thewhiteninja/ntfstoolStrumento forense per NTFS (parser, mft, bitlocker, file cancellati)
NTFSTool è uno strumento forense focalizzato sui volumi NTFS. Supporta la lettura delle informazioni sulle partizioni (MBR, tabella delle partizioni, VBR) ma anche informazioni su Master File Table, volumi crittografati con Bitlocker, file crittografati con EFS, journal USN e altro.
Scarica gli ultimi binari su AppVeyor o controllando gli ultimi artefatti su GitHub.
Vedi sotto per alcuni esempi delle funzionalità!
Una documentazione alternativa realizzata da deepwiki è disponibile qui: https://deepwiki.com/thewhiteninja/ntfstool/
NTFSTool mostra la struttura completa del master boot record, volume boot record, tabella delle partizioni e record file $MFT. È anche possibile scaricare qualsiasi file (anche $MFT o SAM) o analizzare e analizzare il journal USN, LogFile inclusi i flussi da Alternate Data Stream (ADS). $MFT può essere scaricato come csv o json con l'analisi di Zone.Identifier per identificare rapidamente i file scaricati. Il comando undelete cercherà qualsiasi record file contrassegnato come "non in uso" e ti permetterà di recuperare il file (o parte del file se è già stato riscritto). Supporta l'input da file immagine, disco live o virtuale come VeraCrypt e TrueCrypt, ma puoi anche usare strumenti come OSFMount per montare l'immagine del disco. Sono supportati anche file sparsi e compressi (lznt1, xpress).
Per le partizioni crittografate con Bitlocker, può mostrare i record FVE, verificare una password e una chiave (bek, password, chiave di ripristino), estrarre VMK e FVEK. Non esiste una funzionalità di brute force perché l'attacco basato su GPU è migliore (vedi Bitcracker e Hashcat) ma puoi ottenere l'hash per questi strumenti.
Le masterkey, le chiavi private e i certificati possono essere elencati, visualizzati e decifrati utilizzando gli input necessari (SID, password). I certificati con chiavi private possono essere esportati utilizzando il comando backup.
Reimporta il backup su un'altra macchina per poter leggere di nuovo il tuo file crittografato!
Oppure puoi usare il comando efs.decrypt per decifrare un file usando la chiave di backup.
Maggiori informazioni su Mimikatz Wiki
I record del journal USN possono essere analizzati utilizzando regole personalizzate per rilevare programmi e azioni sospetti ma anche per avere una panoramica del journal (% di file eliminati, creati ...)
Regole predefinite: Rules/default.json``` { "id": "lsass-dump", "description": "Dumped LSASS.exe process.", "severity": "high", "rule": { "filename": "lsass(\.(dmp|dump))?" } }
Vedi un esempio di esecuzione qui: [usn.analyze](#usn-analyze)
### Shell
C'è una shell limitata con pochi comandi (exit, cd, ls, cat, pwd, cp, quit, rec).
Il comando `rec` mostra i dettagli del record MFT.
## Aiuto ed Esempi
Il comando di aiuto mostra descrizione ed esempi per ogni comando.
Le opzioni possono essere inserite come numero decimale o esadecimale con prefisso "0x" (es: inode).
ntfstool help [command]
| Comando | Descrizione |
| --- | --- |
| [info](#info) | Mostra informazioni per tutti i dischi e volumi |
| [mbr](#mbr) | Mostra struttura MBR, codice e partizioni per un disco |
| [gpt](#gpt) | Mostra struttura GPT, codice e partizioni per un disco |
| [vbr](#vbr) | Mostra struttura VBR e codice per un volume specificato (ntfs, fat32, fat1x, bitlocker supportati) |
| [extract](#extract) | Estrai un file da un volume. |
| [image](#image) | Crea un file immagine di un disco o volume. |
| [mft.dump](#mft-dump) | Scarica il file $MFT nel formato specificato: csv, json, raw. |
| [mft.record](#mft-record) | Mostra i dettagli del record FILE per un inode MFT specificato. Quasi tutti i tipi di attributo supportati |
| [mft.btree](#mft-btree) | Mostra il contenuto VCN e l'indice Btree per un inode |
| [bitlocker.info](#bitlocker-info) | Mostra informazioni e hash ($bitlocker$) per tutti i VMK. Testa una password o chiave di ripristino. |
| [bitlocker.decrypt](#bitlocker-decrypt) | Decifra un volume in un file usando password, chiave di ripristino o bek. |
| [bitlocker.fve](#bitlocker-fve) | Mostra informazioni per il blocco FVE specificato. |
| [efs.backup](#efs-backup) | Esporta le chiavi EFS in formato PKCS12 (pfx). |
| [efs.decrypt](#efs-decrypt) | Decifra file crittografato EFS usando chiavi in formato PKCS12 (pfx). |
| [efs.certificate](#efs-certificate) | Elenca, mostra ed esporta i certificati di sistema (SystemCertificates/My/Certificates). |
| [efs.key](#efs-key) | Elenca, mostra, decifra ed esporta le chiavi private (Crypto/RSA). |
| [efs.masterkey](#efs-masterkey) | Elenca, mostra e decifra le masterkey (Protect). |
| [reparse](#reparse) | Analizza e mostra i punti di reparse da \$Extend\$Reparse. |
| [logfile.dump](#logfile-dump) | Scarica il file $LogFile nel formato specificato: csv, json, raw. |
| [usn.analyze](#usn-analyze) | Analizza il file $UsnJrnl con regole specificate. Output: csv o json. |
| [usn.dump](#usn-dump) | Scarica il file $UsnJrnl nel formato specificato: csv, json, raw. |
| [shadow](#shadow) | Elenca gli snapshot dei volumi shadow dal disco e volume selezionati. |
| [streams](#streams) | Mostra gli Alternate Data Streams |
| [undelete](#undelete) | Cerca ed estrae file eliminati per un volume. |
| [shell](#shell-1) | Avvia una shell limitata simile a Unix |
| [smart](#smart) | Mostra dati S.M.A.R.T |
## Limitazioni
- Alcuni casi non supportati. WIP.
- Nessuna documentazione :no_mouth:.
Sentiti libero di aprire una segnalazione o richiedere una nuova funzionalità!
## Compilazione
- Installa [Visual Studio 2022](https://visualstudio.microsoft.com/fr/vs/)
- Installa vcpkg (per le librerie di terze parti richieste) come descritto qui: [vcpkg#getting-started](https://github.com/microsoft/vcpkg#getting-started)
```
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat
```
- Integralo nel tuo ambiente VisualStudio:
```
vcpkg integrate install
```
Durante la compilazione, VisualStudio rileverà il file `vcpkg.json` e installerà automaticamente i pacchetti necessari.
Librerie di terze parti:
- [openssl](https://www.openssl.org/): OpenSSL è un progetto open source che fornisce un toolkit robusto, di livello commerciale e completo per i protocolli Transport Layer Security (TLS) e Secure Sockets Layer (SSL).
- [nlohmann-json](https://github.com/nlohmann/json): JSON per C++ moderno
- [distorm](https://github.com/gdabah/distorm): Potente libreria di disassemblaggio per x86/AMD64
- [cppcoro](https://github.com/lewissbaker/cppcoro): Una libreria di astrazioni coroutine C++ per le coroutine TS.
- [re2](https://github.com/google/re2): RE2 è un'alternativa veloce, sicura e thread-friendly ai motori di espressioni regolari con backtracking.
## Esempi
### Info
<table>
<tr><td>info</td></tr>
<tr><td>
+-------------------------------------------------------------------------------------+
| Id | Model | Type | Partition | Size |
+-------------------------------------------------------------------------------------+
| 0 | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT | 500107862016 (465.76 GiBs) |
| 1 | ST2000DM001-1ER164 | Fixed HDD | GPT | 2000398934016 (1.82 TiB) |
| 2 | 15EADS External | Fixed HDD | MBR | 1500301910016 (1.36 TiB) |
| 3 | osfdisk | Fixed HDD | MBR | 536870912 (512.00 MiBs) |
+-------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3</td></tr>
<tr><td>
Model : osfdisk
Version : 1
Serial :
Media Type : Fixed HDD
Size : 536870912 (512.00 MiBs)
Geometry : 512 bytes * 63 sectors * 255 tracks * 65 cylinders
Volume : MBR
+--------------------------------------------------------------------------------------------------+
| Id | Boot | Label | Mounted | Filesystem | Offset | Size |
+--------------------------------------------------------------------------------------------------+
| 1 | No | NTFSDRIVE | F:\ | Bitlocker | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |
+--------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3 volume=1</td></tr>
<tr><td>
Serial Number : 0000aa60-00002eae
Filesystem : Bitlocker
Bootable : False
Type : Fixed
Label : NTFSDRIVE
Offset : 512 (512.00 bytes)
Size : 536870400 (512.00 MiBs)
Free : 519442432 (495.38 MiBs)
Mounted : True (F:\)
Bitlocker : True (Unlocked)
</td></tr>
</table>
### MBR
<table>
<tr><td>mbr disk=2</td></tr>
<tr><td>
Disk signature : e4589462
Reserved bytes : 0000
Partition table :
+---------------------------------------------------------------------------------------------------+
| Id | Boot | Flags | Filesystem | First sector | Last sector | Offset | Sectors | Size |
+---------------------------------------------------------------------------------------------------+
| 1 | No | Principal | NTFS / exFAT | 0 2 3 | 255 254 255 | 128 | 16771072 | 8.00 GiBs |
+---------------------------------------------------------------------------------------------------+
MBR signature : 55aa
Strings:
[63] : Invalid partition table
[7b] : Error loading operating system
[9a] : Missing operating system
Disassemble Bootstrap Code [y/N] ? y
0000 : 33c0 : xor ax, ax
0002 : 8ed0 : mov ss, ax
0004 : bc007c : mov sp, 0x7c00
0007 : 8ec0 : mov es, ax
0009 : 8ed8 : mov ds, ax
000b : be007c : mov si, 0x7c00
000e : bf0006 : mov di, 0x600
0011 : b90002 : mov cx, 0x200
...
</td></tr>
</table>
### GPT
<table>
<tr><td>gpt disk=1</td></tr>
<tr><td>
Signature : EFI PART
Revision : 1.0
Header Size : 92
Header CRC32 : cc72e4d3
Reserved : 00000000
Current LBA : 1
Backup LBA : 3907029167
First Usable LBA : 34
Last Usable LBA : 3907029134
GUID : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}
Entry LBA : 2
Entries Num : 128
Entries Size : 128
Partitions CRC32 : 0c9a0a25
Partition table : 2 entries
+------------------------------------------------------------------------------------------------------------------------+
| Id | Name | GUID | First sector | Last sector | Flags |
+------------------------------------------------------------------------------------------------------------------------+
| 1 | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34 | 262177 | 000000000000 |
| 2 | Basic data partition | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192 | 3907028991 | 000000000000 |
+------------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### VBR
<table>
<tr><td>vbr disk=3 volume=1</td></tr>
<tr><td>
Structure :
Jump : eb5890 (jmp 0x7c5a)
OEM id : -FVE-FS-
BytePerSector : 512
SectorPerCluster : 8
Reserved Sectors : 0
Number of FATs : 0
Root Max Entries : 0
Total Sectors : 0
Media Type : f8
SectorPerFat : 8160
SectorPerTrack : 63
Head Count : 255
FS Offset : 1
Total Sectors : 0
FAT Flags : 0000
FAT Version : 0000
Root Cluster : 0
FS Info Sector : 1
Backup BootSector: 6
Reserved : 00000000
Reserved : 00000000
Reserved : 00000000
Drive Number : 80
Reserved : 00
Ext. Boot Sign : 29
Serial Number : 00000000
Volume Name : NO NAME
FileSystem Type : FAT32
Volume GUID : {4967d63b-2e29-4ad8-8399-f6a339e3d001}
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
End marker : 55aa
Strings:
[00] : Remove disks or other media.
[1f] : Disk error
[2c] : Press any key to restart
Disassemble Bootstrap Code [y/N] ? y
7c5a : eb58 : jmp 0x7cb4
7c5c : 90 : nop
7c5d : 2d4656 : sub ax, 0x5646
7c60 : 45 : inc bp
7c61 : 2d4653 : sub ax, 0x5346
7c64 : 2d0002 : sub ax, 0x200
...
</td></tr>
</table>
### Extract
<table>
<tr><td>extract disk=0 volume=4 inode=0 output=d:\mymft</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 0 (00000000h)
[-] Destination : d:\mymft
[+] File extracted (5123541 bytes written)
</td></tr>
<tr><td>extract disk=3 volume=1 from=\bob.txt output=d:\bob.txt</td></tr>
<tr><td>
[+] Opening \\?\Volume{00023d5d-0000-0000-0002-000000000000}\
[-] Record Num : 47 (0000002fh)
[-] Destination : d:\bob.txt
[+] File extracted (42 bytes written)
</td></tr>
<tr><td>extract disk=0 volume=4 --system output=d:\system</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 623636 (00098414h)
[-] Destination : d:\system
[+] File extracted (19398656 bytes written)
</td></tr>
</table>
### Image
<table>
<tr><td>image disk=2 volume=2 output=d:\imagevol.raw</td></tr>
<tr><td>
[+] Opening \\?\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\
[-] Size : 33520128 (31.97 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
<tr><td>image disk=2 output=d:\image.raw</td></tr>
<tr><td>
[+] Opening \\.\PhysicalDrive2
[-] Size : 67108864 (64.00 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
</table>
### MFT-dump
<table>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.raw</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.raw
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.csv format=csv</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.csv
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>Sample of mft.csv (check the end of the last line for Zone.Identifier data)</td></tr>
<tr><td><pre>RecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl
0,"True","File","$MFT","",1048576,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
1,"True","File","$MFTMirr","",4096,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
2,"True","File","$LogFile","",67108864,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
3,"True","File","$Volume","",0,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
...
397,"True","File","vswhere.exe",".exe",457824,"103911","2020-10-19 18:42:19","2019-06-11 10:07:50","2019-06-11 10:07:52","2021-12-27 14:54:49","True","False","False","False","False","False","False","False","False","False","False","False","False",35944347632,1,"Zone.Identifier","3","https://github.com/microsoft/vswhere/releases","https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190611T100747Z&X-Amz-Expires=300&X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4&X-Amz-SignedHeaders=host&actor_id=40250307&response-content-disposition=attachment%3B%20filename%3Dvswhere.exe&response-content-type=application%2Foctet-stream"</pre>
</td></tr>
</table>
### MFT-record
<table>
<tr><td>mft.record disk=2 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Signature : FILE
Update Offset : 48
Update Number : 3
$LogFile LSN : 274035114
Sequence Number : 5
Hardlink Count : 1
Attribute Offset : 56
Flags : In_use | Directory
Real Size : 704
Allocated Size : 1024
Base File Record : 0
Next Attribute ID : 56
MFT Record Index : 5
Update Seq Number : 4461
Update Seq Array : 00000000
Attributes:
-----------+------------------------------------------------------------------------------------------------------------------+
| Id | Type | Non-resident | Length | Overview |
+------------------------------------------------------------------------------------------------------------------+
| 1 | $STANDARD_INFORMATION | False | 72 | File Created Time : 2009-12-02 02:03:31 |
| | | | | Last File Write Time : 2020-02-24 19:42:23 |
| | | | | FileRecord Changed Time : 2020-02-24 19:42:23 |
| | | | | Last Access Time : 2020-02-24 19:42:23 |
| | | | | Permissions : |
| | | | | read_only : 0 |
| | | | | hidden : 1 |
| | | | | system : 1 |
| | | | | device : 0 |
| | | | | normal : 0 |
| | | | | temporary : 0 |
| | | | | sparse : 0 |
| | | | | reparse_point : 0 |
| | | | | compressed : 0 |
| | | | | offline : 0 |
| | | | | not_indexed : 1 |
| | | | | encrypted : 0 |
| | | | | Max Number of Versions : 0 |
| | | | | Version Number : 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | $FILE_NAME | False | 68 | Parent Dir Record Index : 5 |
| | | | | Parent Dir Sequence Num : 5 |
| | | | | File Created Time : 2009-12-02 02:03:31 |
| | | | | Last File Write Time : 2011-12-24 03:13:12 |
| | | | | FileRecord Changed Time : 2011-12-24 03:13:12 |
| | | | | Last Access Time : 1970-01-01 00:59:59 |
| | | | | Allocated Size : 0 |
| | | | | Real Size : 0 |
| | | | | ------ |
| | | | | Name : . |
+------------------------------------------------------------------------------------------------------------------+
| 3 | $OBJECT_ID | False | 16 | Object Unique ID : {cce8fec5-9a29-11df-be68-0017f29 |
| | | | | 8268d} |
+------------------------------------------------------------------------------------------------------------------+
| 4 | $INDEX_ROOT | False | 152 | Attribute Type : 00000030h |
| | | | | Collation Rule : 1 |
| | | | | Index Alloc Entry Size : 4096 |
| | | | | Cluster/Index Record : 1 |
| | | | | ----- |
| | | | | First Entry Offset : 16 |
| | | | | Index Entries Size : 136 |
| | | | | Index Entries Allocated : 136 |
| | | | | Flags : Large Index |
+------------------------------------------------------------------------------------------------------------------+
| 5 | $INDEX_ALLOCATION | True | 12288 | Index |
| | | | | 0000000000000004 : $AttrDef |
| | | | | 0000000000000008 : $BadClus |
| | | | | 0000000000000006 : $Bitmap |
| | | | | 0000000000000007 : $Boot |
| | | | | 000000000000000b : $Extend |
| | | | | 0000000000000002 : $LogFile |
| | | | | 0000000000000000 : $MFT |
| | | | | 0000000000000001 : $MFTMirr |
| | | | | 000000000000002d : $RECYCLE.BIN |
| | | | | 0000000000000009 : $Secure |
| | | | | 000000000000000a : $UpCase |
| | | | | 0000000000000003 : $Volume |
| | | | | 0000000000000005 : . |
| | | | | 000000000000240c : Dir1 |
| | | | | 0000000000000218 : Dir2 |
| | | | | 000000000000212a : Dir3 |
| | | | | 0000000000000024 : Dir4 |
| | | | | 0000000000000def : RECYCLER |
| | | | | 000000000000001b : System Volume Information |
| | | | | 000000000000001b : SYSTEM~1 |
+------------------------------------------------------------------------------------------------------------------+
| 6 | $BITMAP | False | 8 | Index Node Used : 2 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### MFT-btree
<table>
<tr><td>mft.btree disk=0 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Attributes:
-----------
+-------------------------------------------------------------------------------------------+
| Id | Type | Non-resident | Length | Overview |
+-------------------------------------------------------------------------------------------+
| 1 | $INDEX_ROOT | False | 56 | Attribute Type : Filename |
| | | | | Collation Rule : 1 |
| | | | | Index Alloc Entry Size : 4096 |
| | | | | Cluster/Index Record : 1 |
| | | | | ----- |
| | | | | First Entry Offset : 16 |
| | | | | Index Entries Size : 40 |
| | | | | Index Entries Allocated : 40 |
| | | | | Flags : Large Index |
+-------------------------------------------------------------------------------------------+
| 2 | $INDEX_ALLOCATION | True | 20480 | First VCN : 0x000000000000 |
| | | | | Last VCN : 0x000000000004 |
+-------------------------------------------------------------------------------------------+
$INDEX_ALLOCATION entries:
--------------------------
+--------------------------------------------------------------------------------------------+
| VCN | Raw address | Size | Entries |
+--------------------------------------------------------------------------------------------+
| 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef |
| | | | 000000000008: $BadClus |
| | | | 000000000006: $Bitmap |
...
| | | | 000000000009: $Secure |
| | | | 00000000000a: $UpCase |
| | | | 000000000003: $Volume |
+--------------------------------------------------------------------------------------------+
| 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |
| | | | 000000000097: randomfile - Copie (5).bat |
| | | | 000000000095: randomfile - Copie (5).psd |
| | | | 000000000096: randomfile - Copie (5).txt |
| | | | 00000000009b: randomfile - Copie (6).accdb |
...
| | | | 000000000083: randomfile.accdb |
| | | | 000000000082: randomfile.bat |
| | | | 000000000084: randomfile.psd |
| | | | 000000000081: randomfile.txt |
| | | | 000000000024: System Volume Information |
+--------------------------------------------------------------------------------------------+
| 000000000002h | 0000007d6000h | 000000001000h | |
+--------------------------------------------------------------------------------------------+
| 000000000003h | 0000007d7000h | 000000001000h | 000000000005: . |
| | | | 000000000092: randomfile - Copie (4).txt |
+--------------------------------------------------------------------------------------------+
| 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder |
| | | | 00000000008c: randomfile - Copie (2).accdb |
| | | | 00000000008b: randomfile - Copie (2).bat |
| | | | 000000000089: randomfile - Copie (2).psd |
...
| | | | 00000000008e: randomfile - Copie (3).txt |
| | | | 000000000094: randomfile - Copie (4).accdb |
| | | | 000000000093: randomfile - Copie (4).bat |
| | | | 000000000091: randomfile - Copie (4).psd |
+--------------------------------------------------------------------------------------------+
B-tree index:
-------------
Root
|- 000000000000:
|---- VCN: 3
|- 000000000005: .
|---- VCN: 0
|- 000000000004: $AttrDef
|- 000000000008: $BadClus
|- 000000000006: $Bitmap
....
|- 000000000009: $Secure
|- 00000000000a: $UpCase
|- 000000000003: $Volume
|- 000000000092: randomfile - Copie (4).txt
|---- VCN: 4
|- 000000000027: random folder
|- 00000000008c: randomfile - Copie (2).accdb
|- 00000000008b: randomfile - Copie (2).bat
|- 000000000089: randomfile - Copie (2).psd
....
|- 000000000094: randomfile - Copie (4).accdb
|- 000000000093: randomfile - Copie (4).bat
|- 000000000091: randomfile - Copie (4).psd
|- 000000000000 (*)
|---- VCN: 1
|- 000000000098: randomfile - Copie (5).accdb
|- 000000000097: randomfile - Copie (5).bat
|- 000000000095: randomfile - Copie (5).psd
....
|- 000000000084: randomfile.psd
|- 000000000081: randomfile.txt
|- 000000000024: System Volume Information
</td></tr>
</table>
### Bitlocker-Info
<table>
<tr><td>bitlocker.info disk=3 volume=1</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Volume Master Keys:
-------------------
+--------------------------------------------------------------------------------------------------------------------+
| Id | Type | GUID | Details |
+--------------------------------------------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | Nonce : 01d5ecbb00f7155000000003 |
| | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | Encrypted Key : b76281568419ec3bee89d1eddccf3169 |
| | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | 0788bd366bec117b11a9fd6e |
| | | | |
| | | | JtR Hash : $bitlocker$1$16$daea96439babc5d1 |
| | | | e7f20c8860ff1ee9$1048576$12$5015 |
| | | | f700bbecd50103000000$60$175ec23c |
| | | | d799e2bde9d24bf3697919feb7628156 |
| | | | 8419ec3bee89d1eddccf316959c466b6 |
| | | | b392f40f0875e58168d868d70788bd36 |
| | | | 6bec117b11a9fd6e |
+--------------------------------------------------------------------------------------------------------------------+
| 2 | Recovery Password | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | Nonce : 01d5ecbb00f7155000000006 |
| | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | Encrypted Key : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | 6124ff46865e805367f7bef1 |
| | | | |
| | | | JtR Hash : $bitlocker$1$16$b9963d29e1bad1f4 |
| | | | 2e60c3bfb6e3bef5$1048576$12$5015 |
| | | | f700bbecd50106000000$60$3a06a06f |
| | | | db044d850ecd6faf5cf2aec997a43d40 |
| | | | c695c6d190eba3956ac7c7b1f5fdbbc7 |
| | | | f9a61a77c914fa347479c7ac6124ff46 |
| | | | 865e805367f7bef1 |
+--------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=badpassword</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Tested Password:
----------------+--------------------------------------------------------------------------------+
| ID | Tipo | GUID | Password | Risultato |
+--------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | badpassword | Non valido |
+--------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=123456789</td></tr>
<tr><td>
FVE Version : 2
Stato : CRITTOGRAFATO
Dimensione : 536870400 (512.00 MiBs)
Dimensione Crittografata : 536870400 (512.00 MiBs)
Algoritmo : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Password Testata:
----------------
+--------------------------------------------------------------------------------------------------------------+
| ID | Tipo | GUID | Password | Risultato |
+--------------------------------------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 123456789 | Valido |
| | | | | |
| | | | | VMK : 751bf363db63ba6f1b36fb2ecd5ff1d8 |
| | | | | f5eab77e8754a848f2743978c7615f9f |
| | | | | FVEK : 35b8197e6d74d8521f49698d5f556589 |
| | | | | 2cf286ae5323c65631965c905a9d7da4 |
+--------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Bitlocker-Decrypt
<table>
<tr><td>bitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4</td></tr>
<tr><td>
[+] Apertura \\?\Volume{09a02598-0000-0000-0002-000000000000}\
[+] Lettura Bitlocker VBR
[-] Stato Volume : CRITTOGRAFATO
[-] Dimensione : 536870400 (512.00 MiBs)
[-] Dimensione Crittografata : 536870400 (512.00 MiBs)
[-] Algoritmo : AES-XTS-128
[+] Decifratura settori
[-] Dimensione dati elaborati : 512.00 MiBs (100%)
[+] Durata : 7535ms
[+] Chiusura Volume
</td></tr>
</table>
### Bitlocker-FVE
<table>
<tr><td>bitlocker.fve disk=3 volume=1 fve_block=2</td></tr>
<tr><td>
Firma : -FVE-FS-
Dimensione : 57
Versione : 2
Stato Corrente : CRITTOGRAFATO (4)
Stato Successivo : CRITTOGRAFATO (4)
Dimensione Crittografata : 536870400 (512.00 MiBs)
Dimensione Conversione : 0
Settori di Backup : 16
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
Offset Settori di Backup : 0000000002110000
Intestazione Metadati FVE
-------------------
Dimensione : 840
Versione : 1
Dimensione Intestazione : 48
Dimensione Copia : 840
GUID Volume : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}
Prossimo Contatore : 10
Algoritmo : AES-XTS-128 (8004)
Timestamp : 2020-02-26 16:39:17
Voci Metadati FVE (5)
------------------------
+----------------------------------------------------------------------------------------------------------------+
| ID | Versione | Dimensione | Tipo Voce | Tipo Valore | Valore |
+----------------------------------------------------------------------------------------------------------------+
| 1 | 1 | 72 | Etichetta Unità | Unicode | Stringa : TWN NTFSDRIVE 26/02/2020 |
+----------------------------------------------------------------------------------------------------------------+
| 2 | 1 | 224 | VMK | VMK | ID Chiave : {2dd368f3-37d7-414f-94e6-3c5b86f |
| | | | | | add50} |
| | | | | | Ultima Modifica : 2020-02-26 16:40:00 |
| | | | | | Protezione : Password |
| | | | | | |
| | | | | | Proprietà #1 - Stretch Key - 108 |
| | | | | | -------- |
| | | | | | Crittografia : STRETCH KEY |
| | | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | | | |
| | | | | | Proprietà #1.1 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000002 |
| | | | | | MAC : 1dfebdc79a966e72ca806d6a83d8c7ba |
| | | | | | Chiave : eb51a188df981b54f51698c76d76a8bb |
| | | | | | d22afbbe27603ea6afc34c077726262e |
| | | | | | 5ba07482053d3c36fdecf80f |
| | | | | | |
| | | | | | Proprietà #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000003 |
| | | | | | MAC : 175ec23cd799e2bde9d24bf3697919fe |
| | | | | | Chiave : b76281568419ec3bee89d1eddccf3169 |
| | | | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | | | 0788bd366bec117b11a9fd6e |
+----------------------------------------------------------------------------------------------------------------+
| 3 | 1 | 316 | VMK | VMK | ID Chiave : {19b4a3e2-94b3-452f-a614-6212fae |
| | | | | | b1b9d} |
| | | | | | Ultima Modifica : 2020-02-26 16:40:07 |
| | | | | | Protezione : Password di Recupero |
| | | | | | |
| | | | | | Proprietà #1 - Stretch Key - 172 |
| | | | | | -------- |
| | | | | | Crittografia : STRETCH KEY |
| | | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | | | |
| | | | | | Proprietà #1.1 - AES-CCM - 64 |
| | | | | | -------- |
| | | | | | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000004 |
| | | | | | MAC : 8064d679c7d8d1fa8ae548b0844882c7 |
| | | | | | Chiave : 18d21021d40e3dc99d38c8dd84faed10 |
| | | | | | 370c32095f4f63261ad8ec40 |
| | | | | | |
| | | | | | Proprietà #1.2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000005 |
| | | | | | MAC : 3d40f2b5fc0091b894b438763fcdf4cd |
| | | | | | Chiave : a0af0aeda32d977d26ac76f9fc429668 |
| | | | | | 955d2a6a49fe4e2323751924e47e6c39 |
| | | | | | 8c22f7fcd2d4272003cb7a4e |
| | | | | | |
| | | | | | Proprietà #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000006 |
| | | | | | MAC : 3a06a06fdb044d850ecd6faf5cf2aec9 |
| | | | | | Chiave : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | | | 6124ff46865e805367f7bef1 |
| | | | | | |
| | | | | | Proprietà #3 - Backup di Recupero - 28 |
| | | | | | -------- |
| | | | | | Posizione : File |
| | | | | | Inizio : 2022-04-03 12:52:50 |
| | | | | | Fine : 2022-04-03 12:52:50 |
+----------------------------------------------------------------------------------------------------------------+
| 4 | 1 | 80 | FKEV | AES-CCM | Nonce come Hex : 01d5ecbb00f71550 |
| | | | | | Nonce come Ora : 2020-02-26 16:39:59 |
| | | | | | Contatore Nonce : 00000008 |
| | | | | | MAC : 2ff7d7f79920e3509fb8d20cb15b62c8 |
| | | | | | Chiave : 097169b9a5c41420ed2353a4a4210763 |
| | | | | | a8833d1a4a88c6f7c0c45ec7c0959f25 |
| | | | | | 2c8eac3f306e9fd1e693784a |
+----------------------------------------------------------------------------------------------------------------+
| 5 | 1 | 100 | Blocco Intestazione Volume | Offset e Dimensione | Offset : 0000000002110000 |
| | | | | | Dimensione : 0000000000002000 |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### EFS-backup
<table>
<tr><td>efs.backup disk=0 volume=4 password=123456</td></tr>
<tr><td>
[+] Apertura \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Elencazione directory utente
8 directory trovate
[+] Ricerca certificati
- 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B
[+] Ricerca chiavi private corrispondenti
- 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a
[+] Ricerca master key corrispondenti
- 9ac19509-54d3-48bc-8c67-4cfb01d73498
[+] Esportazione di 1 certificato e chiavi (pass: backup)
- ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok
Esportato in 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx
</td></tr>
</table>
### EFS-decrypt
<table>
<tr><td>efs.decrypt disk=0 volume=4 from=c:\cat.png pfx=z:\my_backup.pfx password=backup output=c:\socute.png</td></tr>
<tr><td>
[+] Caricamento file di input PKCS12
[-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b
[-] Lettura record: 13525
[+] Analisi flussi $EFS
[-] 1 campo di decifratura dati trovato
[+] Decifratura FEK
[-] FEK
+----------------------------------------------------------------------------------+
| Proprietà | Valore |
+----------------------------------------------------------------------------------+
| Entropia | 32 |
| Algoritmo | CALG_AES_256 |
| Chiave (256 bit) | 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |
+----------------------------------------------------------------------------------+
[+] Decifratura file
[-] File decifrato scritto in c:\socute.png (1.94 MiB)
</td></tr>
</table>
### EFS-certificate
<table>
<tr><td>efs.certificate disk=0 volume=4</td></tr>
<tr><td>
[+] Apertura \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Elencazione directory utente
8 directory trovate
[+] Ricerca certificati
8 certificato/i trovato/i
[+] Certificati
+-----------------------------------------------------------------------------------------------------------------------------------+
| ID | Utente | File | Certificato |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 0 | Bobby | Nome : 02728B6DF5573C5955A4DFF22319441C889C367B | Nome descrittivo : APNS certificate Direct |
| | | Record : 00000001d2d5h | |
| | | Dimensione: 850.00 bytes | |
| | | | |
| | | Creazione : 2019-05-11 15:59:29 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 1 | Bobby | Nome : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Nome descrittivo : APNS certificate |
| | | Record : 00000000b5a4h | |
| | | Dimensione: 824.00 bytes | |
| | | | |
| | | Creazione : 2021-03-03 18:02:33 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bobby | Nome : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Contenitore : ef456e5b-36e4-4eda-a80b-e234611306d4 |
| | | Record : 00000000ab23h | Provider : Microsoft Enhanced Cryptographic Provider v1.0 |
| | | Dimensione: 1.15 KiB | Tipo : PROV_RSA_FULL |
| | | | KeySpec : AT_KEYEXCHANGE |
| | | Creazione : 2020-08-17 13:20:03 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
..........
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4</td></tr>
<tr><td>
</td></tr>
</table>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading certificate file record: 46500
[+] Certificate
+--------------------------------------------------------------------------------------------------------------------------+
| Id | Property | Value |
+--------------------------------------------------------------------------------------------------------------------------+
| 0 | File | Creation : 2021-03-03 18:02:33 |
| | | Size : 824.00 bytes |
+--------------------------------------------------------------------------------------------------------------------------+
| 1 | SHA1_HASH_PROP_ID | 14A67663C51C66FF5CAD89B4DC34495864338C67 |
+--------------------------------------------------------------------------------------------------------------------------+
| 2 | FRIENDLY_NAME_PROP_ID | APNS certificate |
+--------------------------------------------------------------------------------------------------------------------------+
| 3 | KEY_IDENTIFIER_PROP_ID | 82B87AE4F2251242252A2644D98169F34F909CA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 4 | SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID | DB532C4794A15E5D0392C7C605FCBCA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 5 | CERTIFICATE_FILE | Data: |
| | | Version: 3 (0x2) |
| | | Serial Number: |
| | | 01:20:cb:ab:28:8a:97:ee:99:cc |
| | | Signature Algorithm: sha1WithRSAEncryption |
| | | Issuer: C=US, O=Apple Inc., OU=Apple iPhone, CN=Apple iPhone Device CA |
| | | Validity |
| | | Not Before: Mar 3 15:57:33 2021 GMT |
| | | Not After : Mar 3 16:02:33 2022 GMT |
| | | Subject: CN=1A6032AA-91A2-4B1D-B6AF-5509FC173686 |
| | | Subject Public Key Info: |
| | | Public Key Algorithm: rsaEncryption |
| | | RSA Public-Key: (1024 bit) |
| | | Modulus: |
| | | 00:a2:75:db:69:8d:c9:b3:fd:96:4d:28:b9:43:94: |
| | | db:7d:73:53:88:c9:79:e9:fa:de:e4:12:14:2c:de: |
...
| | | a7:6b:d0:01:9e:dc:66:27:ef:2e:20:7e:e5:2a:42: |
| | | 9e:6f:85:9c:b6:8f:be:d3:05 |
| | | Exponent: 65537 (0x10001) |
| | | X509v3 extensions: |
| | | X509v3 Authority Key Identifier: |
| | | keyid:B2:FE:21:23:44:86:95:6A:79:D5:81:26:8E:73:10:D8:A7:4C:8E:74 |
| | | X509v3 Subject Key Identifier: |
| | | 82:B8:7A:E4:F2:25:12:42:25:2A:26:44:D9:81:69:F3:4F:90:9C:A8 |
| | | X509v3 Basic Constraints: critical |
| | | CA:FALSE |
| | | X509v3 Key Usage: critical |
| | | Digital Signature, Key Encipherment |
| | | X509v3 Extended Key Usage: critical |
| | | TLS Web Server Authentication, TLS Web Client Authentication |
| | | 1.2.840.113635.100.6.10.6: |
| | | .. |
| | | Signature Algorithm: sha1WithRSAEncryption |
| | | 28:54:6c:d9:4e:97:f5:dd:1f:79:4a:6a:74:42:ad:6e:a1:11: |
...
| | | 27:58:3b:d5:1e:c3:71:af:6b:bd:fe:5d:ad:4d:bd:82:fa:53: |
| | | ff:0c |
+--------------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4 output=mycert</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading certificate file record: 46500
[+] Certificate exported to mycert.pem
</td></tr>
</table>
### EFS-key
<table>
<tr><td>efs.key disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}
[+] Listing user directories:
8 directories found
[+] Searching for keys
9713 key(s) found
[+] Keys
+------------------------------------------------------------------------------------------------------------------+
| Id | User | Keyfile | Name | Creation Date |
+------------------------------------------------------------------------------------------------------------------+
| 0 | User1 | Name : 0004f7ed30db...017ee8d52ca6 | {15676EB3-D258-410F-85CB-9AB29E642CB3} | 2021-05-19 14:10:15 |
| | | Record : 0000000246c5h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 1 | User1 | Name : 0016875547ba...f7a9606b4177 | {BA4B66DC-8C1D-4FDF-A1EF-78B64411D1AD} | 2020-02-03 19:37:39 |
| | | Record : 000000019f19h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 2 | User1 | Name : 002a02ec680e...9a0a8d52ca67 | {3A3E1CF2-5AC2-4717-8006-D7C0F2936435} | 2019-06-26 15:50:50 |
..........
</td></tr>
<tr><td>efs.key disk=0 volume=4 inode=742107</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading key file record: 742107
[+] Key
+------------------------------------------------------------------------------------------------------------------+
| Id | Property | Value |
+------------------------------------------------------------------------------------------------------------------+
| 0 | File | Creation : 2021-09-23 22:16:43 |
| | | Size : 4.00 KiBs |
+------------------------------------------------------------------------------------------------------------------+
| 1 | Version | 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | Name | ef456e5b-43e4-4eda-a80b-e234611306d4 |
+------------------------------------------------------------------------------------------------------------------+
| 3 | Flags | 00000000h |
+------------------------------------------------------------------------------------------------------------------+
| 4 | PublicKey | Magic : 31415352h (RSA1) |
| | | Size : 2048 |
| | | Exponent : 65537 |
| | | |
| | | Permissions : CRYPT_ENCRYPT |
| | | CRYPT_DECRYPT |
| | | CRYPT_EXPORT |
| | | CRYPT_READ |
...
| | | |
| | | Modulus : 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+------------------------------------------------------------------------------------------------------------------+
| 5 | Encrypted PrivateKey | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Chiave privata CryptoAPI |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : ABABD5324CCE0254BC726C3BF5A777D38BC4D75CACC2360EF3276EB4DC42FF6A |
| | | |
| | | HMAC : - |
| | | HMAC2 : D24F0B0AF684AE986F1328EAAFC01DA346D2BADE2B84CBE3C94CCB338D449EA6 |
| | | |
| | | Encrypted Data : D7DAD9229C91DBC9608852A4411527D7 |
| | | 58DB27E19596DD118F2D70F68CC7913C |
...
| | | 7870F6C68DA1B9139BF6E39725F4E72E |
| | | 4EC435C947F127CA3E333CB5E2F43978 |
| | | |
| | | Signature Data : 6077C027E6714A81C2710C5D334758F9AD463117DA4CBA8D0D05B5845A662E8F |
| | | 5E38DCCAB05DA5DD6C8328F5CF925F378F229790D30A2BCC91D5E3370AE50FED |
+------------------------------------------------------------------------------------------------------------------+
| 6 | Hash | 0000000000000000000000000000000000000000 |
+------------------------------------------------------------------------------------------------------------------+
| 7 | ExportFlag | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Export Flag |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : 772935C3582F625367716CE87D9626A524F15B9B7FF07166BB2C704B1223CB06 |
| | | |
| | | HMAC : - |
| | | HMAC2 : 3BCA74ED2C83767F06D9FF907817FE85FBA65FDB72A94E9D8F2C7CF1D8E7DCA2 |
| | | |
| | | Encrypted Data : 875A6429226F11DFD3690D43BE633287 |
| | | |
| | | Signature Data : FD97F69A214C37D0DA968B5AA18EE7C80D475F72F650C8DCAE887C97E850DCD6 |
| | | 9FA17D397A2375E362DE6F17193E3D084C06B0DCDB38E6C746150C1056145178 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34fac126105ce30...178c5bff4979eb</td></tr>
<tr><td>### EFS-masterkey
<table>
<tr><td>efs.masterkey disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for keys
19 key(s), 2 preferred file(s) found
[+] MasterKeys
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| Id | User | Keyfile | Key(s) | Creation Date |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 0 | DefaultAppPool | Name : e4ed144f-6522-4471-8893-a6e29e175ba6 | MasterKey | 2021-08-17 14:54:41 |
| | | Record : 000000031848h | Version : 2 | |
| | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : FA737C82899CC3F61A3B332B15FDC241 | |
| | | | Rounds : 8000 | |
| | | | BackupKey | |
| | | | Version : 2 | |
| | | | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : DF0651C903763132BC3043BF144A7DDD | |
| | | | Rounds : 8000 | |
| | | | CredHist | |
| | | | Version : 3 | |
| | | | GUID : {00000000-0000-0000-0000-000000000000} | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 1 | DefaultAppPool | Name : Preferred | Preferred | 2021-08-17 14:54:41 |
| | | Record : 00000003184ah | GUID : {e4ed144f-6522-4471-8893-a6e29e175ba6} | |
| | | Size : 24.00 bytes | Renew : 2021-11-15 12:54:41 | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bob | Name : 26bd8b3d-e87f-4df3-a1af-18f434788090 | MasterKey | 2021-03-05 01:16:42 |
| | | Record : 000000004f4ah | Version : 2 | |
| | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : 39B575D1816DE8224B9E11C38E35EB34 | |
| | | | Rounds : 8000 | |
| | | | BackupKey | |
..........
</td></tr>
<tr><td>efs.masterkey disk=0 volume=4 inode=0x80544</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading masterkey file record: 525636
[+] MasterKey
+--------------------------------------------------------------------+
| Id | Property | Value |
+--------------------------------------------------------------------+
| 0 | File | Creation : 2020-07-06 05:56:06 |
| | | Size : 468.00 bytes |
+--------------------------------------------------------------------+
| 1 | Version | 2 |
+--------------------------------------------------------------------+
| 2 | GUID | 9ac19509-54d3-48bc-8c67-4cfb01d73498 |
+--------------------------------------------------------------------+
| 3 | Policy | 00000005h |
+--------------------------------------------------------------------+
| 4 | MasterKey | Version : 2 |
| | | Salt : 3ED4CDBCC4073D6724A512061D0597E1 |
| | | Rounds : 8000 |
| | | Hash Alg : CALG_SHA_512 |
| | | Enc Alg : CALG_AES_256 |
| | | Enc Key : 3610946FE1A7B9099D0AFA7658325014 |
| | | 296D1F0E5BA93249858BE3ACCC8FD7A8 |
| | | F62DB6808833FC303095C6588BDE3826 |
| | | 80ABF391222CD77661BCCB637DDAC490 |
| | | B5FC02C854EF45490EE10851EF524DE2 |
| | | 85DD508F905216D528D3DC3336830FF9 |
| | | 690472730A03D64CF892E06B9AA35692 |
| | | AB7679E908D487119030B73CB87E6F9F |
| | | 731F65609CB8ACA972BCC9042B27B9B4 |
+--------------------------------------------------------------------+
| 5 | BackupKey | Version : 2 |
| | | Salt : B60E21F9578D02A97964D7B10151BE69 |
| | | Rounds : 8000 |
| | | Hash Alg : CALG_SHA_512 |
| | | Enc Alg : CALG_AES_256 |
| | | Enc Key : CD5D3684873D6A1D66520FB1642779E1 |
| | | D78A649F02DDFE7C069F9B5F8FF9F005 |
| | | 7DC01E0A6AA9A815C8887BC1BF5B88E6 |
| | | E797DC5F4A3A0535B3217BADC7FAD38E |
| | | 798C1846423C8631DE472D790B308B2D |
| | | F15340B87FCD55A98DAEE92196235CF9 |
| | | B328FAF475C05A911DF19C99D54D5A3C |
+--------------------------------------------------------------------+
| 6 | CredHist | Version : 3 |
| | | GUID : {20e0b482-797f-429e-b4a0-30020731ef0a} |
+--------------------------------------------------------------------+
</td></tr>
<tr><td> efs.masterkey disk=0 volume=4 inode=0x80544 sid="S-1-5-21-1521398...3175218-1001" password="ntfst00l"</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading masterkey file record: 525636
[-] Masterkey
Encryption Algorithm : CALG_AES_256
Hash Algorithm : CALG_SHA_512
Rounds : 8000
Salt : 3ED4CDBCC4073D6724A512061D0597E1
[+] Decrypting masterkey
[+] Clear masterkey (256bits):
34FAC126105CE302421A0FC7E3933FEC5639AA6BFF95000E6DA83AE67522EAB6
0AF58A27D834883B65611878B258AAAECD8983E3718E00F276178C5BFF4979EB
</td></tr>
</table>
### Reparse
<table>
<tr><td>reparse disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading $Extend\$Reparse
[+] 104 entries found
+----------------------------------------------------------------------------------------------------------------+
| Id | MFT Index | Filename | Type | Target/Data |
+----------------------------------------------------------------------------------------------------------------+
| 0 | 00000eb3 | debian.exe | AppExecLink | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4 |
| | | | | |
| | | | | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4!debian |
| | | | | |
| | | | | C:\Program Files\WindowsApps\The |
| | | | | DebianProject.DebianGNULinux_1.2 |
| | | | | .0.0_x64__76v4gfsz19hv4\debian.e |
| | | | | xe |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 13 | 000007f9 | BaseLayer | Mount Point | \??\Volume{629458e4-0000-0000-00 |
| | | | | 00-010000000000}\ |
+----------------------------------------------------------------------------------------------------------------+
| 14 | 00013e24 | Watchdog | Mount Point | \??\C:\Program Files\NVIDIA Corp |
| | | | | oration\NvContainer\Watchdog |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 102 | 00035861 | C2R64.dll | Symbolic Link | \??\C:\Program Files\Common File |
| | | | | s\Microsoft Shared\ClickToRun\C2 |
| | | | | R64.dll |
+----------------------------------------------------------------------------------------------------------------+
| 103 | 000986b0 | All Users | Symbolic Link | \??\C:\ProgramData |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Logfile-dump
<table>
<tr><td>logfile.dump disk=4 volume=1 output=logfile.csv format=csv</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading $LogFile record
[-] $LogFile size : 4.14 MiBs
[+] Parsing $LogFile Restart Pages
[-] Newest Restart Page LSN : 5274485
[-] Volume marked as cleanly unmounted
[-] Client found : [1] NTFS
[+] Parsing $LogFile Record Pages
[-] $LogFile Record Page Count: 86
[+] Parsing $LogFile Records: 601
[+] Closing volume
</td></tr>
<tr><td>Esempio di logfile.csv</td></tr>
<tr><td><pre>LSN,ClientPreviousLSN,UndoNextLSN,ClientID,RecordType,TransactionID,RedoOperation,UndoOperation,MFTClusterIndex,TargetVCN,TargetLCN
5269000,5268967,5268967,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269019,5269000,5269000,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269044,5269019,5269019,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269063,5269044,5269044,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269082,5269063,5269063,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269103,5269082,5269082,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269122,5269103,0,0,1,24,ForgetTransaction,CompensationLogRecord,0,0,18446744073709551615
5269133,0,0,0,1,24,UpdateResidentValue,UpdateResidentValue,2,13,43703</pre>
</td></tr>
</table>
### USN-analyze
<table>
<tr><td>From dump : usn.analyze from=usn_dump rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr></tr>
<tr><td>From running system : usn.analyze disk=4 volume=1 rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr><td>
[+] Loading rules from: d:\rules.json
[-] 4 rules loaded
[+] Creating d:\usn_analyze_results.csv
[-] Mode: fast
[+] Opening \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[+] Searching for $Extend\$UsnJrnl
[-] Found in file record: 116
[-] $J stream size: 31.70 KiBs (could be sparse)
[+] Processing USN records: 192 (31.70 KiBs) - 9 matches
[+] Closing volume
[+] Summary:
+------------------------------------------------------+
| Index | Category | Value | % |
+------------------------------------------------------+
| 0 | file creation | 125 | 65.10 |
| 1 | file deletion | 0 | 0.00 |
| 2 | file rename | 8 | 4.17 |
| 3 | latest | 2022-03-28 23:23:12 | |
| 4 | oldest | 2022-03-28 13:20:08 | |
| 5 | records count | 192 | 100.00 |
+------------------------------------------------------+
[+] Rules results:
+------------------------------------------+
| Index | Rule ID | Count | % |
+------------------------------------------+
| 0 | executable-create | 9 | 4.69 |
| 1 | ccleaner | 2 | 1.04 |
| 2 | lsass-dump | 1 | 0.52 |
+------------------------------------------+
</td></tr>
</table>
### USN-dump
<table>
<tr><td>usn.dump disk=4 volume=1 output=usn.csv format=csv</td></tr>
<tr><td>
```### Shadow
<table>
<tr><td>shadow disk=0 volume=4</td></tr>
<tr><td>
[+] Apertura di \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Intestazione VSS trovata a 0x1e00
+---------------------------------------------------------------------------------------------------------------+
| SetID/ID | Conteggio | Data | Dettagli |
+---------------------------------------------------------------------------------------------------------------+
| {857c9ac4-ee4f-4bc6-b822-59e935a7120f} | 1 | 2020-09-21 00:15:38 | Macchina di Servizio: WORK-PC10 |
| | | | Macchina di Origine: WORK-PC10 |
| {3d102db1-8de2-4e7d-8ba5-e0dd4f67740d} | | | Stato : Creata |
| | | | Flag : 0x0042000d |
| | | | - Persistente |
| | | | - Accessibile al Client |
| | | | - Nessun Rilascio Auto |
| | | | - Differenziale |
| | | | - Recupero Auto |
+---------------------------------------------------------------------------------------------------------------+
| {83bc8af4-8802-4466-ae38-717f6474616a} | 1 | 2020-09-22 06:10:00 | Macchina di Servizio: WORK-PC10 |
| | | | Macchina di Origine: WORK-PC10 |
| {e668c329-66a2-4ebd-beef-3c6bca81cbf7} | | | Stato : Creata |
| | | | Flag : 0x0042000d |
| | | | - Persistente |
| | | | - Accessibile al Client |
| | | | - Nessun Rilascio Auto |
| | | | - Differenziale |
| | | | - Recupero Auto |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Streams
<table>
<tr><td>streams disk=0 volume=4 from=c:\test.pdf</td></tr>
<tr><td>
[+] Apertura di \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Sorgente : c:\test.pdf
[-] Num. Record : 13525 (000034d5h)
[+] Flusso(i) di dati alternativo(i):
+-----------------------------+
| Id | Nome | Dimensione |
+-----------------------------+
| 0 | Zone.Identifier | 27 |
+-----------------------------+
</td></tr>
</table>
### Annulla eliminazione
<table>
<tr><td>undelete disk=4 volume=1</td></tr>
<tr><td>
[+] Apertura di \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Lettura record $MFT
[+] Dimensione $MFT : 256.00 KiBs (~256 record)
[+] Lettura record $BITMAP
[+] Dimensione $BITMAP : 16.00 KiBs
[+] Ricerca file eliminati
[+] Dati elaborati : 262144 (100%)
[+] Durata : 7ms
File eliminati trovati
-------------------
+-----------------------------------------------------------------------------------------------------------------------+
| Id | Indice MFT | Flag | Nome file | Dimensione | Data eliminazione | % Recuperabile |
+-----------------------------------------------------------------------------------------------------------------------+
| 0 | 00000029 | | .\$RECYCLE.BIN\[...]\$RAV85W4.jpg | 5.10 KiBs | 2020-02-26 21:29:03 | 100.00 |
+-----------------------------------------------------------------------------------------------------------------------+
| 1 | 00000035 | | .\$RECYCLE.BIN\[...]\$IAV85W4.jpg | 58.00 byte | 2020-02-26 21:29:03 | 100.00 |
+-----------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>undelete disk=2 volume=1 format=csv output=mydeletedfiles.csv</td></tr>
<tr><td>
[+] Apertura di \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[-] Dimensione $MFT :34.00 MiBs (~34816 record)
[-] Dimensione $BITMAP :14.32 MiBs
[+] Ricerca file eliminati
[-] Dati elaborati: 35651584 (100%)
[-] Durata : 425ms
[+] File eliminati : 127
[+] Scrittura risultati in mydeletedfiles.csv (csv) file
[+] Completato
</td></tr>
<tr><td>undelete disk=4 volume=1 inode=41 output=restored_kitten.jpg</td></tr>
<tr><td>
[+] Apertura di \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Lettura record file : 41
[+] Estrazione $RAV85W4.jpg in restored_kitten.jpg
[+] 5219 byte scritti
</td></tr>
</table>
### Shell
<table>
<tr><td>shell disk=4 volume=1</td></tr>
<tr><td>
disk4:volume1:> ls
Inode | Tipo | Nome | Dimensione | Data Creazione | Attributi
-----------------------------------------------------------------------------------------
4 | | $AttrDef | 2560 | 2020-02-26 16:35:29 | Hi Sy
8 | | $BadClus | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Bad | 536866816 | |
6 | | $Bitmap | 16384 | 2020-02-26 16:35:29 | Hi Sy
7 | | $Boot | 8192 | 2020-02-26 16:35:29 | Hi Sy
11 | DIR | $Extend | | 2020-02-26 16:35:29 | Hi Sy
2 | | $LogFile | 4341760 | 2020-02-26 16:35:29 | Hi Sy
0 | | $MFT | 262144 | 2020-02-26 16:35:29 | Hi Sy
1 | | $MFTMirr | 4096 | 2020-02-26 16:35:29 | Hi Sy
50 | DIR | $RECYCLE.BIN | | 2020-02-26 16:40:34 | Hi Sy
9 | | $Secure | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $SDS | 264200 | |
10 | | $UpCase | 131072 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Info | 32 | |
3 | | $Volume | 0 | 2020-02-26 16:35:29 | Hi Sy
5 | DIR | . | | 2020-02-26 16:35:29 | Hi Sy
85010 | | 7z1900-x64.exe | 1447178 | 2020-07-29 17:19:49 | Ar
| ADS | Zone.Identifier | 123 | |
42 | | hello.txt | 5 | 2020-02-26 21:27:33 | Ar
39 | | kitten1.jpg | 23486 | 2020-02-26 16:37:23 | Ar
| ADS | Zone.Identifier | 154 | |
40 | | kitten2.jpg | 79678 | 2020-02-26 16:37:55 | Ar
| ADS | Zone.Identifier | 303 | |
41 | | kitten3.jpg | 5219 | 2020-02-26 16:38:16 | Ar
| ADS | Zone.Identifier | 262 | |
36 | DIR | System Volume Information | | 2020-02-26 16:35:29 | Hi Sy
disk4:volume1:> pwd
\
disk4:volume1:> cat hello.txt
Hey !
disk4:volume1:> cat 7z1900-x64.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://www.7-zip.org/download.html
HostUrl=https://www.7-zip.org/a/7z1900-x64.exe
disk4:volume1:> cp kitten3.jpg z:\custestkitten.jpg
1 file copiato
disk4:volume1:> exit
</td></tr>
</table>
### SMART
<table>
<tr><td>smart disk=1</td></tr>
<tr><td>
Versione : 1 revisione 1
Tipo : Master SATA/IDE su canale primario
Capacità : ATA, ATAPI, S.M.A.R.T
Stato : Superato
-- ID Dispositivo
+---------------------------------------------------------------------------------------------------+
| Proprietà | Valore |
+---------------------------------------------------------------------------------------------------+
| Configurazione Generale | 0040h |
| Numero di Cilindri | 16383 |
| Riservato | c837h |
| Numero di Teste | 16 |
| Byte per Traccia | 0 |
| Byte per Settore | 0 |
| Settori per Traccia | 63 |
| Specifico del Produttore | |
| Numero di Serie | S2RBNX0H606448W |
| Tipo di Buffer | 0 |
| Dimensione Buffer | 0 |
| Dimensione ECC | 0 |
| Revisione Firmware | EMT02B6Q |
| Numero Modello | Samsung SSD 850 EVO 500GB |
| Numero Massimo di Settori in Lettura/Scrittura | 32769 |
| Doppia Parola IO | 16385 |
| Capacità | Riservato : 0000h |
| | Supporto DMA : True |
| | Supporto LBA : True |
| | DisIORDY : True |
| | IORDY : True |
| | Richiede avvio software ATA: False |
| | Supporto Operazioni Overlap: True |
| | Supporto Coda Comandi : False |
| | Supporto DMA Interleaved : False |
| Riservato1 | 4000h |
| Temporizzazione PIO | 512 |
| Temporizzazione DMA | 512 |
| Validità Campo | Numero CHS : True |
| | Numero Cicli : True |
| | Ultra DMA : True |
| Numero corrente di cilindri | 16383 |
| Numero corrente di teste | 16 |
| Numero corrente di settori per traccia | 63 |
| Impostazione Settori Multipli | 16514064 |
| Numero Totale di Settori Indirizzabili (LBA) | 268435455 |
| Supporto Trasferimento DMA a Parola Singola | 0 |
| Supporto Trasferimento DMA a Parola Multipla | Modo 0 (4.17Mb/s) |
| | Modo 1 (13.3Mb/s) |
| | Modo 2 (16.7Mb/s) |
| Modalità PIO Avanzate | 0003h |
| Tempo Minimo Ciclo Trasferimento DMA Multipla per Parola | 120 |
| Tempo Minimo Ciclo Trasferimento DMA Multipla Raccomandato | 120 |
| Tempo Minimo Ciclo Trasferimento PIO (Nessun Controllo di Flusso) | 120 |
| Tempo Minimo Ciclo Trasferimento PIO (Controllo di Flusso) | 120 |
| Supporto ATA | ATA-2 |
| | ATA-3 |
| | ATA-4 |
| | ATA/ATAPI-5 |
| | ATA/ATAPI-6 |
| | ATA/ATAPI-7 |
| | ATA/ATAPI-8 |
| | ATA/ATAPI-9 |
| Supporto Trasferimento Ultra DMA | Modo 0 (16.7MB/s) |
| | Modo 1 (25.0MB/s) |
| | Modo 2 (33.3MB/s) |
| | Modo 3 (44.4MB/s) |
| | Modo 4 (66.7MB/s) |
| | Modo 5 (100.0MB/s) (selezionato) |
| | Modo 6 (133.0MB/s) |
+---------------------------------------------------------------------------------------------------+
-- Attributi
+-------------------------------------------------------------------------------------------------------------------+
| Indice | Nome | Flag | Raw | Valore | Peggiore | Soglia | Stato |
+-------------------------------------------------------------------------------------------------------------------+
| 05h | Conteggio Settori Riallocati | 0033h | 000000000000h | 100 | 100 | 10 | Ok |
| 09h | Conteggio Ore di Accensione | 0032h | 000000008d54h | 92 | 92 | 0 | Ok |
| 0ch | Conteggio Cicli di Alimentazione | 0032h | 0000000000f5h | 99 | 99 | 0 | Ok |
| b1h | Delta Intervallo Usura | 0013h | 00000000005eh | 95 | 95 | 0 | Ok |
| b3h | Conteggio Blocchi Riservati Usati (Totale) | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| b5h | Conteggio Totale Fallimenti Programma | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b6h | Conteggio Fallimenti Cancellazione | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b7h | Conteggio Errori di Declassamento Sata | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| bbh | Errori Non Correttibili Segnalati | 0032h | 000000000000h | 100 | 100 | 0 | Ok |
| beh | Differenza di Temperatura da 100 | 0032h | 000000000020h | 68 | 50 | 0 | Ok |
| c3h | ECC Hardware Recuperato | 001ah | 000000000000h | 200 | 200 | 0 | Ok |
| c7h | Tasso Errore CRC Udma | 003eh | 000000000000h | 100 | 100 | 0 | Ok |
| ebh | Conteggio Blocchi Buoni e Blocchi Liberi Sistema | 0012h | 000000000071h | 99 | 99 | 0 | Ok |
| f1h | Scritture a Vita dall'Host in Gib | 0032h | 00154bf298c9h | 99 | 99 | 0 | Ok |
+-------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>