thewhiteninja/ntfstoolNTFS용 포렌식 도구 (parser, mft, bitlocker, 삭제된 파일)
NTFSTool은 NTFS 볼륨에 초점을 맞춘 포렌식 도구입니다. 파티션 정보(MBR, 파티션 테이블, VBR) 읽기를 지원할 뿐만 아니라 마스터 파일 테이블, Bitlocker 암호화 볼륨, EFS 암호화 파일, USN 저널 등에 대한 정보도 제공합니다.
최신 바이너리는 AppVeyor에서 다운로드하거나 GitHub artefacts를 확인하세요.
아래에서 기능에 대한 몇 가지 예시를 확인하세요!
deepwiki에서 제공하는 대체 문서는 여기에서 확인할 수 있습니다 : https://deepwiki.com/thewhiteninja/ntfstool/
NTFSTool은 마스터 부트 레코드, 볼륨 부트 레코드, 파티션 테이블 및 $MFT 파일 레코드의 전체 구조를 표시합니다. 또한 모든 파일($MFT 또는 SAM 포함)을 덤프하거나, USN 저널, LogFile 및 대체 데이터 스트림(ADS)을 포함한 스트림을 구문 분석 및 분석할 수 있습니다. $MFT는 Zone.Identifier 구문 분석과 함께 csv 또는 json으로 덤프하여 다운로드한 파일을 신속하게 식별할 수 있습니다. 삭제 취소 명령은 "사용 중이 아님"으로 표시된 파일 레코드를 검색하여 파일(또는 이미 덮어쓰여진 경우 파일의 일부)을 복구할 수 있습니다. 이미지 파일, 라이브 디스크 또는 VeraCrypt 및 TrueCrypt와 같은 가상에서 입력을 지원하며, OSFMount와 같은 도구를 사용하여 디스크 이미지를 마운트할 수도 있습니다. 희소 파일 및 압축 파일(lznt1, xpress)도 지원됩니다.
Bitlocker 암호화 파티션의 경우 FVE 레코드를 표시하고, 비밀번호와 키(bek, 비밀번호, 복구 키)를 확인하며, VMK 및 FVEK를 추출할 수 있습니다. GPU 기반 크래킹이 더 효과적이므로 무차별 대입 기능은 없지만(Bitcracker 및 Hashcat 참조), 이러한 도구를 위한 해시를 얻을 수 있습니다.
마스터 키, 개인 키 및 인증서는 필요한 입력(SID, 비밀번호)을 사용하여 나열, 표시 및 복호화할 수 있습니다. 개인 키가 포함된 인증서는 백업 명령을 사용하여 내보낼 수 있습니다.
백업을 다른 컴퓨터에 다시 가져와서 암호화된 파일을 다시 읽을 수 있습니다!
또는 efs.decrypt 명령을 사용하여 백업된 키로 파일을 복호화할 수 있습니다.
자세한 내용은 Mimikatz Wiki를 참조하세요.
USN 저널 레코드는 사용자 정의 규칙을 사용하여 분석할 수 있으며, 의심스러운 프로그램 및 작업을 감지할 수 있을 뿐만 아니라 저널 개요(파일 삭제 비율, 생성 비율 등)를 확인할 수 있습니다.
기본 규칙: Rules/default.json``` { "id": "lsass-dump", "description": "Dumped LSASS.exe process.", "severity": "high", "rule": { "filename": "lsass(\.(dmp|dump))?" } }
여기서 실행 예제를 확인하세요: [usn.analyze](#usn-analyze)
### 셸
제한된 명령(exit, cd, ls, cat, pwd, cp, quit, rec)이 있는 셸이 제공됩니다.
`rec` 명령은 MFT 레코드 세부 정보를 표시합니다.
## 도움말 및 예제
도움말 명령은 각 명령에 대한 설명과 예제를 표시합니다.
옵션은 10진수 또는 "0x" 접두사가 있는 16진수로 입력할 수 있습니다(예: inode).
ntfstool help [command]
| 명령 | 설명 |
| --- | --- |
| [info](#info) | 모든 디스크와 볼륨에 대한 정보 표시 |
| [mbr](#mbr) | 디스크의 MBR 구조, 코드 및 파티션 표시 |
| [gpt](#gpt) | 디스크의 GPT 구조, 코드 및 파티션 표시 |
| [vbr](#vbr) | 지정된 볼륨(ntfs, fat32, fat1x, bitlocker 지원)의 VBR 구조 및 코드 표시 |
| [extract](#extract) | 볼륨에서 파일 추출. |
| [image](#image) | 디스크 또는 볼륨의 이미지 파일 생성. |
| [mft.dump](#mft-dump) | 지정된 형식(csv, json, raw)으로 $MFT 파일 덤프. |
| [mft.record](#mft-record) | 지정된 MFT inode의 FILE 레코드 세부 정보 표시. 거의 모든 속성 유형 지원 |
| [mft.btree](#mft-btree) | inode에 대한 VCN 콘텐츠 및 Btree 인덱스 표시 |
| [bitlocker.info](#bitlocker-info) | 모든 VMK에 대한 정보 및 해시($bitlocker$) 표시. 암호 또는 복구 키 테스트. |
| [bitlocker.decrypt](#bitlocker-decrypt) | 암호, 복구 키 또는 bek을 사용하여 볼륨을 파일로 복호화. |
| [bitlocker.fve](#bitlocker-fve) | 지정된 FVE 블록에 대한 정보 표시. |
| [efs.backup](#efs-backup) | EFS 키를 PKCS12(pfx) 형식으로 내보내기. |
| [efs.decrypt](#efs-decrypt) | PKCS12(pfx) 형식의 키를 사용하여 EFS 암호화 파일 복호화. |
| [efs.certificate](#efs-certificate) | 시스템 인증서(SystemCertificates/My/Certificates) 나열, 표시 및 내보내기. |
| [efs.key](#efs-key) | 개인 키(Crypto/RSA) 나열, 표시, 복호화 및 내보내기. |
| [efs.masterkey](#efs-masterkey) | 마스터 키(Protect) 나열, 표시 및 복호화. |
| [reparse](#reparse) | \$Extend\$Reparse에서 재분석 지점 파싱 및 표시. |
| [logfile.dump](#logfile-dump) | 지정된 형식(csv, json, raw)으로 $LogFile 파일 덤프. |
| [usn.analyze](#usn-analyze) | 지정된 규칙으로 $UsnJrnl 파일 분석. 출력: csv 또는 json. |
| [usn.dump](#usn-dump) | 지정된 형식(csv, json, raw)으로 $UsnJrnl 파일 덤프. |
| [shadow](#shadow) | 선택한 디스크 및 볼륨의 볼륨 섀도 스냅샷 나열. |
| [streams](#streams) | 대체 데이터 스트림 표시 |
| [undelete](#undelete) | 볼륨에서 삭제된 파일 검색 및 추출. |
| [shell](#shell-1) | 제한된 Unix 계열 셸 시작 |
| [smart](#smart) | S.M.A.R.T 데이터 표시 |
## 제한 사항
- 지원되지 않는 사례가 있습니다. 작업 중입니다.
- 문서 없음 :no_mouth:.
이슈를 열거나 새 기능을 요청하세요!
## 빌드
- [Visual Studio 2022](https://visualstudio.microsoft.com/fr/vs/) 설치
- 여기에 설명된 대로 vcpkg(필수 타사 라이브러리용) 설치: [vcpkg#getting-started](https://github.com/microsoft/vcpkg#getting-started)
```
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat
```
- VisualStudio 환경에 통합:
```
vcpkg integrate install
```
빌드 시 VisualStudio가 `vcpkg.json` 파일을 감지하고 필요한 패키지를 자동으로 설치합니다.
타사 라이브러리:
- [openssl](https://www.openssl.org/): OpenSSL은 TLS(전송 계층 보안) 및 SSL(Secure Sockets Layer) 프로토콜을 위한 강력하고 상업용 등급의 완전한 기능을 갖춘 툴킷을 제공하는 오픈 소스 프로젝트입니다.
- [nlohmann-json](https://github.com/nlohmann/json): Modern C++용 JSON
- [distorm](https://github.com/gdabah/distorm): x86/AMD64를 위한 강력한 디스어셈블러 라이브러리
- [cppcoro](https://github.com/lewissbaker/cppcoro): 코루틴 TS를 위한 C++ 코루틴 추상화 라이브러리.
- [re2](https://github.com/google/re2): RE2는 역추적 정규 표현식 엔진에 대한 빠르고 안전하며 스레드 친화적인 대안입니다.
## 예제
### Info
<table>
<tr><td>info</td></tr>
<tr><td>
+-------------------------------------------------------------------------------------+
| Id | Model | Type | Partition | Size |
+-------------------------------------------------------------------------------------+
| 0 | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT | 500107862016 (465.76 GiBs) |
| 1 | ST2000DM001-1ER164 | Fixed HDD | GPT | 2000398934016 (1.82 TiB) |
| 2 | 15EADS External | Fixed HDD | MBR | 1500301910016 (1.36 TiB) |
| 3 | osfdisk | Fixed HDD | MBR | 536870912 (512.00 MiBs) |
+-------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3</td></tr>
<tr><td>
Model : osfdisk
Version : 1
Serial :
Media Type : Fixed HDD
Size : 536870912 (512.00 MiBs)
Geometry : 512 bytes * 63 sectors * 255 tracks * 65 cylinders
Volume : MBR
+--------------------------------------------------------------------------------------------------+
| Id | Boot | Label | Mounted | Filesystem | Offset | Size |
+--------------------------------------------------------------------------------------------------+
| 1 | No | NTFSDRIVE | F:\ | Bitlocker | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |
+--------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3 volume=1</td></tr>
<tr><td>
Serial Number : 0000aa60-00002eae
Filesystem : Bitlocker
Bootable : False
Type : Fixed
Label : NTFSDRIVE
Offset : 512 (512.00 bytes)
Size : 536870400 (512.00 MiBs)
Free : 519442432 (495.38 MiBs)
Mounted : True (F:\)
Bitlocker : True (Unlocked)
</td></tr>
</table>
### MBR
<table>
<tr><td>mbr disk=2</td></tr>
<tr><td>
Disk signature : e4589462
Reserved bytes : 0000
Partition table :
+---------------------------------------------------------------------------------------------------+
| Id | Boot | Flags | Filesystem | First sector | Last sector | Offset | Sectors | Size |
+---------------------------------------------------------------------------------------------------+
| 1 | No | Principal | NTFS / exFAT | 0 2 3 | 255 254 255 | 128 | 16771072 | 8.00 GiBs |
+---------------------------------------------------------------------------------------------------+
MBR signature : 55aa
Strings:
[63] : Invalid partition table
[7b] : Error loading operating system
[9a] : Missing operating system
Disassemble Bootstrap Code [y/N] ? y
0000 : 33c0 : xor ax, ax
0002 : 8ed0 : mov ss, ax
0004 : bc007c : mov sp, 0x7c00
0007 : 8ec0 : mov es, ax
0009 : 8ed8 : mov ds, ax
000b : be007c : mov si, 0x7c00
000e : bf0006 : mov di, 0x600
0011 : b90002 : mov cx, 0x200
...
</td></tr>
</table>
### GPT
<table>
<tr><td>gpt disk=1</td></tr>
<tr><td>
Signature : EFI PART
Revision : 1.0
Header Size : 92
Header CRC32 : cc72e4d3
Reserved : 00000000
Current LBA : 1
Backup LBA : 3907029167
First Usable LBA : 34
Last Usable LBA : 3907029134
GUID : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}
Entry LBA : 2
Entries Num : 128
Entries Size : 128
Partitions CRC32 : 0c9a0a25
Partition table : 2 entries
+------------------------------------------------------------------------------------------------------------------------+
| Id | Name | GUID | First sector | Last sector | Flags |
+------------------------------------------------------------------------------------------------------------------------+
| 1 | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34 | 262177 | 000000000000 |
| 2 | Basic data partition | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192 | 3907028991 | 000000000000 |
+------------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### VBR
<table>
<tr><td>vbr disk=3 volume=1</td></tr>
<tr><td>
Structure :
Jump : eb5890 (jmp 0x7c5a)
OEM id : -FVE-FS-
BytePerSector : 512
SectorPerCluster : 8
Reserved Sectors : 0
Number of FATs : 0
Root Max Entries : 0
Total Sectors : 0
Media Type : f8
SectorPerFat : 8160
SectorPerTrack : 63
Head Count : 255
FS Offset : 1
Total Sectors : 0
FAT Flags : 0000
FAT Version : 0000
Root Cluster : 0
FS Info Sector : 1
Backup BootSector: 6
Reserved : 00000000
Reserved : 00000000
Reserved : 00000000
Drive Number : 80
Reserved : 00
Ext. Boot Sign : 29
Serial Number : 00000000
Volume Name : NO NAME
FileSystem Type : FAT32
Volume GUID : {4967d63b-2e29-4ad8-8399-f6a339e3d001}
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
End marker : 55aa
Strings:
[00] : Remove disks or other media.
[1f] : Disk error
[2c] : Press any key to restart
Disassemble Bootstrap Code [y/N] ? y
7c5a : eb58 : jmp 0x7cb4
7c5c : 90 : nop
7c5d : 2d4656 : sub ax, 0x5646
7c60 : 45 : inc bp
7c61 : 2d4653 : sub ax, 0x5346
7c64 : 2d0002 : sub ax, 0x200
...
</td></tr>
</table>
### Extract
<table>
<tr><td>extract disk=0 volume=4 inode=0 output=d:\mymft</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 0 (00000000h)
[-] Destination : d:\mymft
[+] File extracted (5123541 bytes written)
</td></tr>
<tr><td>extract disk=3 volume=1 from=\bob.txt output=d:\bob.txt</td></tr>
<tr><td>
[+] Opening \\?\Volume{00023d5d-0000-0000-0002-000000000000}\
[-] Record Num : 47 (0000002fh)
[-] Destination : d:\bob.txt
[+] File extracted (42 bytes written)
</td></tr>
<tr><td>extract disk=0 volume=4 --system output=d:\system</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 623636 (00098414h)
[-] Destination : d:\system
[+] File extracted (19398656 bytes written)
</td></tr>
</table>
### Image
<table>
<tr><td>image disk=2 volume=2 output=d:\imagevol.raw</td></tr>
<tr><td>
[+] Opening \\?\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\
[-] Size : 33520128 (31.97 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
<tr><td>image disk=2 output=d:\image.raw</td></tr>
<tr><td>
[+] Opening \\.\PhysicalDrive2
[-] Size : 67108864 (64.00 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
</table>
### MFT-dump
<table>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.raw</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.raw
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.csv format=csv</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.csv
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>mft.csv 샘플 (마지막 줄 끝의 Zone.Identifier 데이터 확인)</td></tr>
<tr><td><pre>RecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl
0,"True","File","$MFT","",1048576,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
1,"True","File","$MFTMirr","",4096,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
2,"True","File","$LogFile","",67108864,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
3,"True","File","$Volume","",0,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
...
397,"True","File","vswhere.exe",".exe",457824,"103911","2020-10-19 18:42:19","2019-06-11 10:07:50","2019-06-11 10:07:52","2021-12-27 14:54:49","True","False","False","False","False","False","False","False","False","False","False","False","False",35944347632,1,"Zone.Identifier","3","https://github.com/microsoft/vswhere/releases","https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190611T100747Z&X-Amz-Expires=300&X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4&X-Amz-SignedHeaders=host&actor_id=40250307&response-content-disposition=attachment%3B%20filename%3Dvswhere.exe&response-content-type=application%2Foctet-stream"</pre>
</td></tr>
</table>
### MFT-record
<table>
<tr><td>mft.record disk=2 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Signature : FILE
Update Offset : 48
Update Number : 3
$LogFile LSN : 274035114
Sequence Number : 5
Hardlink Count : 1
Attribute Offset : 56
Flags : In_use | Directory
Real Size : 704
Allocated Size : 1024
Base File Record : 0
Next Attribute ID : 56
MFT Record Index : 5
Update Seq Number : 4461
Update Seq Array : 00000000
Attributes:
-----------+------------------------------------------------------------------------------------------------------------------+
| Id | Type | Non-resident | Length | Overview |
+------------------------------------------------------------------------------------------------------------------+
| 1 | $STANDARD_INFORMATION | False | 72 | File Created Time : 2009-12-02 02:03:31 |
| | | | | Last File Write Time : 2020-02-24 19:42:23 |
| | | | | FileRecord Changed Time : 2020-02-24 19:42:23 |
| | | | | Last Access Time : 2020-02-24 19:42:23 |
| | | | | Permissions : |
| | | | | read_only : 0 |
| | | | | hidden : 1 |
| | | | | system : 1 |
| | | | | device : 0 |
| | | | | normal : 0 |
| | | | | temporary : 0 |
| | | | | sparse : 0 |
| | | | | reparse_point : 0 |
| | | | | compressed : 0 |
| | | | | offline : 0 |
| | | | | not_indexed : 1 |
| | | | | encrypted : 0 |
| | | | | Max Number of Versions : 0 |
| | | | | Version Number : 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | $FILE_NAME | False | 68 | Parent Dir Record Index : 5 |
| | | | | Parent Dir Sequence Num : 5 |
| | | | | File Created Time : 2009-12-02 02:03:31 |
| | | | | Last File Write Time : 2011-12-24 03:13:12 |
| | | | | FileRecord Changed Time : 2011-12-24 03:13:12 |
| | | | | Last Access Time : 1970-01-01 00:59:59 |
| | | | | Allocated Size : 0 |
| | | | | Real Size : 0 |
| | | | | ------ |
| | | | | Name : . |
+------------------------------------------------------------------------------------------------------------------+
| 3 | $OBJECT_ID | False | 16 | Object Unique ID : {cce8fec5-9a29-11df-be68-0017f29 |
| | | | | 8268d} |
+------------------------------------------------------------------------------------------------------------------+
| 4 | $INDEX_ROOT | False | 152 | Attribute Type : 00000030h |
| | | | | Collation Rule : 1 |
| | | | | Index Alloc Entry Size : 4096 |
| | | | | Cluster/Index Record : 1 |
| | | | | ----- |
| | | | | First Entry Offset : 16 |
| | | | | Index Entries Size : 136 |
| | | | | Index Entries Allocated : 136 |
| | | | | Flags : Large Index |
+------------------------------------------------------------------------------------------------------------------+
| 5 | $INDEX_ALLOCATION | True | 12288 | Index |
| | | | | 0000000000000004 : $AttrDef |
| | | | | 0000000000000008 : $BadClus |
| | | | | 0000000000000006 : $Bitmap |
| | | | | 0000000000000007 : $Boot |
| | | | | 000000000000000b : $Extend |
| | | | | 0000000000000002 : $LogFile |
| | | | | 0000000000000000 : $MFT |
| | | | | 0000000000000001 : $MFTMirr |
| | | | | 000000000000002d : $RECYCLE.BIN |
| | | | | 0000000000000009 : $Secure |
| | | | | 000000000000000a : $UpCase |
| | | | | 0000000000000003 : $Volume |
| | | | | 0000000000000005 : . |
| | | | | 000000000000240c : Dir1 |
| | | | | 0000000000000218 : Dir2 |
| | | | | 000000000000212a : Dir3 |
| | | | | 0000000000000024 : Dir4 |
| | | | | 0000000000000def : RECYCLER |
| | | | | 000000000000001b : System Volume Information |
| | | | | 000000000000001b : SYSTEM~1 |
+------------------------------------------------------------------------------------------------------------------+
| 6 | $BITMAP | False | 8 | Index Node Used : 2 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### MFT-btree
<table>
<tr><td>mft.btree disk=0 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Attributes:
-----------
+-------------------------------------------------------------------------------------------+
| Id | Type | Non-resident | Length | Overview |
+-------------------------------------------------------------------------------------------+
| 1 | $INDEX_ROOT | False | 56 | Attribute Type : Filename |
| | | | | Collation Rule : 1 |
| | | | | Index Alloc Entry Size : 4096 |
| | | | | Cluster/Index Record : 1 |
| | | | | ----- |
| | | | | First Entry Offset : 16 |
| | | | | Index Entries Size : 40 |
| | | | | Index Entries Allocated : 40 |
| | | | | Flags : Large Index |
+-------------------------------------------------------------------------------------------+
| 2 | $INDEX_ALLOCATION | True | 20480 | First VCN : 0x000000000000 |
| | | | | Last VCN : 0x000000000004 |
+-------------------------------------------------------------------------------------------+
$INDEX_ALLOCATION entries:
--------------------------
+--------------------------------------------------------------------------------------------+
| VCN | Raw address | Size | Entries |
+--------------------------------------------------------------------------------------------+
| 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef |
| | | | 000000000008: $BadClus |
| | | | 000000000006: $Bitmap |
...
| | | | 000000000009: $Secure |
| | | | 00000000000a: $UpCase |
| | | | 000000000003: $Volume |
+--------------------------------------------------------------------------------------------+
| 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |
| | | | 000000000097: randomfile - Copie (5).bat |
| | | | 000000000095: randomfile - Copie (5).psd |
| | | | 000000000096: randomfile - Copie (5).txt |
| | | | 00000000009b: randomfile - Copie (6).accdb |
...
| | | | 000000000083: randomfile.accdb |
| | | | 000000000082: randomfile.bat |
| | | | 000000000084: randomfile.psd |
| | | | 000000000081: randomfile.txt |
| | | | 000000000024: System Volume Information |
+--------------------------------------------------------------------------------------------+
| 000000000002h | 0000007d6000h | 000000001000h | |
+--------------------------------------------------------------------------------------------+
| 000000000003h | 0000007d7000h | 000000001000h | 000000000005: . |
| | | | 000000000092: randomfile - Copie (4).txt |
+--------------------------------------------------------------------------------------------+
| 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder |
| | | | 00000000008c: randomfile - Copie (2).accdb |
| | | | 00000000008b: randomfile - Copie (2).bat |
| | | | 000000000089: randomfile - Copie (2).psd |
...
| | | | 00000000008e: randomfile - Copie (3).txt |
| | | | 000000000094: randomfile - Copie (4).accdb |
| | | | 000000000093: randomfile - Copie (4).bat |
| | | | 000000000091: randomfile - Copie (4).psd |
+--------------------------------------------------------------------------------------------+
B-tree index:
-------------
Root
|- 000000000000:
|---- VCN: 3
|- 000000000005: .
|---- VCN: 0
|- 000000000004: $AttrDef
|- 000000000008: $BadClus
|- 000000000006: $Bitmap
....
|- 000000000009: $Secure
|- 00000000000a: $UpCase
|- 000000000003: $Volume
|- 000000000092: randomfile - Copie (4).txt
|---- VCN: 4
|- 000000000027: random folder
|- 00000000008c: randomfile - Copie (2).accdb
|- 00000000008b: randomfile - Copie (2).bat
|- 000000000089: randomfile - Copie (2).psd
....
|- 000000000094: randomfile - Copie (4).accdb
|- 000000000093: randomfile - Copie (4).bat
|- 000000000091: randomfile - Copie (4).psd
|- 000000000000 (*)
|---- VCN: 1
|- 000000000098: randomfile - Copie (5).accdb
|- 000000000097: randomfile - Copie (5).bat
|- 000000000095: randomfile - Copie (5).psd
....
|- 000000000084: randomfile.psd
|- 000000000081: randomfile.txt
|- 000000000024: System Volume Information
</td></tr>
</table>
### Bitlocker-Info
<table>
<tr><td>bitlocker.info disk=3 volume=1</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Volume Master Keys:
-------------------
+--------------------------------------------------------------------------------------------------------------------+
| Id | Type | GUID | Details |
+--------------------------------------------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | Nonce : 01d5ecbb00f7155000000003 |
| | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | Encrypted Key : b76281568419ec3bee89d1eddccf3169 |
| | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | 0788bd366bec117b11a9fd6e |
| | | | |
| | | | JtR Hash : $bitlocker$1$16$daea96439babc5d1 |
| | | | e7f20c8860ff1ee9$1048576$12$5015 |
| | | | f700bbecd50103000000$60$175ec23c |
| | | | d799e2bde9d24bf3697919feb7628156 |
| | | | 8419ec3bee89d1eddccf316959c466b6 |
| | | | b392f40f0875e58168d868d70788bd36 |
| | | | 6bec117b11a9fd6e |
+--------------------------------------------------------------------------------------------------------------------+
| 2 | Recovery Password | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | Nonce : 01d5ecbb00f7155000000006 |
| | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | Encrypted Key : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | 6124ff46865e805367f7bef1 |
| | | | |
| | | | JtR Hash : $bitlocker$1$16$b9963d29e1bad1f4 |
| | | | 2e60c3bfb6e3bef5$1048576$12$5015 |
| | | | f700bbecd50106000000$60$3a06a06f |
| | | | db044d850ecd6faf5cf2aec997a43d40 |
| | | | c695c6d190eba3956ac7c7b1f5fdbbc7 |
| | | | f9a61a77c914fa347479c7ac6124ff46 |
| | | | 865e805367f7bef1 |
+--------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=badpassword</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Tested Password:
----------------<table>
<tr><td>
+--------------------------------------------------------------------------------+
| Id | Type | GUID | Password | Result |
+--------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | badpassword | Invalid |
+--------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=123456789</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Tested Password:
----------------
+--------------------------------------------------------------------------------------------------------------+
| Id | Type | GUID | Password | Result |
+--------------------------------------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 123456789 | Valid |
| | | | | |
| | | | | VMK : 751bf363db63ba6f1b36fb2ecd5ff1d8 |
| | | | | f5eab77e8754a848f2743978c7615f9f |
| | | | | FVEK : 35b8197e6d74d8521f49698d5f556589 |
| | | | | 2cf286ae5323c65631965c905a9d7da4 |
+--------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Bitlocker-복호화
<table>
<tr><td>bitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4</td></tr>
<tr><td>
[+] Opening \\?\Volume{09a02598-0000-0000-0002-000000000000}\
[+] Reading Bitlocker VBR
[-] Volume State : ENCRYPTED
[-] Size : 536870400 (512.00 MiBs)
[-] Encrypted Size : 536870400 (512.00 MiBs)
[-] Algorithm : AES-XTS-128
[+] Decrypting sectors
[-] Processed data size : 512.00 MiBs (100%)
[+] Duration : 7535ms
[+] Closing Volume
</td></tr>
</table>
### Bitlocker-FVE
<table>
<tr><td>bitlocker.fve disk=3 volume=1 fve_block=2</td></tr>
<tr><td>
Signature : -FVE-FS-
Size : 57
Version : 2
Current State : ENCRYPTED (4)
Next State : ENCRYPTED (4)
Encrypted Size : 536870400 (512.00 MiBs)
Convert Size : 0
Backup Sectors : 16
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
Backup Sectors Offset : 0000000002110000
FVE Metadata Header
-------------------
Size : 840
Version : 1
Header Size : 48
Copy Size : 840
Volume GUID : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}
Next Counter : 10
Algorithm : AES-XTS-128 (8004)
Timestamp : 2020-02-26 16:39:17
FVE Metadata Entries (5)
------------------------
+----------------------------------------------------------------------------------------------------------------+
| Id | Version | Size | Entry Type | Value Type | Value |
+----------------------------------------------------------------------------------------------------------------+
| 1 | 1 | 72 | Drive Label | Unicode | String : TWN NTFSDRIVE 26/02/2020 |
+----------------------------------------------------------------------------------------------------------------+
| 2 | 1 | 224 | VMK | VMK | Key ID : {2dd368f3-37d7-414f-94e6-3c5b86f |
| | | | | | add50} |
| | | | | | Last Change : 2020-02-26 16:40:00 |
| | | | | | Protection : Password |
| | | | | | |
| | | | | | Property #1 - Stretch Key - 108 |
| | | | | | -------- |
| | | | | | Encryption : STRETCH KEY |
| | | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | | | |
| | | | | | Property #1.1 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000002 |
| | | | | | MAC : 1dfebdc79a966e72ca806d6a83d8c7ba |
| | | | | | Key : eb51a188df981b54f51698c76d76a8bb |
| | | | | | d22afbbe27603ea6afc34c077726262e |
| | | | | | 5ba07482053d3c36fdecf80f |
| | | | | | |
| | | | | | Property #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000003 |
| | | | | | MAC : 175ec23cd799e2bde9d24bf3697919fe |
| | | | | | Key : b76281568419ec3bee89d1eddccf3169 |
| | | | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | | | 0788bd366bec117b11a9fd6e |
+----------------------------------------------------------------------------------------------------------------+
| 3 | 1 | 316 | VMK | VMK | Key ID : {19b4a3e2-94b3-452f-a614-6212fae |
| | | | | | b1b9d} |
| | | | | | Last Change : 2020-02-26 16:40:07 |
| | | | | | Protection : Recovery Password |
| | | | | | |
| | | | | | Property #1 - Stretch Key - 172 |
| | | | | | -------- |
| | | | | | Encryption : STRETCH KEY |
| | | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | | | |
| | | | | | Property #1.1 - AES-CCM - 64 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000004 |
| | | | | | MAC : 8064d679c7d8d1fa8ae548b0844882c7 |
| | | | | | Key : 18d21021d40e3dc99d38c8dd84faed10 |
| | | | | | 370c32095f4f63261ad8ec40 |
| | | | | | |
| | | | | | Property #1.2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000005 |
| | | | | | MAC : 3d40f2b5fc0091b894b438763fcdf4cd |
| | | | | | Key : a0af0aeda32d977d26ac76f9fc429668 |
| | | | | | 955d2a6a49fe4e2323751924e47e6c39 |
| | | | | | 8c22f7fcd2d4272003cb7a4e |
| | | | | | |
| | | | | | Property #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000006 |
| | | | | | MAC : 3a06a06fdb044d850ecd6faf5cf2aec9 |
| | | | | | Key : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | | | 6124ff46865e805367f7bef1 |
| | | | | | |
| | | | | | Property #3 - Recovery Backup - 28 |
| | | | | | -------- |
| | | | | | Location : File |
| | | | | | Start : 2022-04-03 12:52:50 |
| | | | | | End : 2022-04-03 12:52:50 |
+----------------------------------------------------------------------------------------------------------------+
| 4 | 1 | 80 | FKEV | AES-CCM | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000008 |
| | | | | | MAC : 2ff7d7f79920e3509fb8d20cb15b62c8 |
| | | | | | Key : 097169b9a5c41420ed2353a4a4210763 |
| | | | | | a8833d1a4a88c6f7c0c45ec7c0959f25 |
| | | | | | 2c8eac3f306e9fd1e693784a |
+----------------------------------------------------------------------------------------------------------------+
| 5 | 1 | 100 | Volume Header Block | Offset and Size | Offset : 0000000002110000 |
| | | | | | Size : 0000000000002000 |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### EFS-백업
<table>
<tr><td>efs.backup disk=0 volume=4 password=123456</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for certificates
- 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B
[+] Finding corresponding private keys
- 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a
[+] Finding corresponding masterkeys
- 9ac19509-54d3-48bc-8c67-4cfb01d73498
[+] Exporting 1 certificates and keys (pass: backup)
- ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok
Exported to 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx
</td></tr>
</table>
### EFS-복호화
<table>
<tr><td>efs.decrypt disk=0 volume=4 from=c:\cat.png pfx=z:\my_backup.pfx password=backup output=c:\socute.png</td></tr>
<tr><td>
[+] Loading PKCS12 input file
[-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b
[-] Reading record: 13525
[+] Parsing $EFS streams
[-] 1 data decryption field(s) found
[+] Decrypting FEK
[-] FEK
+----------------------------------------------------------------------------------+
| Property | Value |
+----------------------------------------------------------------------------------+
| Entropy | 32 |
| Algorithm | CALG_AES_256 |
| Key (256bits) | 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |
+----------------------------------------------------------------------------------+
[+] Decrypting file
[-] Decrypted file written to c:\socute.png (1.94 MiB)
</td></tr>
</table>
### EFS-인증서
<table>
<tr><td>efs.certificate disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for certificates
8 certificate(s) found
[+] Certificates
+-----------------------------------------------------------------------------------------------------------------------------------+
| Id | User | File | Certificate |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 0 | Bobby | Name : 02728B6DF5573C5955A4DFF22319441C889C367B | Friendly Name : APNS certificate Direct |
| | | Record : 00000001d2d5h | |
| | | Size : 850.00 bytes | |
| | | | |
| | | Creation : 2019-05-11 15:59:29 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 1 | Bobby | Name : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Friendly Name : APNS certificate |
| | | Record : 00000000b5a4h | |
| | | Size : 824.00 bytes | |
| | | | |
| | | Creation : 2021-03-03 18:02:33 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bobby | Name : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Container : ef456e5b-36e4-4eda-a80b-e234611306d4 |
| | | Record : 00000000ab23h | Provider : Microsoft Enhanced Cryptographic Provider v1.0 |
| | | Size : 1.15 KiB | Type : PROV_RSA_FULL |
| | | | KeySpec : AT_KEYEXCHANGE |
| | | Creation : 2020-08-17 13:20:03 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
..........
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4</td></tr>
<tr><td>### EFS 키
<table>
<tr><td>efs.key disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}
[+] Listing user directories:
8 directories found
[+] Searching for keys
9713 key(s) found
[+] Keys
+------------------------------------------------------------------------------------------------------------------+
| Id | User | Keyfile | Name | Creation Date |
+------------------------------------------------------------------------------------------------------------------+
| 0 | User1 | Name : 0004f7ed30db...017ee8d52ca6 | {15676EB3-D258-410F-85CB-9AB29E642CB3} | 2021-05-19 14:10:15 |
| | | Record : 0000000246c5h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 1 | User1 | Name : 0016875547ba...f7a9606b4177 | {BA4B66DC-8C1D-4FDF-A1EF-78B64411D1AD} | 2020-02-03 19:37:39 |
| | | Record : 000000019f19h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 2 | User1 | Name : 002a02ec680e...9a0a8d52ca67 | {3A3E1CF2-5AC2-4717-8006-D7C0F2936435} | 2019-06-26 15:50:50 |
..........
</td></tr>
<tr><td>efs.key disk=0 volume=4 inode=742107</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading key file record: 742107
[+] Key
+------------------------------------------------------------------------------------------------------------------+
| Id | Property | Value |
+------------------------------------------------------------------------------------------------------------------+
| 0 | File | Creation : 2021-09-23 22:16:43 |
| | | Size : 4.00 KiBs |
+------------------------------------------------------------------------------------------------------------------+
| 1 | Version | 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | Name | ef456e5b-43e4-4eda-a80b-e234611306d4 |
+------------------------------------------------------------------------------------------------------------------+
| 3 | Flags | 00000000h |
+------------------------------------------------------------------------------------------------------------------+
| 4 | PublicKey | Magic : 31415352h (RSA1) |
| | | Size : 2048 |
| | | Exponent : 65537 |
| | | |
| | | Permissions : CRYPT_ENCRYPT |
| | | CRYPT_DECRYPT |
| | | CRYPT_EXPORT |
| | | CRYPT_READ |
...
| | | |
| | | Modulus : 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+------------------------------------------------------------------------------------------------------------------+
| 5 | Encrypted PrivateKey | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Clé privée CryptoAPI |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : ABABD5324CCE0254BC726C3BF5A777D38BC4D75CACC2360EF3276EB4DC42FF6A |
| | | |
| | | HMAC : - |
| | | HMAC2 : D24F0B0AF684AE986F1328EAAFC01DA346D2BADE2B84CBE3C94CCB338D449EA6 |
| | | |
| | | Encrypted Data : D7DAD9229C91DBC9608852A4411527D7 |
| | | 58DB27E19596DD118F2D70F68CC7913C |
...
| | | 7870F6C68DA1B9139BF6E39725F4E72E |
| | | 4EC435C947F127CA3E333CB5E2F43978 |
| | | |
| | | Signature Data : 6077C027E6714A81C2710C5D334758F9AD463117DA4CBA8D0D05B5845A662E8F |
| | | 5E38DCCAB05DA5DD6C8328F5CF925F378F229790D30A2BCC91D5E3370AE50FED |
+------------------------------------------------------------------------------------------------------------------+
| 6 | Hash | 0000000000000000000000000000000000000000 |
+------------------------------------------------------------------------------------------------------------------+
| 7 | ExportFlag | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Export Flag |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : 772935C3582F625367716CE87D9626A524F15B9B7FF07166BB2C704B1223CB06 |
| | | |
| | | HMAC : - |
| | | HMAC2 : 3BCA74ED2C83767F06D9FF907817FE85FBA65FDB72A94E9D8F2C7CF1D8E7DCA2 |
| | | |
| | | Encrypted Data : 875A6429226F11DFD3690D43BE633287 |
| | | |
| | | Signature Data : FD97F69A214C37D0DA968B5AA18EE7C80D475F72F650C8DCAE887C97E850DCD6 |
| | | 9FA17D397A2375E362DE6F17193E3D084C06B0DCDB38E6C746150C1056145178 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34fac126105ce30...178c5bff4979eb</td></tr>
<tr><td>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading key file record: 742107
[-] Key
Encryption Algorithm : CALG_AES_256
Hash Algorithm : CALG_SHA_512
Salt : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] Decrypting key
[+] Key successfully decrypted
[+] Export flags : 00000001 (ALLOW_EXPORT_FLAG)
[+] Clear key (2048bits) :
+----------------------------------------------------------+
| Id | Property | Value |
+----------------------------------------------------------+
| 0 | Magic | RSA2 |
+----------------------------------------------------------+
| 1 | Bitsize | 2048 |
+----------------------------------------------------------+
| 2 | Exponent | 65537 |
+----------------------------------------------------------+
| 3 | Modulus | 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+----------------------------------------------------------+
| 4 | Prime1 | C02F585644ED6326FF82368B0AD9ECD4 |
...
| | | 65F7DE6D173FEBEF95BE491FB222E07B |
+----------------------------------------------------------+
| 5 | Prime2 | C884376BBC50C2A14C495894FBF980DE |
...
| | | 6759E812B6385B9151EBED8DCD65238F |
+----------------------------------------------------------+
| 6 | Exponent1 | 0E33B17876918051427271EB667AE238 |
...
| | | 69349EF83ACE9B75D20004D155CDA3FF |
+----------------------------------------------------------+
| 7 | Exponent2 | 5BF265077E1EFA60C47E8DA423B751A4 |
...
| | | E7008F2EA5684A74E4BFEEFAAB48C979 |
+----------------------------------------------------------+
| 8 | Coefficient | 7D68AA3844F096959C23BD59E4BE3147 |
...
| | | 592ABC1BEDEBA6F5B4BDE3D0F9BEF7C5 |
+----------------------------------------------------------+
| 9 | Private Exponent | 2462A061AD85A7C3B0DF7764CC5DDDFA |
| | | 40D83B3FBF0D9D016C419E6B6744AD73 |
...
| | | 47685BDEB0FABDC21AF5CABBA13D138D |
| | | F39FC063F1F20323E3220229E29FA42D |
+----------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34...eb output=mykey</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading key file record: 742107
[-] Key
Encryption Algorithm : CALG_AES_256
Hash Algorithm : CALG_SHA_512
Salt : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] Decrypting key
[+] Key successfully decrypted
[+] Public key exported to mykey.pub.pem.
[+] Private key exported to mykey.priv.pem.
</td></tr>
</table>
### EFS-마스터키
<table>
<tr><td>efs.masterkey disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for keys
19 key(s), 2 preferred file(s) found
[+] MasterKeys
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| Id | User | Keyfile | Key(s) | Creation Date |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 0 | DefaultAppPool | Name : e4ed144f-6522-4471-8893-a6e29e175ba6 | MasterKey | 2021-08-17 14:54:41 |
| | | Record : 000000031848h | Version : 2 | |
| | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : FA737C82899CC3F61A3B332B15FDC241 | |
| | | | Rounds : 8000 | |
| | | | BackupKey | |
| | | | Version : 2 | |
| | | | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : DF0651C903763132BC3043BF144A7DDD | |
| | | | Rounds : 8000 | |
| | | | CredHist | |
| | | | Version : 3 | |
| | | | GUID : {00000000-0000-0000-0000-000000000000} | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 1 | DefaultAppPool | Name : Preferred | Preferred | 2021-08-17 14:54:41 |
| | | Record : 00000003184ah | GUID : {e4ed144f-6522-4471-8893-a6e29e175ba6} | |
| | | Size : 24.00 bytes | Renew : 2021-11-15 12:54:41 | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bob | Name : 26bd8b3d-e87f-4df3-a1af-18f434788090 | MasterKey | 2021-03-05 01:16:42 |
| | | Record : 000000004f4ah | Version : 2 | |
| | | Size : 468.00 bytes | Algo : CALG_SHA_512 - CALG_AES_256 | |
| | | | Salt : 39B575D1816DE8224B9E11C38E35EB34 | |
| | | | Rounds : 8000 | |
| | | | BackupKey | |
..........
</td></tr>
<tr><td>efs.masterkey disk=0 volume=4 inode=0x80544</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading masterkey file record: 525636
[+] MasterKey
+--------------------------------------------------------------------+
| Id | Property | Value |
+--------------------------------------------------------------------+
| 0 | File | Creation : 2020-07-06 05:56:06 |
| | | Size : 468.00 bytes |
+--------------------------------------------------------------------+
| 1 | Version | 2 |
+--------------------------------------------------------------------+
| 2 | GUID | 9ac19509-54d3-48bc-8c67-4cfb01d73498 |
+--------------------------------------------------------------------+
| 3 | Policy | 00000005h |
+--------------------------------------------------------------------+
| 4 | MasterKey | Version : 2 |
| | | Salt : 3ED4CDBCC4073D6724A512061D0597E1 |
| | | Rounds : 8000 |
| | | Hash Alg : CALG_SHA_512 |
| | | Enc Alg : CALG_AES_256 |
| | | Enc Key : 3610946FE1A7B9099D0AFA7658325014 |
| | | 296D1F0E5BA93249858BE3ACCC8FD7A8 |
| | | F62DB6808833FC303095C6588BDE3826 |
| | | 80ABF391222CD77661BCCB637DDAC490 |
| | | B5FC02C854EF45490EE10851EF524DE2 |
| | | 85DD508F905216D528D3DC3336830FF9 |
| | | 690472730A03D64CF892E06B9AA35692 |
| | | AB7679E908D487119030B73CB87E6F9F |
| | | 731F65609CB8ACA972BCC9042B27B9B4 |
+--------------------------------------------------------------------+
| 5 | BackupKey | Version : 2 |
| | | Salt : B60E21F9578D02A97964D7B10151BE69 |
| | | Rounds : 8000 |
| | | Hash Alg : CALG_SHA_512 |
| | | Enc Alg : CALG_AES_256 |
| | | Enc Key : CD5D3684873D6A1D66520FB1642779E1 |
| | | D78A649F02DDFE7C069F9B5F8FF9F005 |
| | | 7DC01E0A6AA9A815C8887BC1BF5B88E6 |
| | | E797DC5F4A3A0535B3217BADC7FAD38E |
| | | 798C1846423C8631DE472D790B308B2D |
| | | F15340B87FCD55A98DAEE92196235CF9 |
| | | B328FAF475C05A911DF19C99D54D5A3C |
+--------------------------------------------------------------------+
| 6 | CredHist | Version : 3 |
| | | GUID : {20e0b482-797f-429e-b4a0-30020731ef0a} |
+--------------------------------------------------------------------+
</td></tr>
<tr><td> efs.masterkey disk=0 volume=4 inode=0x80544 sid="S-1-5-21-1521398...3175218-1001" password="ntfst00l"</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading masterkey file record: 525636
[-] Masterkey
Encryption Algorithm : CALG_AES_256
Hash Algorithm : CALG_SHA_512
Rounds : 8000
Salt : 3ED4CDBCC4073D6724A512061D0597E1
[+] Decrypting masterkey
[+] Clear masterkey (256bits):
34FAC126105CE302421A0FC7E3933FEC5639AA6BFF95000E6DA83AE67522EAB6
0AF58A27D834883B65611878B258AAAECD8983E3718E00F276178C5BFF4979EB
</td></tr>
</table>
### 재분석 포인트
<table>
<tr><td>reparse disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading $Extend\$Reparse
[+] 104 entries found
+----------------------------------------------------------------------------------------------------------------+
| Id | MFT Index | Filename | Type | Target/Data |
+----------------------------------------------------------------------------------------------------------------+
| 0 | 00000eb3 | debian.exe | AppExecLink | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4 |
| | | | | |
| | | | | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4!debian |
| | | | | |
| | | | | C:\Program Files\WindowsApps\The |
| | | | | DebianProject.DebianGNULinux_1.2 |
| | | | | .0.0_x64__76v4gfsz19hv4\debian.e |
| | | | | xe |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 13 | 000007f9 | BaseLayer | Mount Point | \??\Volume{629458e4-0000-0000-00 |
| | | | | 00-010000000000}\ |
+----------------------------------------------------------------------------------------------------------------+
| 14 | 00013e24 | Watchdog | Mount Point | \??\C:\Program Files\NVIDIA Corp |
| | | | | oration\NvContainer\Watchdog |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 102 | 00035861 | C2R64.dll | Symbolic Link | \??\C:\Program Files\Common File |
| | | | | s\Microsoft Shared\ClickToRun\C2 |
| | | | | R64.dll |
+----------------------------------------------------------------------------------------------------------------+
| 103 | 000986b0 | All Users | Symbolic Link | \??\C:\ProgramData |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### 로그파일 덤프
<table>
<tr><td>logfile.dump disk=4 volume=1 output=logfile.csv format=csv</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading $LogFile record
[-] $LogFile size : 4.14 MiBs
[+] Parsing $LogFile Restart Pages
[-] Newest Restart Page LSN : 5274485
[-] Volume marked as cleanly unmounted
[-] Client found : [1] NTFS
[+] Parsing $LogFile Record Pages
[-] $LogFile Record Page Count: 86
[+] Parsing $LogFile Records: 601
[+] Closing volume
</td></tr>
<tr><td>logfile.csv 샘플</td></tr>
<tr><td><pre>LSN,ClientPreviousLSN,UndoNextLSN,ClientID,RecordType,TransactionID,RedoOperation,UndoOperation,MFTClusterIndex,TargetVCN,TargetLCN
5269000,5268967,5268967,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269019,5269000,5269000,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269044,5269019,5269019,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269063,5269044,5269044,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269082,5269063,5269063,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269103,5269082,5269082,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269122,5269103,0,0,1,24,ForgetTransaction,CompensationLogRecord,0,0,18446744073709551615
5269133,0,0,0,1,24,UpdateResidentValue,UpdateResidentValue,2,13,43703</pre>
</td></tr>
</table>
### USN 분석
<table>
<tr><td>덤프에서 : usn.analyze from=usn_dump rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr></tr>
<tr><td>실행 중인 시스템에서 : usn.analyze disk=4 volume=1 rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr><td>
[+] Loading rules from: d:\rules.json
[-] 4 rules loaded
[+] Creating d:\usn_analyze_results.csv
[-] Mode: fast
[+] Opening \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[+] Searching for $Extend\$UsnJrnl
[-] Found in file record: 116
[-] $J stream size: 31.70 KiBs (could be sparse)
[+] Processing USN records: 192 (31.70 KiBs) - 9 matches
[+] Closing volume
[+] Summary:
+------------------------------------------------------+
| Index | Category | Value | % |
+------------------------------------------------------+
| 0 | file creation | 125 | 65.10 |
| 1 | file deletion | 0 | 0.00 |
| 2 | file rename | 8 | 4.17 |
| 3 | latest | 2022-03-28 23:23:12 | |
| 4 | oldest | 2022-03-28 13:20:08 | |
| 5 | records count | 192 | 100.00 |
+------------------------------------------------------+
[+] Rules results:
+------------------------------------------+
| Index | Rule ID | Count | % |
+------------------------------------------+
| 0 | executable-create | 9 | 4.69 |
| 1 | ccleaner | 2 | 1.04 |
| 2 | lsass-dump | 1 | 0.52 |
+------------------------------------------+
</td></tr>
</table>
### USN 덤프
<table>
<tr><td>usn.dump disk=4 volume=1 output=usn.csv format=csv</td></tr>
<tr><td>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Finding $Extend\$UsnJrnl record
[+] Found in file record: 88008
[+] $J stream size: 60.24 GiBs (could be sparse)
[+] Creating d:\mft_c.csv
[+] Loading $MFT records
[+] Processing $MFT records: 1.37 GiB
[+] 1436928 record loaded
[+] Processing entry: 322667 (34.12 MiBs)
[+] Closing volume
</td></tr>
<tr><td>usn.csv 예시</td></tr>
<tr><td><pre>MajorVersion,MinorVersion,FileReferenceNumber,FileReferenceSequenceNumber,ParentFileReferenceNumber,ParentFileReferenceSequenceNumber,Usn,Timestamp,Reason,SourceInfo,SecurityId,FileAttributes,Filename
2,0,53,4,5,5,0,2020-02-26 21:43:36,FILE_CREATE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,96,2020-02-26 21:43:36,FILE_CREATE+CLOSE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,192,2020-02-26 21:43:38,RENAME_OLD_NAME,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,288,2020-02-26 21:43:38,RENAME_NEW_NAME,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,360,2020-02-26 21:43:38,RENAME_NEW_NAME+CLOSE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,432,2020-02-26 21:43:39,OBJECT_ID_CHANGE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,504,2020-02-26 21:43:39,OBJECT_ID_CHANGE+CLOSE,0,0,DIRECTORY,volume:\test
2,0,54,2,53,4,576,2020-02-26 21:43:41,FILE_CREATE,0,0,ARCHIVE,volume:\test\Nouveau document texte.txt</pre>
</td></tr>
</table>
### 섀도
<table>
<tr><td>shadow disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] VSS header found at 0x1e00
+---------------------------------------------------------------------------------------------------------------+
| SetID/ID | 개수 | 날짜 | 세부 정보 |
+---------------------------------------------------------------------------------------------------------------+
| {857c9ac4-ee4f-4bc6-b822-59e935a7120f} | 1 | 2020-09-21 00:15:38 | 서비스 컴퓨터 : WORK-PC10 |
| | | | 원본 컴퓨터 : WORK-PC10 |
| {3d102db1-8de2-4e7d-8ba5-e0dd4f67740d} | | | 상태 : Created |
| | | | 플래그 : 0x0042000d |
| | | | - 영구적 |
| | | | - 클라이언트 접근 가능 |
| | | | - 자동 해제 없음 |
| | | | - 차등 |
| | | | - 자동 복구 |
+---------------------------------------------------------------------------------------------------------------+
| {83bc8af4-8802-4466-ae38-717f6474616a} | 1 | 2020-09-22 06:10:00 | 서비스 컴퓨터 : WORK-PC10 |
| | | | 원본 컴퓨터 : WORK-PC10 |
| {e668c329-66a2-4ebd-beef-3c6bca81cbf7} | | | 상태 : Created |
| | | | 플래그 : 0x0042000d |
| | | | - 영구적 |
| | | | - 클라이언트 접근 가능 |
| | | | - 자동 해제 없음 |
| | | | - 차등 |
| | | | - 자동 복구 |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### 스트림
<table>
<tr><td>streams disk=0 volume=4 from=c:\test.pdf</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Source : c:\test.pdf
[-] Record Num : 13525 (000034d5h)
[+] Alternate data stream(s):
+-----------------------------+
| ID | 이름 | 크기 |
+-----------------------------+
| 0 | Zone.Identifier | 27 |
+-----------------------------+
</td></tr>
</table>
### 삭제 취소
<table>
<tr><td>undelete disk=4 volume=1</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading $MFT record
[+] $MFT size : 256.00 KiBs (~256 records)
[+] Reading $BITMAP record
[+] $BITMAP size : 16.00 KiBs
[+] Searching deleted files
[+] Processed data size : 262144 (100%)
[+] Duration : 7ms
발견된 삭제된 파일
-------------------
+---------------------------------------------------------------------------------------------------------------+
| ID | MFT 인덱스 | 플래그 | 파일 이름 | 크기 | 삭제 날짜 | 복구 가능 % |
+---------------------------------------------------------------------------------------------------------------+
| 0 | 00000029 | | .\$RECYCLE.BIN\[...]\$RAV85W4.jpg | 5.10 KiBs | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
| 1 | 00000035 | | .\$RECYCLE.BIN\[...]\$IAV85W4.jpg | 58.00 bytes | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>undelete disk=2 volume=1 format=csv output=mydeletedfiles.csv</td></tr>
<tr><td>
[+] Opening \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[-] $MFT size :34.00 MiBs (~34816 records)
[-] $BITMAP size :14.32 MiBs
[+] Searching deleted files
[-] Processed data: 35651584 (100%)
[-] Duration : 425ms
[+] Deleted files : 127
[+] Writing results to mydeletedfiles.csv (csv) file
[+] Done
</td></tr>
<tr><td>undelete disk=4 volume=1 inode=41 output=restored_kitten.jpg</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading file record : 41
[+] Extracting $RAV85W4.jpg to restored_kitten.jpg
[+] 5219 bytes written
</td></tr>
</table>
### 셸
<table>
<tr><td>shell disk=4 volume=1</td></tr>
<tr><td>
disk4:volume1:> ls
Inode | 유형 | 이름 | 크기 | 생성 날짜 | 속성
---------------------------------------------------------------------------------------
4 | | $AttrDef | 2560 | 2020-02-26 16:35:29 | 숨김 시스템
8 | | $BadClus | 0 | 2020-02-26 16:35:29 | 숨김 시스템
| ADS | $Bad | 536866816 | |
6 | | $Bitmap | 16384 | 2020-02-26 16:35:29 | 숨김 시스템
7 | | $Boot | 8192 | 2020-02-26 16:35:29 | 숨김 시스템
11 | DIR | $Extend | | 2020-02-26 16:35:29 | 숨김 시스템
2 | | $LogFile | 4341760 | 2020-02-26 16:35:29 | 숨김 시스템
0 | | $MFT | 262144 | 2020-02-26 16:35:29 | 숨김 시스템
1 | | $MFTMirr | 4096 | 2020-02-26 16:35:29 | 숨김 시스템
50 | DIR | $RECYCLE.BIN | | 2020-02-26 16:40:34 | 숨김 시스템
9 | | $Secure | 0 | 2020-02-26 16:35:29 | 숨김 시스템
| ADS | $SDS | 264200 | |
10 | | $UpCase | 131072 | 2020-02-26 16:35:29 | 숨김 시스템
| ADS | $Info | 32 | |
3 | | $Volume | 0 | 2020-02-26 16:35:29 | 숨김 시스템
5 | DIR | . | | 2020-02-26 16:35:29 | 숨김 시스템
85010 | | 7z1900-x64.exe | 1447178 | 2020-07-29 17:19:49 | 아카이브
| ADS | Zone.Identifier | 123 | |
42 | | hello.txt | 5 | 2020-02-26 21:27:33 | 아카이브
39 | | kitten1.jpg | 23486 | 2020-02-26 16:37:23 | 아카이브
| ADS | Zone.Identifier | 154 | |
40 | | kitten2.jpg | 79678 | 2020-02-26 16:37:55 | 아카이브
| ADS | Zone.Identifier | 303 | |
41 | | kitten3.jpg | 5219 | 2020-02-26 16:38:16 | 아카이브
| ADS | Zone.Identifier | 262 | |
36 | DIR | System Volume Information | | 2020-02-26 16:35:29 | 숨김 시스템
disk4:volume1:> pwd
\
disk4:volume1:> cat hello.txt
Hey !
disk4:volume1:> cat 7z1900-x64.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://www.7-zip.org/download.html
HostUrl=https://www.7-zip.org/a/7z1900-x64.exe
disk4:volume1:> cp kitten3.jpg z:\custestkitten.jpg
1 file copied
disk4:volume1:> exit
</td></tr>
</table>
### SMART
<table>
<tr><td>smart disk=1</td></tr>
<tr><td>
버전 : 1 revision 1
유형 : SATA/IDE Master on primary channel
기능 : ATA, ATAPI, S.M.A.R.T
상태 : Passed
-- Device ID
+---------------------------------------------------------------------------------------------------+
| 속성 | 값 |
+---------------------------------------------------------------------------------------------------+
| 일반 구성 | 0040h |
| 실린더 수 | 16383 |
| 예약됨 | c837h |
| 헤드 수 | 16 |
| 트랙당 바이트 | 0 |
| 섹터당 바이트 | 0 |
| 트랙당 섹터 | 63 |
| 공급업체 고유 | |
| 일련 번호 | S2RBNX0H606448W |
| 버퍼 유형 | 0 |
| 버퍼 크기 | 0 |
| ECC 크기 | 0 |
| 펌웨어 개정 | EMT02B6Q |
| 모델 번호 | Samsung SSD 850 EVO 500GB |
| R/W 최대 섹터 수 | 32769 |
| 더블 워드 IO | 16385 |
| 기능 | 예약됨 : 0000h |
| | DMA 지원 : True |
| | LBA 지원 : True |
| | DisIORDY : True |
| | IORDY : True |
| | ATA 소프트 시작 필요 : False |
| | 중첩 작업 지원 : True |
| | 명령 큐 지원 : False |
| | 인터리브 DMA 지원 : False |
| 예약됨1 | 4000h |
| PIO 타이밍 | 512 |
| DMA 타이밍 | 512 |
| 필드 유효성 | CHS 개수 : True |
| | 사이클 횟수 : True |
| | Ultra DMA : True |
| 현재 실린더 수 | 16383 |
| 현재 헤드 수 | 16 |
| 현재 트랙당 섹터 수 | 63 |
| 다중 섹터 설정 | 16514064 |
| 주소 지정 가능한 총 섹터 수 (LBA) | 268435455 |
| 싱글워드 DMA 전송 지원 | 0 |
| 멀티워드 DMA 전송 지원 | Mode 0 (4.17Mb/s) |
| | Mode 1 (13.3Mb/s) |
| | Mode 2 (16.7Mb/s) |
| 고급 PIO 모드 | 0003h |
| 워드당 최소 멀티워드 DMA 전송 주기 시간 | 120 |
| 권장 멀티워드 DMA 전송 주기 시간 | 120 |
| 최소 PIO 전송 주기 시간 (흐름 제어 없음) | 120 |
| 최소 PIO 전송 주기 시간 (흐름 제어 있음) | 120 |
| ATA 지원 | ATA-2 |
| | ATA-3 |
| | ATA-4 |
| | ATA/ATAPI-5 |
| | ATA/ATAPI-6 |
| | ATA/ATAPI-7 |
| | ATA/ATAPI-8 |
| | ATA/ATAPI-9 |
| 울트라 DMA 전송 지원 | Mode 0 (16.7MB/s) |
| | Mode 1 (25.0MB/s) |
| | Mode 2 (33.3MB/s) |
| | Mode 3 (44.4MB/s) |
| | Mode 4 (66.7MB/s) |
| | Mode 5 (100.0MB/s) (selected) |
| | Mode 6 (133.0MB/s) |
+---------------------------------------------------------------------------------------------------+
-- 속성
+-------------------------------------------------------------------------------------------------------------------+
| 인덱스 | 이름 | 플래그 | 원시 | 값 | 최악 | 임계값 | 상태 |
+-------------------------------------------------------------------------------------------------------------------+
| 05h | 재할당된 섹터 수 | 0033h | 000000000000h | 100 | 100 | 10 | 정상 |
| 09h | 전원 켜짐 시간 수 | 0032h | 000000008d54h | 92 | 92 | 0 | 정상 |
| 0ch | 전원 사이클 수 | 0032h | 0000000000f5h | 99 | 99 | 0 | 정상 |
| b1h | 마모 범위 델타 | 0013h | 00000000005eh | 95 | 95 | 0 | 정상 |
| b3h | 사용된 예약 블록 수 (총) | 0013h | 000000000000h | 100 | 100 | 10 | 정상 |
| b5h | 프로그램 실패 수 총 | 0032h | 000000000000h | 100 | 100 | 10 | 정상 |
| b6h | 삭제 실패 수 | 0032h | 000000000000h | 100 | 100 | 10 | 정상 |
| b7h | SATA 다운 시프트 오류 수 | 0013h | 000000000000h | 100 | 100 | 10 | 정상 |
| bbh | 보고된 수정 불가 오류 | 0032h | 000000000000h | 100 | 100 | 0 | 정상 |
| beh | 100과의 온도 차이 | 0032h | 000000000020h | 68 | 50 | 0 | 정상 |
| c3h | 하드웨어 ECC 복구됨 | 001ah | 000000000000h | 200 | 200 | 0 | 정상 |
| c7h | UDMA CRC 오류율 | 003eh | 000000000000h | 100 | 100 | 0 | 정상 |
| ebh | 양호 블록 수 및 시스템 여유 블록 수 | 0012h | 000000000071h | 99 | 99 | 0 | 정상 |
| f1h | 호스트에서의 수명 쓰기 GiB | 0032h | 00154bf298c9h | 99 | 99 | 0 | 정상 |
+-------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>