------------------------------------------+
| 3 | KEY_IDENTIFIER_PROP_ID | 82B87AE4F2251242252A2644D98169F34F909CA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 4 | SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID | DB532C4794A15E5D0392C7C605FCBCA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 5 | CERTIFICATE_FILE | Datos: |
| | | Versión: 3 (0x2) |
| | | Número de serie: |
| | | 01:20:cb:ab:28:8a:97:ee:99:cc |
| | | Algoritmo de firma: sha1WithRSAEncryption |
| | | Emisor: C=US, O=Apple Inc., OU=Apple iPhone, CN=Apple iPhone Device CA |
| | | Validez |
| | | No antes de: Mar 3 15:57:33 2021 GMT |
| | | No después de : Mar 3 16:02:33 2022 GMT |
| | | Asunto: CN=1A6032AA-91A2-4B1D-B6AF-5509FC173686 |
| | | Información de clave pública del asunto: |
| | | Algoritmo de clave pública: rsaEncryption |
| | | Clave pública RSA: (1024 bit) |
| | | Módulo: |
| | | 00:a2:75:db:69:8d:c9:b3:fd:96:4d:28:b9:43:94: |
| | | a7:6b:d0:01:9e:dc:66:27:ef:2e:20:7e:e5:2a:42: |
| | | 9e:6f:85:9c:b6:8f:be:d3:05 |
| | | Exponente: 65537 (0x10001) |
| | | Extensiones X509v3: |
| | | Identificador de clave de autoridad X509v3: |
| | | keyid:B2:FE:21:23:44:86:95:6A:79:D5:81:26:8E:73:10:D8:A7:4C:8E:74 |
| | | Identificador de clave de asunto X509v3: |
| | | 82:B8:7A:E4:F2:25:12:42:25:2A:26:44:D9:81:69:F3:4F:90:9C:A8 |
| | | Restricciones básicas X509v3: crítico |
| | | CA:FALSE |
| | | Uso de clave X509v3: crítico |
| | | Firma digital, Cifrado de clave |
| | | Uso extendido de clave X509v3: crítico |
| | | Autenticación de servidor web TLS, Autenticación de cliente web TLS |
| | | 1.2.840.113635.100.6.10.6: |
| | | .. |
| | | Algoritmo de firma: sha1WithRSAEncryption |
| | | 28:54:6c:d9:4e:97:f5:dd:1f:79:4a:6a:74:42:ad:6e:a1:11: |
| | | 27:58:3b:d5:1e:c3:71:af:6b:bd:fe:5d:ad:4d:bd:82:fa:53: |
| | | ff:0c |
+--------------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4 output=mycert</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de certificado: 46500
[+] Certificado exportado a mycert.pem
</td></tr>
</table>
### EFS-key
<table>
<tr><td>efs.key disk=0 volume=4</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}
[+] Listando directorios de usuario:
8 directorios encontrados
[+] Buscando claves
9713 clave(s) encontrada(s)
[+] Claves
+------------------------------------------------------------------------------------------------------------------+
| Id | Usuario | Archivo de clave | Nombre | Fecha de creación |
+------------------------------------------------------------------------------------------------------------------+
| 0 | User1 | Nombre : 0004f7ed30db...017ee8d52ca6 | {15676EB3-D258-410F-85CB-9AB29E642CB3} | 2021-05-19 14:10:15 |
| | | Registro : 0000000246c5h | | |
| | | Tamaño : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 1 | User1 | Nombre : 0016875547ba...f7a9606b4177 | {BA4B66DC-8C1D-4FDF-A1EF-78B64411D1AD} | 2020-02-03 19:37:39 |
| | | Registro : 000000019f19h | | |
| | | Tamaño : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 2 | User1 | Nombre : 002a02ec680e...9a0a8d52ca67 | {3A3E1CF2-5AC2-4717-8006-D7C0F2936435} | 2019-06-26 15:50:50 |
..........
</td></tr>
<tr><td>efs.key disk=0 volume=4 inode=742107</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de clave: 742107
[+] Clave
+------------------------------------------------------------------------------------------------------------------+
| Id | Propiedad | Valor |
+------------------------------------------------------------------------------------------------------------------+
| 0 | Archivo | Creación : 2021-09-23 22:16:43 |
| | | Tamaño : 4.00 KiBs |
+------------------------------------------------------------------------------------------------------------------+
| 1 | Versión | 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | Nombre | ef456e5b-43e4-4eda-a80b-e234611306d4 |
+------------------------------------------------------------------------------------------------------------------+
| 3 | Banderas | 00000000h |
+------------------------------------------------------------------------------------------------------------------+
| 4 | Clave pública | Magic : 31415352h (RSA1) |
| | | Tamaño : 2048 |
| | | Exponente : 65537 |
| | | |
| | | Permisos : CRYPT_ENCRYPT |
| | | CRYPT_DECRYPT |
| | | CRYPT_EXPORT |
| | | CRYPT_READ |
...
| | | |
| | | Módulo : 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+------------------------------------------------------------------------------------------------------------------+
| 5 | Clave privada cifrada | Versión : 1 |
| | | GUID del proveedor : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | Versión de clave maestra : 1 |
| | | GUID de clave maestra : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Descripción : Clé privée CryptoAPI |
| | | Banderas : 00000000h |
| | | |
| | | Algoritmo de cifrado : CALG_AES_256 |
| | | Algoritmo hash : CALG_SHA_512 |
| | | |
| | | Sal : ABABD5324CCE0254BC726C3BF5A777D38BC4D75CACC2360EF3276EB4DC42FF6A |
| | | |
| | | HMAC : - |
| | | HMAC2 : D24F0B0AF684AE986F1328EAAFC01DA346D2BADE2B84CBE3C94CCB338D449EA6 |
| | | |
| | | Datos cifrados : D7DAD9229C91DBC9608852A4411527D7 |
| | | 58DB27E19596DD118F2D70F68CC7913C |
...
| | | 7870F6C68DA1B9139BF6E39725F4E72E |
| | | 4EC435C947F127CA3E333CB5E2F43978 |
| | | |
| | | Datos de firma : 6077C027E6714A81C2710C5D334758F9AD463117DA4CBA8D0D05B5845A662E8F |
| | | 5E38DCCAB05DA5DD6C8328F5CF925F378F229790D30A2BCC91D5E3370AE50FED |
+------------------------------------------------------------------------------------------------------------------+
| 6 | Hash | 0000000000000000000000000000000000000000 |
+------------------------------------------------------------------------------------------------------------------+
| 7 | Marca de exportación | Versión : 1 |
| | | GUID del proveedor : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | Versión de clave maestra : 1 |
| | | GUID de clave maestra : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Descripción : Flag de exportación |
| | | Banderas : 00000000h |
| | | |
| | | Algoritmo de cifrado : CALG_AES_256 |
| | | Algoritmo hash : CALG_SHA_512 |
| | | |
| | | Sal : 772935C3582F625367716CE87D9626A524F15B9B7FF07166BB2C704B1223CB06 |
| | | |
| | | HMAC : - |
| | | HMAC2 : 3BCA74ED2C83767F06D9FF907817FE85FBA65FDB72A94E9D8F2C7CF1D8E7DCA2 |
| | | |
| | | Datos cifrados : 875A6429226F11DFD3690D43BE633287 |
| | | |
| | | Datos de firma : FD97F69A214C37D0DA968B5AA18EE7C80D475F72F650C8DCAE887C97E850DCD6 |
| | | 9FA17D397A2375E362DE6F17193E3D084C06B0DCDB38E6C746150C1056145178 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34fac126105ce30...178c5bff4979eb</td></tr>
<tr><td>[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de clave: 742107
[-] Clave
Algoritmo de cifrado : CALG_AES_256
Algoritmo hash : CALG_SHA_512
Sal : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] Descifrando clave
[+] Clave descifrada exitosamente
[+] Banderas de exportación : 00000001 (ALLOW_EXPORT_FLAG)
[+] Clave en claro (2048 bits) :
+----------------------------------------------------------+
| Id | Propiedad | Valor |
+----------------------------------------------------------+
| 0 | Magic | RSA2 |
+----------------------------------------------------------+
| 1 | Bitsize | 2048 |
+----------------------------------------------------------+
| 2 | Exponente | 65537 |
+----------------------------------------------------------+
| 3 | Módulo | 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+----------------------------------------------------------+
| 4 | Prime1 | C02F585644ED6326FF82368B0AD9ECD4 |
...
| | | 65F7DE6D173FEBEF95BE491FB222E07B |
+----------------------------------------------------------+
| 5 | Prime2 | C884376BBC50C2A14C495894FBF980DE |
...
| | | 6759E812B6385B9151EBED8DCD65238F |
+----------------------------------------------------------+
| 6 | Exponent1 | 0E33B17876918051427271EB667AE238 |
...
| | | 69349EF83ACE9B75D20004D155CDA3FF |
+----------------------------------------------------------+
| 7 | Exponent2 | 5BF265077E1EFA60C47E8DA423B751A4 |
...
| | | E7008F2EA5684A74E4BFEEFAAB48C979 |
+----------------------------------------------------------+
| 8 | Coeficiente | 7D68AA3844F096959C23BD59E4BE3147 |
...
| | | 592ABC1BEDEBA6F5B4BDE3D0F9BEF7C5 |
+----------------------------------------------------------+
| 9 | Exponente privado| 2462A061AD85A7C3B0DF7764CC5DDDFA |
| | | 40D83B3FBF0D9D016C419E6B6744AD73 |
...
| | | 47685BDEB0FABDC21AF5CABBA13D138D |
| | | F39FC063F1F20323E3220229E29FA42D |
+----------------------------------------------------------+
</td></tr>
<tr><td> efs.key disco=0 volumen=4 inodo=742107 clavemaestra=34...eb salida=mykey</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de clave: 742107
[-] Clave
Algoritmo de cifrado : CALG_AES_256
Algoritmo hash : CALG_SHA_512
Sal : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] Descifrando clave
[+] Clave descifrada exitosamente
[+] Clave pública exportada a mykey.pub.pem.
[+] Clave privada exportada a mykey.priv.pem.
</td></tr>
</table>
### EFS-clavemaestra
<table>
<tr><td>efs.masterkey disco=0 volumen=4</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listando directorios de usuario
8 directorios encontrados
[+] Buscando claves
19 clave(s), 2 archivo(s) preferido(s) encontrados
[+] Claves maestras
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| Id | Usuario | Archivo clave | Clave(s) | Fecha de creación |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 0 | DefaultAppPool | Nombre : e4ed144f-6522-4471-8893-a6e29e175ba6 | ClaveMaestra | 2021-08-17 14:54:41 |
| | | Registro : 000000031848h | Versión : 2 | |
| | | Tamaño : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Sal : FA737C82899CC3F61A3B332B15FDC241 | |
| | | | Rondas : 8000 | |
| | | | ClaveRespaldo | |
| | | | Versión : 2 | |
| | | | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Sal : DF0651C903763132BC3043BF144A7DDD | |
| | | | Rondas : 8000 | |
| | | | CredHist | |
| | | | Versión : 3 | |
| | | | GUID : {00000000-0000-0000-0000-000000000000} | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 1 | DefaultAppPool | Nombre : Preferred | Preferida | 2021-08-17 14:54:41 |
| | | Registro : 00000003184ah | GUID : {e4ed144f-6522-4471-8893-a6e29e175ba6} | |
| | | Tamaño : 24.00 bytes | Renovar : 2021-11-15 12:54:41 | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bob | Nombre : 26bd8b3d-e87f-4df3-a1af-18f434788090 | ClaveMaestra | 2021-03-05 01:16:42 |
| | | Registro : 000000004f4ah | Versión : 2 | |
| | | Tamaño : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Sal : 39B575D1816DE8224B9E11C38E35EB34 | |
| | | | Rondas : 8000 | |
| | | | ClaveRespaldo | |
..........
</td></tr>
<tr><td>efs.masterkey disco=0 volumen=4 inodo=0x80544</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de clave maestra: 525636
[+] Clave maestra
+--------------------------------------------------------------------+
| Id | Propiedad | Valor |
+--------------------------------------------------------------------+
| 0 | Archivo | Creación : 2020-07-06 05:56:06 |
| | | Tamaño : 468.00 bytes |
+--------------------------------------------------------------------+
| 1 | Versión | 2 |
+--------------------------------------------------------------------+
| 2 | GUID | 9ac19509-54d3-48bc-8c67-4cfb01d73498 |
+--------------------------------------------------------------------+
| 3 | Directiva | 00000005h |
+--------------------------------------------------------------------+
| 4 | ClaveMaestra | Versión : 2 |
| | | Sal : 3ED4CDBCC4073D6724A512061D0597E1 |
| | | Rondas : 8000 |
| | | Algo Hash : CALG_SHA_512 |
| | | Algo Cif : CALG_AES_256 |
| | | Clave Cif : 3610946FE1A7B9099D0AFA7658325014 |
| | | 296D1F0E5BA93249858BE3ACCC8FD7A8 |
| | | F62DB6808833FC303095C6588BDE3826 |
| | | 80ABF391222CD77661BCCB637DDAC490 |
| | | B5FC02C854EF45490EE10851EF524DE2 |
| | | 85DD508F905216D528D3DC3336830FF9 |
| | | 690472730A03D64CF892E06B9AA35692 |
| | | AB7679E908D487119030B73CB87E6F9F |
| | | 731F65609CB8ACA972BCC9042B27B9B4 |
+--------------------------------------------------------------------+
| 5 | ClaveRespaldo | Versión : 2 |
| | | Sal : B60E21F9578D02A97964D7B10151BE69 |
| | | Rondas : 8000 |
| | | Algo Hash : CALG_SHA_512 |
| | | Algo Cif : CALG_AES_256 |
| | | Clave Cif : CD5D3684873D6A1D66520FB1642779E1 |
| | | D78A649F02DDFE7C069F9B5F8FF9F005 |
| | | 7DC01E0A6AA9A815C8887BC1BF5B88E6 |
| | | E797DC5F4A3A0535B3217BADC7FAD38E |
| | | 798C1846423C8631DE472D790B308B2D |
| | | F15340B87FCD55A98DAEE92196235CF9 |
| | | B328FAF475C05A911DF19C99D54D5A3C |
+--------------------------------------------------------------------+
| 6 | CredHist | Versión : 3 |
| | | GUID : {20e0b482-797f-429e-b4a0-30020731ef0a} |
+--------------------------------------------------------------------+
</td></tr>
<tr><td> efs.masterkey disco=0 volumen=4 inodo=0x80544 sid="S-1-5-21-1521398...3175218-1001" contraseña="ntfst00l"</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo registro de archivo de clave maestra: 525636
[-] Clave maestra
Algoritmo de cifrado : CALG_AES_256
Algoritmo hash : CALG_SHA_512
Rondas : 8000
Sal : 3ED4CDBCC4073D6724A512061D0597E1
[+] Descifrando clave maestra
[+] Clave maestra en claro (256 bits):
34FAC126105CE302421A0FC7E3933FEC5639AA6BFF95000E6DA83AE67522EAB6
0AF58A27D834883B65611878B258AAAECD8983E3718E00F276178C5BFF4979EB
</td></tr>
</table>
### Reparse
<table>
<tr><td>reparse disco=0 volumen=4</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Leyendo $Extend\$Reparse
[+] 104 entradas encontradas
+----------------------------------------------------------------------------------------------------------------+
| Id | Índice MFT | Nombre de archivo | Tipo | Destino/Dato |
+----------------------------------------------------------------------------------------------------------------+
| 0 | 00000eb3 | debian.exe | AppExecLink | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4 |
| | | | | |
| | | | | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4!debian |
| | | | | |
| | | | | C:\Program Files\WindowsApps\The |
| | | | | DebianProject.DebianGNULinux_1.2 |
| | | | | .0.0_x64__76v4gfsz19hv4\debian.e |
| | | | | xe |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 13 | 000007f9 | BaseLayer | Punto de montaje | \??\Volume{629458e4-0000-0000-00 |
| | | | | 00-010000000000}\ |
+----------------------------------------------------------------------------------------------------------------+
| 14 | 00013e24 | Watchdog | Punto de montaje | \??\C:\Program Files\NVIDIA Corp |
| | | | | oration\NvContainer\Watchdog |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 102 | 00035861 | C2R64.dll | Enlace simbólico | \??\C:\Program Files\Common File |
| | | | | s\Microsoft Shared\ClickToRun\C2 |
| | | | | R64.dll |
+----------------------------------------------------------------------------------------------------------------+
| 103 | 000986b0 | All Users | Enlace simbólico | \??\C:\ProgramData |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Logfile-dump
<table>
<tr><td>logfile.dump disco=4 volumen=1 salida=logfile.csv formato=csv</td></tr>
<tr><td>
[+] Abriendo \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Leyendo registro $LogFile
[-] Tamaño de $LogFile : 4.14 MiBs
[+] Analizando páginas de reinicio de $LogFile
[-] LSN de la página de reinicio más nueva : 5274485
[-] Volumen marcado como desmontado limpiamente
[-] Cliente encontrado : [1] NTFS
[+] Analizando páginas de registro de $LogFile
[-] Cantidad de páginas de registro de $LogFile: 86
[+] Analizando registros de $LogFile: 601
[+] Cerrando volumen
</td></tr>
<tr><td>Muestra de logfile.csv</td></tr>
<tr><td><pre>LSN,ClientPreviousLSN,UndoNextLSN,ClientID,RecordType,TransactionID,RedoOperation,UndoOperation,MFTClusterIndex,TargetVCN,TargetLCN
5269000,5268967,5268967,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269019,5269000,5269000,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269044,5269019,5269019,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269063,5269044,5269044,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269082,5269063,5269063,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269103,5269082,5269082,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269122,5269103,0,0,1,24,ForgetTransaction,CompensationLogRecord,0,0,18446744073709551615
5269133,0,0,0,1,24,UpdateResidentValue,UpdateResidentValue,2,13,43703</pre>
</td></tr>
</table>
### USN-analyze
<table>
<tr><td>Desde volcado : usn.analyze from=usn_dump rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr></tr>
<tr><td>Desde sistema en ejecución : usn.analyze disk=4 volume=1 rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr><td>
[+] Cargando reglas desde: d:\rules.json
[-] 4 reglas cargadas
[+] Creando d:\usn_analyze_results.csv
[-] Modo: rápido
[+] Abriendo \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[+] Buscando $Extend\$UsnJrnl
[-] Encontrado en registro de archivo: 116
[-] Tamaño de flujo $J: 31.70 KiBs (podría ser disperso)
[+] Procesando registros USN: 192 (31.70 KiBs) - 9 coincidencias
[+] Cerrando volumen
[+] Resumen:
+------------------------------------------------------+
| Índice | Categoría | Valor | % |
+------------------------------------------------------+
| 0 | creación archivo | 125 | 65.10 |
| 1 | eliminación archivo | 0 | 0.00 |
| 2 | renombrado archivo | 8 | 4.17 |
| 3 | más reciente | 2022-03-28 23:23:12 | |
| 4 | más antiguo | 2022-03-28 13:20:08 | |
| 5 | conteo registros | 192 | 100.00 |
+------------------------------------------------------+
[+] Resultados de reglas:
+------------------------------------------+
| Índice | ID de regla | Conteo | % |
+------------------------------------------+
| 0 | executable-create | 9 | 4.69 |
| 1 | ccleaner | 2 | 1.04 |
| 2 | lsass-dump | 1 | 0.52 |
+------------------------------------------+
</td></tr>
</table>
### USN-dump
<table>
<tr><td>usn.dump disco=4 volumen=1 salida=usn.csv formato=csv</td></tr>
<tr><td>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Finding $Extend\$UsnJrnl record
[+] Found in file record: 88008
[+] $J stream size: 60.24 GiBs (could be sparse)
[+] Creating d:\mft_c.csv
[+] Loading $MFT records
[+] Processing $MFT records: 1.37 GiB
[+] 1436928 record loaded
[+] Processing entry: 322667 (34.12 MiBs)
[+] Closing volume
</td></tr>
<tr><td>Muestra de usn.csv</td></tr>
<tr><td><pre>MajorVersion,MinorVersion,FileReferenceNumber,FileReferenceSequenceNumber,ParentFileReferenceNumber,ParentFileReferenceSequenceNumber,Usn,Timestamp,Reason,SourceInfo,SecurityId,FileAttributes,Filename
2,0,53,4,5,5,0,2020-02-26 21:43:36,FILE_CREATE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,96,2020-02-26 21:43:36,FILE_CREATE+CLOSE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,192,2020-02-26 21:43:38,RENAME_OLD_NAME,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,288,2020-02-26 21:43:38,RENAME_NEW_NAME,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,360,2020-02-26 21:43:38,RENAME_NEW_NAME+CLOSE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,432,2020-02-26 21:43:39,OBJECT_ID_CHANGE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,504,2020-02-26 21:43:39,OBJECT_ID_CHANGE+CLOSE,0,0,DIRECTORY,volume:\test
2,0,54,2,53,4,576,2020-02-26 21:43:41,FILE_CREATE,0,0,ARCHIVE,volume:\test\Nouveau document texte.txt</pre>
</td></tr>
</table>
### Shadow
<table>
<tr><td>shadow disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] VSS header found at 0x1e00
+---------------------------------------------------------------------------------------------------------------+
| SetID/ID | Count | Date | Details |
+---------------------------------------------------------------------------------------------------------------+
| {857c9ac4-ee4f-4bc6-b822-59e935a7120f} | 1 | 2020-09-21 00:15:38 | Service Machine : WORK-PC10 |
| | | | Originating Machine: WORK-PC10 |
| {3d102db1-8de2-4e7d-8ba5-e0dd4f67740d} | | | State : Created |
| | | | Flags : 0x0042000d |
| | | | - Persistent |
| | | | - Client Accessible |
| | | | - No Auto Release |
| | | | - Differential |
| | | | - Auto Recover |
+---------------------------------------------------------------------------------------------------------------+
| {83bc8af4-8802-4466-ae38-717f6474616a} | 1 | 2020-09-22 06:10:00 | Service Machine : WORK-PC10 |
| | | | Originating Machine: WORK-PC10 |
| {e668c329-66a2-4ebd-beef-3c6bca81cbf7} | | | State : Created |
| | | | Flags : 0x0042000d |
| | | | - Persistent |
| | | | - Client Accessible |
| | | | - No Auto Release |
| | | | - Differential |
| | | | - Auto Recover |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Streams
<table>
<tr><td>streams disk=0 volume=4 from=c:\test.pdf</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Source : c:\test.pdf
[-] Record Num : 13525 (000034d5h)
[+] Alternate data stream(s):
+-----------------------------+
| Id | Name | Size |
+-----------------------------+
| 0 | Zone.Identifier | 27 |
+-----------------------------+
</td></tr>
</table>
### Undelete
<table>
<tr><td>undelete disk=4 volume=1</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading $MFT record
[+] $MFT size : 256.00 KiBs (~256 records)
[+] Reading $BITMAP record
[+] $BITMAP size : 16.00 KiBs
[+] Searching deleted files
[+] Processed data size : 262144 (100%)
[+] Duration : 7ms
Deleted Files Found
-------------------
+---------------------------------------------------------------------------------------------------------------+
| Id | MFT Index | Flag | Filename | Size | Deletion Date | % Recoverable |
+---------------------------------------------------------------------------------------------------------------+
| 0 | 00000029 | | .\$RECYCLE.BIN\[...]\$RAV85W4.jpg | 5.10 KiBs | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
| 1 | 00000035 | | .\$RECYCLE.BIN\[...]\$IAV85W4.jpg | 58.00 bytes | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>undelete disk=2 volume=1 format=csv output=mydeletedfiles.csv</td></tr>
<tr><td>
[+] Opening \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[-] $MFT size :34.00 MiBs (~34816 records)
[-] $BITMAP size :14.32 MiBs
[+] Searching deleted files
[-] Processed data: 35651584 (100%)
[-] Duration : 425ms
[+] Deleted files : 127
[+] Writing results to mydeletedfiles.csv (csv) file
[+] Done
</td></tr>
<tr><td>undelete disk=4 volume=1 inode=41 output=restored_kitten.jpg</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading file record : 41
[+] Extracting $RAV85W4.jpg to restored_kitten.jpg
[+] 5219 bytes written
</td></tr>
</table>
### Shell
<table>
<tr><td>shell disk=4 volume=1</td></tr>
<tr><td>
disk4:volume1:> ls
Inode | Type | Name | Size | Creation Date | Attributes
---------------------------------------------------------------------------------------
4 | | $AttrDef | 2560 | 2020-02-26 16:35:29 | Hi Sy
8 | | $BadClus | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Bad | 536866816 | |
6 | | $Bitmap | 16384 | 2020-02-26 16:35:29 | Hi Sy
7 | | $Boot | 8192 | 2020-02-26 16:35:29 | Hi Sy
11 | DIR | $Extend | | 2020-02-26 16:35:29 | Hi Sy
2 | | $LogFile | 4341760 | 2020-02-26 16:35:29 | Hi Sy
0 | | $MFT | 262144 | 2020-02-26 16:35:29 | Hi Sy
1 | | $MFTMirr | 4096 | 2020-02-26 16:35:29 | Hi Sy
50 | DIR | $RECYCLE.BIN | | 2020-02-26 16:40:34 | Hi Sy
9 | | $Secure | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $SDS | 264200 | |
10 | | $UpCase | 131072 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Info | 32 | |
3 | | $Volume | 0 | 2020-02-26 16:35:29 | Hi Sy
5 | DIR | . | | 2020-02-26 16:35:29 | Hi Sy
85010 | | 7z1900-x64.exe | 1447178 | 2020-07-29 17:19:49 | Ar
| ADS | Zone.Identifier | 123 | |
42 | | hello.txt | 5 | 2020-02-26 21:27:33 | Ar
39 | | kitten1.jpg | 23486 | 2020-02-26 16:37:23 | Ar
| ADS | Zone.Identifier | 154 | |
40 | | kitten2.jpg | 79678 | 2020-02-26 16:37:55 | Ar
| ADS | Zone.Identifier | 303 | |
41 | | kitten3.jpg | 5219 | 2020-02-26 16:38:16 | Ar
| ADS | Zone.Identifier | 262 | |
36 | DIR | System Volume Information | | 2020-02-26 16:35:29 | Hi Sy
disk4:volume1:> pwd
\
disk4:volume1:> cat hello.txt
Hey !
disk4:volume1:> cat 7z1900-x64.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://www.7-zip.org/download.html
HostUrl=https://www.7-zip.org/a/7z1900-x64.exe
disk4:volume1:> cp kitten3.jpg z:\custestkitten.jpg
1 file copied
disk4:volume1:> exit
</td></tr>
</table>
### SMART
<table>
<tr><td>smart disk=1</td></tr>
<tr><td>
Version : 1 revision 1
Type : SATA/IDE Master on primary channel
Capabilities : ATA, ATAPI, S.M.A.R.T
Status : Passed
-- Device ID
+---------------------------------------------------------------------------------------------------+
| Property | Value |
+---------------------------------------------------------------------------------------------------+
| General Configuration | 0040h |
| Number of Cylinders | 16383 |
| Reserved | c837h |
| Number Of Heads | 16 |
| Bytes Per Track | 0 |
| Bytes Per Sector | 0 |
| Sectors Per Track | 63 |
| Vendor Unique | |
| Seria Number | S2RBNX0H606448W |
| Buffer Type | 0 |
| Buffer Size | 0 |
| ECC Size | 0 |
| Firmware Revision | EMT02B6Q |
| Model Number | Samsung SSD 850 EVO 500GB |
| Maximum Number of Sectors On R/W | 32769 |
| Double Word IO | 16385 |
| Capabilities | Reserved : 0000h |
| | DMA Support : True |
| | LBA Support : True |
| | DisIORDY : True |
| | IORDY : True |
| | Requires ATA soft start : False |
| | Overlap Operation support: True |
| | Command Queue Support : False |
| | Interleaved DMA Support : False |
| Reserved1 | 4000h |
| PIO Timing | 512 |
| DMA Timing | 512 |
| Field Validity | CHS Number : True |
| | Cycle Number : True |
| | Ultra DMA : True |
| Current numbers of cylinders | 16383 |
| Current numbers of heads | 16 |
| Current numbers of sectors per track | 63 |
| Multiple Sector Setting | 16514064 |
| Total Number of Sectors Addressable (LBA) | 268435455 |
| Singleword DMA Transfer Support | 0 |
| Multiword DMA Transfer Support | Mode 0 (4.17Mb/s) |
| | Mode 1 (13.3Mb/s) |
| | Mode 2 (16.7Mb/s) |
| Advanced PIO Modes | 0003h |
| Minimum Multiword DMA Transfer Cycle Time per Word | 120 |
| Recommended Multiword DMA Transfer Cycle Time per Word | 120 |
| Minimum PIO Transfer Cycle Time (No Flow Control) | 120 |
| Minimum PIO Transfer Cycle Time (Flow Control) | 120 |
| ATA Support | ATA-2 |
| | ATA-3 |
| | ATA-4 |
| | ATA/ATAPI-5 |
| | ATA/ATAPI-6 |
| | ATA/ATAPI-7 |
| | ATA/ATAPI-8 |
| | ATA/ATAPI-9 |
| Ultra DMA Transfer Support | Mode 0 (16.7MB/s) |
| | Mode 1 (25.0MB/s) |
| | Mode 2 (33.3MB/s) |
| | Mode 3 (44.4MB/s) |
| | Mode 4 (66.7MB/s) |
| | Mode 5 (100.0MB/s) (selected) |
| | Mode 6 (133.0MB/s) |
+---------------------------------------------------------------------------------------------------+
-- Attributes
+-------------------------------------------------------------------------------------------------------------------+
| Index | Name | Flags | Raw | Value | Worst | Threshold | Status |
+-------------------------------------------------------------------------------------------------------------------+
| 05h | Reallocated Sector Count | 0033h | 000000000000h | 100 | 100 | 10 | Ok |
| 09h | Power-On Hours Count | 0032h | 000000008d54h | 92 | 92 | 0 | Ok |
| 0ch | Power Cycle Count | 0032h | 0000000000f5h | 99 | 99 | 0 | Ok |
| b1h | Wear Range Delta | 0013h | 00000000005eh | 95 | 95 | 0 | Ok |
| b3h | Used Reserved Block Count (Total) | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| b5h | Program Fail Count Total | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b6h | Erase Fail Count | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b7h | Sata Down Shift Error Count | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| bbh | Reported Uncorrectable Errors | 0032h | 000000000000h | 100 | 100 | 0 | Ok |
| beh | Temperature Difference From 100 | 0032h | 000000000020h | 68 | 50 | 0 | Ok |
| c3h | Hardware Ecc Recovered | 001ah | 000000000000h | 200 | 200 | 0 | Ok |
| c7h | Udma Crc Error Rate | 003eh | 000000000000h | 100 | 100 | 0 | Ok |
| ebh | Good Block Count And System Free Block Count | 0012h | 000000000071h | 99 | 99 | 0 | Ok |
| f1h | Lifetime Writes From Host Gib | 0032h | 00154bf298c9h | 99 | 99 | 0 | Ok |
+-------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>