NTFSTool 是一个专注于 NTFS 卷的取证工具。 它支持读取分区信息（MBR、分区表、VBR），还支持主文件表、Bitlocker 加密卷、EFS 加密文件、USN 日志等信息。
在 AppVeyor 上下载最新二进制文件，或查看最近的 GitHub 制品。
以下是一些功能 示例！
由 deepwiki 制作的替代文档可在以下地址获取：https://deepwiki.com/thewhiteninja/ntfstool/
NTFSTool 显示主引导记录、卷引导记录、分区表和 $MFT 文件记录的完整结构。 还可以转储任何文件（甚至 $MFT 或 SAM），或解析和分析 USN 日志、LogFile，包括来自备用数据流 (ADS) 的流。 $MFT 可以转储为 csv 或 json 格式，并解析 Zone.Identifier 以快速识别已下载的文件。 undelete 命令将搜索标记为"未使用"的文件记录，并允许您检索文件（如果文件已被重写，则检索部分文件）。 它支持从镜像文件、活动磁盘或虚拟磁盘（如 VeraCrypt 和 TrueCrypt）输入，您也可以使用 OSFMount 等工具挂载磁盘镜像。 还支持稀疏文件和压缩文件（lznt1, xpress）。
对于 Bitlocker 分区，它可以显示 FVE 记录，检查密码和密钥（bek、password、恢复密钥），提取 VMK 和 FVEK。 没有暴力破解功能，因为基于 GPU 的破解更好（参见 Bitcracker 和 Hashcat），但您可以获取这些工具的哈希值。
主密钥、私钥和证书可以使用所需的输入（SID、密码）列出、显示和解密。 可以使用 backup 命令导出带私钥的证书。
将备份重新导入另一台机器，即可再次读取您的加密文件！
或者，您可以使用 efs.decrypt 命令使用备份的密钥解密文件。
更多信息请参考 Mimikatz Wiki
可以使用自定义规则分析 USN 日志记录，以检测可疑程序和操作，同时也可以了解日志的概况（删除、创建的文件百分比...）
默认规则：Rules/default.json``` { "id": "lsass-dump", "description": "Dumped LSASS.exe process.", "severity": "high", "rule": { "filename": "lsass(\.(dmp|dump))?" } }
查看运行示例：[usn.analyze](#usn-analyze)
### Shell
提供一个有限的Shell，包含少量命令（exit, cd, ls, cat, pwd, cp, quit, rec）。
`rec` 命令显示 MFT 记录详情。
## 帮助与示例
Help 命令显示每个命令的描述和示例。
选项可以输入为十进制或带 "0x" 前缀的十六进制数（例如：inode）。
ntfstool help [command]
| 命令 | 描述 |
| --- | --- |
| [info](#info) | 显示所有磁盘和卷的信息 |
| [mbr](#mbr) | 显示磁盘的 MBR 结构、代码和分区 |
| [gpt](#gpt) | 显示磁盘的 GPT 结构、代码和分区 |
| [vbr](#vbr) | 显示指定卷的 VBR 结构和代码（支持 ntfs, fat32, fat1x, bitlocker） |
| [extract](#extract) | 从卷中提取文件。 |
| [image](#image) | 创建磁盘或卷的镜像文件。 |
| [mft.dump](#mft-dump) | 以指定格式（csv, json, raw）转储 $MFT 文件。 |
| [mft.record](#mft-record) | 显示指定 MFT inode 的 FILE 记录详情。支持几乎所有属性类型。 |
| [mft.btree](#mft-btree) | 显示 inode 的 VCN 内容和 B树索引。 |
| [bitlocker.info](#bitlocker-info) | 显示所有 VMK 的信息和哈希值（$bitlocker$）。测试密码或恢复密钥。 |
| [bitlocker.decrypt](#bitlocker-decrypt) | 使用密码、恢复密钥或 bek 将加密卷解密到文件。 |
| [bitlocker.fve](#bitlocker-fve) | 显示指定 FVE 块的信息。 |
| [efs.backup](#efs-backup) | 以 PKCS12（pfx）格式导出 EFS 密钥。 |
| [efs.decrypt](#efs-decrypt) | 使用 PKCS12（pfx）格式的密钥解密 EFS 加密文件。 |
| [efs.certificate](#efs-certificate) | 列出、显示和导出系统证书（SystemCertificates/My/Certificates）。 |
| [efs.key](#efs-key) | 列出、显示、解密和导出私钥（Crypto/RSA）。 |
| [efs.masterkey](#efs-masterkey) | 列出、显示和解密主密钥（Protect）。 |
| [reparse](#reparse) | 解析并显示 \$Extend\$Reparse 中的重解析点。 |
| [logfile.dump](#logfile-dump) | 以指定格式（csv, json, raw）转储 $LogFile 文件。 |
| [usn.analyze](#usn-analyze) | 使用指定规则分析 $UsnJrnl 文件。输出：csv 或 json。 |
| [usn.dump](#usn-dump) | 以指定格式（csv, json, raw）转储 $UsnJrnl 文件。 |
| [shadow](#shadow) | 从选定磁盘和卷中列出卷影快照。 |
| [streams](#streams) | 显示备用数据流。 |
| [undelete](#undelete) | 搜索并提取卷中已删除的文件。 |
| [shell](#shell-1) | 启动一个受限的类 Unix Shell。 |
| [smart](#smart) | 显示 S.M.A.R.T. 数据。 |
## 限制
- 某些情况尚未支持。继续开发中。
- 没有文档 :no_mouth:。
欢迎提出问题或请求新功能！
## 构建
- 安装 [Visual Studio 2022](https://visualstudio.microsoft.com/fr/vs/)
- 按照以下说明安装 vcpkg（用于所需的第三方库）：[vcpkg#getting-started](https://github.com/microsoft/vcpkg#getting-started)
```
git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat
```
- 将其集成到您的 Visual Studio 环境中：
```
vcpkg integrate install
```
在构建时，Visual Studio 会自动检测 `vcpkg.json` 文件并安装所需的包。
第三方库：
- [openssl](https://www.openssl.org/)：OpenSSL 是一个开源项目，提供健壮、商业级且功能齐全的传输层安全（TLS）和安全套接层（SSL）协议工具包。
- [nlohmann-json](https://github.com/nlohmann/json)：现代 C++ 的 JSON 库。
- [distorm](https://github.com/gdabah/distorm)：强大的 x86/AMD64 反汇编库。
- [cppcoro](https://github.com/lewissbaker/cppcoro)：用于协程 TS 的 C++ 协程抽象库。
- [re2](https://github.com/google/re2)：RE2 是一种快速、安全、线程友好的回溯正则表达式引擎替代品。
## 示例
### Info
<table>
<tr><td>info</td></tr>
<tr><td>
+-------------------------------------------------------------------------------------+
| Id | Model | Type | Partition | Size |
+-------------------------------------------------------------------------------------+
| 0 | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT | 500107862016 (465.76 GiBs) |
| 1 | ST2000DM001-1ER164 | Fixed HDD | GPT | 2000398934016 (1.82 TiB) |
| 2 | 15EADS External | Fixed HDD | MBR | 1500301910016 (1.36 TiB) |
| 3 | osfdisk | Fixed HDD | MBR | 536870912 (512.00 MiBs) |
+-------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3</td></tr>
<tr><td>
Model : osfdisk
Version : 1
Serial :
Media Type : Fixed HDD
Size : 536870912 (512.00 MiBs)
Geometry : 512 bytes * 63 sectors * 255 tracks * 65 cylinders
Volume : MBR
+--------------------------------------------------------------------------------------------------+
| Id | Boot | Label | Mounted | Filesystem | Offset | Size |
+--------------------------------------------------------------------------------------------------+
| 1 | No | NTFSDRIVE | F:\ | Bitlocker | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |
+--------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>info disk=3 volume=1</td></tr>
<tr><td>
Serial Number : 0000aa60-00002eae
Filesystem : Bitlocker
Bootable : False
Type : Fixed
Label : NTFSDRIVE
Offset : 512 (512.00 bytes)
Size : 536870400 (512.00 MiBs)
Free : 519442432 (495.38 MiBs)
Mounted : True (F:\)
Bitlocker : True (Unlocked)
</td></tr>
</table>
### MBR
<table>
<tr><td>mbr disk=2</td></tr>
<tr><td>
Disk signature : e4589462
Reserved bytes : 0000
Partition table :
+---------------------------------------------------------------------------------------------------+
| Id | Boot | Flags | Filesystem | First sector | Last sector | Offset | Sectors | Size |
+---------------------------------------------------------------------------------------------------+
| 1 | No | Principal | NTFS / exFAT | 0 2 3 | 255 254 255 | 128 | 16771072 | 8.00 GiBs |
+---------------------------------------------------------------------------------------------------+
MBR signature : 55aa
Strings:
[63] : Invalid partition table
[7b] : Error loading operating system
[9a] : Missing operating system
Disassemble Bootstrap Code [y/N] ? y
0000 : 33c0 : xor ax, ax
0002 : 8ed0 : mov ss, ax
0004 : bc007c : mov sp, 0x7c00
0007 : 8ec0 : mov es, ax
0009 : 8ed8 : mov ds, ax
000b : be007c : mov si, 0x7c00
000e : bf0006 : mov di, 0x600
0011 : b90002 : mov cx, 0x200
...
</td></tr>
</table>
### GPT
<table>
<tr><td>gpt disk=1</td></tr>
<tr><td>
Signature : EFI PART
Revision : 1.0
Header Size : 92
Header CRC32 : cc72e4d3
Reserved : 00000000
Current LBA : 1
Backup LBA : 3907029167
First Usable LBA : 34
Last Usable LBA : 3907029134
GUID : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}
Entry LBA : 2
Entries Num : 128
Entries Size : 128
Partitions CRC32 : 0c9a0a25
Partition table : 2 entries
+------------------------------------------------------------------------------------------------------------------------+
| Id | Name | GUID | First sector | Last sector | Flags |
+------------------------------------------------------------------------------------------------------------------------+
| 1 | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34 | 262177 | 000000000000 |
| 2 | Basic data partition | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192 | 3907028991 | 000000000000 |
+------------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### VBR
<table>
<tr><td>vbr disk=3 volume=1</td></tr>
<tr><td>
Structure :
Jump : eb5890 (jmp 0x7c5a)
OEM id : -FVE-FS-
BytePerSector : 512
SectorPerCluster : 8
Reserved Sectors : 0
Number of FATs : 0
Root Max Entries : 0
Total Sectors : 0
Media Type : f8
SectorPerFat : 8160
SectorPerTrack : 63
Head Count : 255
FS Offset : 1
Total Sectors : 0
FAT Flags : 0000
FAT Version : 0000
Root Cluster : 0
FS Info Sector : 1
Backup BootSector: 6
Reserved : 00000000
Reserved : 00000000
Reserved : 00000000
Drive Number : 80
Reserved : 00
Ext. Boot Sign : 29
Serial Number : 00000000
Volume Name : NO NAME
FileSystem Type : FAT32
Volume GUID : {4967d63b-2e29-4ad8-8399-f6a339e3d001}
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
End marker : 55aa
Strings:
[00] : Remove disks or other media.
[1f] : Disk error
[2c] : Press any key to restart
Disassemble Bootstrap Code [y/N] ? y
7c5a : eb58 : jmp 0x7cb4
7c5c : 90 : nop
7c5d : 2d4656 : sub ax, 0x5646
7c60 : 45 : inc bp
7c61 : 2d4653 : sub ax, 0x5346
7c64 : 2d0002 : sub ax, 0x200
...
</td></tr>
</table>
### Extract
<table>
<tr><td>extract disk=0 volume=4 inode=0 output=d:\mymft</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 0 (00000000h)
[-] Destination : d:\mymft
[+] File extracted (5123541 bytes written)
</td></tr>
<tr><td>extract disk=3 volume=1 from=\bob.txt output=d:\bob.txt</td></tr>
<tr><td>
[+] Opening \\?\Volume{00023d5d-0000-0000-0002-000000000000}\
[-] Record Num : 47 (0000002fh)
[-] Destination : d:\bob.txt
[+] File extracted (42 bytes written)
</td></tr>
<tr><td>extract disk=0 volume=4 --system output=d:\system</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num : 623636 (00098414h)
[-] Destination : d:\system
[+] File extracted (19398656 bytes written)
</td></tr>
</table>
### Image
<table>
<tr><td>image disk=2 volume=2 output=d:\imagevol.raw</td></tr>
<tr><td>
[+] Opening \\?\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\
[-] Size : 33520128 (31.97 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
<tr><td>image disk=2 output=d:\image.raw</td></tr>
<tr><td>
[+] Opening \\.\PhysicalDrive2
[-] Size : 67108864 (64.00 MiBs)
[-] BlockSize: 4096
[+] Copying : [################################] 100% 0s
[+] Done
</td></tr>
</table>
### MFT-dump
<table>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.raw</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.raw
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>mft.dump disk=2 volume=2 output=d:\mft.csv format=csv</td></tr>
<tr><td>
[+] $MFT size : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.csv
[+] Processing data: 1.00 MiB
[+] Closing volume
</td></tr>
<tr><td>Sample of mft.csv (check the end of the last line for Zone.Identifier data)</td></tr>
<tr><td><pre>RecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl
0,"True","File","$MFT","",1048576,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
1,"True","File","$MFTMirr","",4096,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
2,"True","File","$LogFile","",67108864,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
3,"True","File","$Volume","",0,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
...
397,"True","File","vswhere.exe",".exe",457824,"103911","2020-10-19 18:42:19","2019-06-11 10:07:50","2019-06-11 10:07:52","2021-12-27 14:54:49","True","False","False","False","False","False","False","False","False","False","False","False","False",35944347632,1,"Zone.Identifier","3","https://github.com/microsoft/vswhere/releases","https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190611T100747Z&X-Amz-Expires=300&X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4&X-Amz-SignedHeaders=host&actor_id=40250307&response-content-disposition=attachment%3B%20filename%3Dvswhere.exe&response-content-type=application%2Foctet-stream"</pre>
</td></tr>
</table>
### MFT-record
<table>
<tr><td>mft.record disk=2 volume=1 inode=5 (root folder)</td></tr>
<tr><td>
Signature : FILE
Update Offset : 48
Update Number : 3
$LogFile LSN : 274035114
Sequence Number : 5
Hardlink Count : 1
Attribute Offset : 56
Flags : In_use | Directory
Real Size : 704
Allocated Size : 1024
Base File Record : 0
Next Attribute ID : 56
MFT Record Index : 5
Update Seq Number : 4461
Update Seq Array : 00000000
Attributes:
-----------+------------------------------------------------------------------------------------------------------------------+
| ID | 类型 | 非常驻 | 长度 | 概述 |
+------------------------------------------------------------------------------------------------------------------+
| 1 | $STANDARD_INFORMATION | False | 72 | 文件创建时间 : 2009-12-02 02:03:31 |
| | | | | 最后文件写入时间 : 2020-02-24 19:42:23 |
| | | | | 文件记录更改时间 : 2020-02-24 19:42:23 |
| | | | | 最后访问时间 : 2020-02-24 19:42:23 |
| | | | | 权限 : |
| | | | | read_only : 0 |
| | | | | hidden : 1 |
| | | | | system : 1 |
| | | | | device : 0 |
| | | | | normal : 0 |
| | | | | temporary : 0 |
| | | | | sparse : 0 |
| | | | | reparse_point : 0 |
| | | | | compressed : 0 |
| | | | | offline : 0 |
| | | | | not_indexed : 1 |
| | | | | encrypted : 0 |
| | | | | 最大版本数 : 0 |
| | | | | 版本号 : 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | $FILE_NAME | False | 68 | 父目录记录索引 : 5 |
| | | | | 父目录序列号 : 5 |
| | | | | 文件创建时间 : 2009-12-02 02:03:31 |
| | | | | 最后文件写入时间 : 2011-12-24 03:13:12 |
| | | | | 文件记录更改时间 : 2011-12-24 03:13:12 |
| | | | | 最后访问时间 : 1970-01-01 00:59:59 |
| | | | | 分配大小 : 0 |
| | | | | 实际大小 : 0 |
| | | | | ------ |
| | | | | 名称 : . |
+------------------------------------------------------------------------------------------------------------------+
| 3 | $OBJECT_ID | False | 16 | 对象唯一 ID : {cce8fec5-9a29-11df-be68-0017f29 |
| | | | | 8268d} |
+------------------------------------------------------------------------------------------------------------------+
| 4 | $INDEX_ROOT | False | 152 | 属性类型 : 00000030h |
| | | | | 排序规则 : 1 |
| | | | | 索引分配条目大小 : 4096 |
| | | | | 簇/索引记录 : 1 |
| | | | | ----- |
| | | | | 第一个条目偏移 : 16 |
| | | | | 索引条目大小 : 136 |
| | | | | 索引条目已分配 : 136 |
| | | | | 标志 : 大索引 |
+------------------------------------------------------------------------------------------------------------------+
| 5 | $INDEX_ALLOCATION | True | 12288 | 索引 |
| | | | | 0000000000000004 : $AttrDef |
| | | | | 0000000000000008 : $BadClus |
| | | | | 0000000000000006 : $Bitmap |
| | | | | 0000000000000007 : $Boot |
| | | | | 000000000000000b : $Extend |
| | | | | 0000000000000002 : $LogFile |
| | | | | 0000000000000000 : $MFT |
| | | | | 0000000000000001 : $MFTMirr |
| | | | | 000000000000002d : $RECYCLE.BIN |
| | | | | 0000000000000009 : $Secure |
| | | | | 000000000000000a : $UpCase |
| | | | | 0000000000000003 : $Volume |
| | | | | 0000000000000005 : . |
| | | | | 000000000000240c : Dir1 |
| | | | | 0000000000000218 : Dir2 |
| | | | | 000000000000212a : Dir3 |
| | | | | 0000000000000024 : Dir4 |
| | | | | 0000000000000def : RECYCLER |
| | | | | 000000000000001b : System Volume Information |
| | | | | 000000000000001b : SYSTEM~1 |
+------------------------------------------------------------------------------------------------------------------+
| 6 | $BITMAP | False | 8 | 索引节点已用 : 2 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### MFT-btree
<table>
<tr><td>mft.btree disk=0 volume=1 inode=5 (根文件夹)</td></tr>
<tr><td>
属性:
-----------
+-------------------------------------------------------------------------------------------+
| ID | 类型 | 非常驻 | 长度 | 概述 |
+-------------------------------------------------------------------------------------------+
| 1 | $INDEX_ROOT | False | 56 | 属性类型 : 文件名 |
| | | | | 排序规则 : 1 |
| | | | | 索引分配条目大小 : 4096 |
| | | | | 簇/索引记录 : 1 |
| | | | | ----- |
| | | | | 第一个条目偏移 : 16 |
| | | | | 索引条目大小 : 40 |
| | | | | 索引条目已分配 : 40 |
| | | | | 标志 : 大索引 |
+-------------------------------------------------------------------------------------------+
| 2 | $INDEX_ALLOCATION | True | 20480 | 起始 VCN : 0x000000000000 |
| | | | | 最后 VCN : 0x000000000004 |
+-------------------------------------------------------------------------------------------+
$INDEX_ALLOCATION 条目:
--------------------------
+--------------------------------------------------------------------------------------------+
| VCN | 原始地址 | 大小 | 条目 |
+--------------------------------------------------------------------------------------------+
| 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef |
| | | | 000000000008: $BadClus |
| | | | 000000000006: $Bitmap |
...
| | | | 000000000009: $Secure |
| | | | 00000000000a: $UpCase |
| | | | 000000000003: $Volume |
+--------------------------------------------------------------------------------------------+
| 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |
| | | | 000000000097: randomfile - Copie (5).bat |
| | | | 000000000095: randomfile - Copie (5).psd |
| | | | 000000000096: randomfile - Copie (5).txt |
| | | | 00000000009b: randomfile - Copie (6).accdb |
...
| | | | 000000000083: randomfile.accdb |
| | | | 000000000082: randomfile.bat |
| | | | 000000000084: randomfile.psd |
| | | | 000000000081: randomfile.txt |
| | | | 000000000024: System Volume Information |
+--------------------------------------------------------------------------------------------+
| 000000000002h | 0000007d6000h | 000000001000h | |
+--------------------------------------------------------------------------------------------+
| 000000000003h | 0000007d7000h | 000000001000h | 000000000005: . |
| | | | 000000000092: randomfile - Copie (4).txt |
+--------------------------------------------------------------------------------------------+
| 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder |
| | | | 00000000008c: randomfile - Copie (2).accdb |
| | | | 00000000008b: randomfile - Copie (2).bat |
| | | | 000000000089: randomfile - Copie (2).psd |
...
| | | | 00000000008e: randomfile - Copie (3).txt |
| | | | 000000000094: randomfile - Copie (4).accdb |
| | | | 000000000093: randomfile - Copie (4).bat |
| | | | 000000000091: randomfile - Copie (4).psd |
+--------------------------------------------------------------------------------------------+
B-树索引:
-------------
根
|- 000000000000:
|---- VCN: 3
|- 000000000005: .
|---- VCN: 0
|- 000000000004: $AttrDef
|- 000000000008: $BadClus
|- 000000000006: $Bitmap
....
|- 000000000009: $Secure
|- 00000000000a: $UpCase
|- 000000000003: $Volume
|- 000000000092: randomfile - Copie (4).txt
|---- VCN: 4
|- 000000000027: random folder
|- 00000000008c: randomfile - Copie (2).accdb
|- 00000000008b: randomfile - Copie (2).bat
|- 000000000089: randomfile - Copie (2).psd
....
|- 000000000094: randomfile - Copie (4).accdb
|- 000000000093: randomfile - Copie (4).bat
|- 000000000091: randomfile - Copie (4).psd
|- 000000000000 (*)
|---- VCN: 1
|- 000000000098: randomfile - Copie (5).accdb
|- 000000000097: randomfile - Copie (5).bat
|- 000000000095: randomfile - Copie (5).psd
....
|- 000000000084: randomfile.psd
|- 000000000081: randomfile.txt
|- 000000000024: System Volume Information
</td></tr>
</table>
### Bitlocker-Info
<table>
<tr><td>bitlocker.info disk=3 volume=1</td></tr>
<tr><td>
FVE 版本 : 2
状态 : 已加密
大小 : 536870400 (512.00 MiB)
加密大小 : 536870400 (512.00 MiB)
算法 : AES-XTS-128
时间戳 : 2020-02-26 16:39:17
卷主密钥:
-------------------
+--------------------------------------------------------------------------------------------------------------------+
| ID | 类型 | GUID | 详细信息 |
+--------------------------------------------------------------------------------------------------------------------+
| 1 | 密码 | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 随机数 : 01d5ecbb00f7155000000003 |
| | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | 加密密钥 : b76281568419ec3bee89d1eddccf3169 |
| | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | 0788bd366bec117b11a9fd6e |
| | | | |
| | | | JtR 哈希 : $bitlocker$1$16$daea96439babc5d1 |
| | | | e7f20c8860ff1ee9$1048576$12$5015 |
| | | | f700bbecd50103000000$60$175ec23c |
| | | | d799e2bde9d24bf3697919feb7628156 |
| | | | 8419ec3bee89d1eddccf316959c466b6 |
| | | | b392f40f0875e58168d868d70788bd36 |
| | | | 6bec117b11a9fd6e |
+--------------------------------------------------------------------------------------------------------------------+
| 2 | 恢复密码 | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | 随机数 : 01d5ecbb00f7155000000006 |
| | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | 加密密钥 : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | 6124ff46865e805367f7bef1 |
| | | | |
| | | | JtR 哈希 : $bitlocker$1$16$b9963d29e1bad1f4 |
| | | | 2e60c3bfb6e3bef5$1048576$12$5015 |
| | | | f700bbecd50106000000$60$3a06a06f |
| | | | db044d850ecd6faf5cf2aec997a43d40 |
| | | | c695c6d190eba3956ac7c7b1f5fdbbc7 |
| | | | f9a61a77c914fa347479c7ac6124ff46 |
| | | | 865e805367f7bef1 |
+--------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=badpassword</td></tr>
<tr><td>
FVE 版本 : 2
状态 : 已加密
大小 : 536870400 (512.00 MiB)
加密大小 : 536870400 (512.00 MiB)
算法 : AES-XTS-128
时间戳 : 2020-02-26 16:39:17
测试密码:
----------------+--------------------------------------------------------------------------------+
| Id | Type | GUID | Password | Result |
+--------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | badpassword | Invalid |
+--------------------------------------------------------------------------------+
</td></tr>
<tr><td>bitlocker.info disk=3 volume=1 password=123456789</td></tr>
<tr><td>
FVE Version : 2
State : ENCRYPTED
Size : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm : AES-XTS-128
Timestamp : 2020-02-26 16:39:17
Tested Password:
----------------
+--------------------------------------------------------------------------------------------------------------+
| Id | Type | GUID | Password | Result |
+--------------------------------------------------------------------------------------------------------------+
| 1 | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 123456789 | Valid |
| | | | | |
| | | | | VMK : 751bf363db63ba6f1b36fb2ecd5ff1d8 |
| | | | | f5eab77e8754a848f2743978c7615f9f |
| | | | | FVEK : 35b8197e6d74d8521f49698d5f556589 |
| | | | | 2cf286ae5323c65631965c905a9d7da4 |
+--------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### Bitlocker-Decrypt
<table>
<tr><td>bitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4</td></tr>
<tr><td>
[+] Opening \\?\Volume{09a02598-0000-0000-0002-000000000000}\
[+] Reading Bitlocker VBR
[-] Volume State : ENCRYPTED
[-] Size : 536870400 (512.00 MiBs)
[-] Encrypted Size : 536870400 (512.00 MiBs)
[-] Algorithm : AES-XTS-128
[+] Decrypting sectors
[-] Processed data size : 512.00 MiBs (100%)
[+] Duration : 7535ms
[+] Closing Volume
</td></tr>
</table>
### Bitlocker-FVE
<table>
<tr><td>bitlocker.fve disk=3 volume=1 fve_block=2</td></tr>
<tr><td>
Signature : -FVE-FS-
Size : 57
Version : 2
Current State : ENCRYPTED (4)
Next State : ENCRYPTED (4)
Encrypted Size : 536870400 (512.00 MiBs)
Convert Size : 0
Backup Sectors : 16
FVE Block 1 : 0000000002100000
FVE Block 2 : 00000000059e4000
FVE Block 3 : 00000000092c8000
Backup Sectors Offset : 0000000002110000
FVE Metadata Header
-------------------
Size : 840
Version : 1
Header Size : 48
Copy Size : 840
Volume GUID : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}
Next Counter : 10
Algorithm : AES-XTS-128 (8004)
Timestamp : 2020-02-26 16:39:17
FVE Metadata Entries (5)
------------------------
+----------------------------------------------------------------------------------------------------------------+
| Id | Version | Size | Entry Type | Value Type | Value |
+----------------------------------------------------------------------------------------------------------------+
| 1 | 1 | 72 | Drive Label | Unicode | String : TWN NTFSDRIVE 26/02/2020 |
+----------------------------------------------------------------------------------------------------------------+
| 2 | 1 | 224 | VMK | VMK | Key ID : {2dd368f3-37d7-414f-94e6-3c5b86f |
| | | | | | add50} |
| | | | | | Last Change : 2020-02-26 16:40:00 |
| | | | | | Protection : Password |
| | | | | | |
| | | | | | Property #1 - Stretch Key - 108 |
| | | | | | -------- |
| | | | | | Encryption : STRETCH KEY |
| | | | | | MAC : daea96439babc5d1e7f20c8860ff1ee9 |
| | | | | | |
| | | | | | Property #1.1 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000002 |
| | | | | | MAC : 1dfebdc79a966e72ca806d6a83d8c7ba |
| | | | | | Key : eb51a188df981b54f51698c76d76a8bb |
| | | | | | d22afbbe27603ea6afc34c077726262e |
| | | | | | 5ba07482053d3c36fdecf80f |
| | | | | | |
| | | | | | Property #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000003 |
| | | | | | MAC : 175ec23cd799e2bde9d24bf3697919fe |
| | | | | | Key : b76281568419ec3bee89d1eddccf3169 |
| | | | | | 59c466b6b392f40f0875e58168d868d7 |
| | | | | | 0788bd366bec117b11a9fd6e |
+----------------------------------------------------------------------------------------------------------------+
| 3 | 1 | 316 | VMK | VMK | Key ID : {19b4a3e2-94b3-452f-a614-6212fae |
| | | | | | b1b9d} |
| | | | | | Last Change : 2020-02-26 16:40:07 |
| | | | | | Protection : Recovery Password |
| | | | | | |
| | | | | | Property #1 - Stretch Key - 172 |
| | | | | | -------- |
| | | | | | Encryption : STRETCH KEY |
| | | | | | MAC : b9963d29e1bad1f42e60c3bfb6e3bef5 |
| | | | | | |
| | | | | | Property #1.1 - AES-CCM - 64 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000004 |
| | | | | | MAC : 8064d679c7d8d1fa8ae548b0844882c7 |
| | | | | | Key : 18d21021d40e3dc99d38c8dd84faed10 |
| | | | | | 370c32095f4f63261ad8ec40 |
| | | | | | |
| | | | | | Property #1.2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000005 |
| | | | | | MAC : 3d40f2b5fc0091b894b438763fcdf4cd |
| | | | | | Key : a0af0aeda32d977d26ac76f9fc429668 |
| | | | | | 955d2a6a49fe4e2323751924e47e6c39 |
| | | | | | 8c22f7fcd2d4272003cb7a4e |
| | | | | | |
| | | | | | Property #2 - AES-CCM - 80 |
| | | | | | -------- |
| | | | | | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000006 |
| | | | | | MAC : 3a06a06fdb044d850ecd6faf5cf2aec9 |
| | | | | | Key : 97a43d40c695c6d190eba3956ac7c7b1 |
| | | | | | f5fdbbc7f9a61a77c914fa347479c7ac |
| | | | | | 6124ff46865e805367f7bef1 |
| | | | | | |
| | | | | | Property #3 - Recovery Backup - 28 |
| | | | | | -------- |
| | | | | | Location : File |
| | | | | | Start : 2022-04-03 12:52:50 |
| | | | | | End : 2022-04-03 12:52:50 |
+----------------------------------------------------------------------------------------------------------------+
| 4 | 1 | 80 | FKEV | AES-CCM | Nonce as Hex : 01d5ecbb00f71550 |
| | | | | | Nonce as Time : 2020-02-26 16:39:59 |
| | | | | | Nonce Counter : 00000008 |
| | | | | | MAC : 2ff7d7f79920e3509fb8d20cb15b62c8 |
| | | | | | Key : 097169b9a5c41420ed2353a4a4210763 |
| | | | | | a8833d1a4a88c6f7c0c45ec7c0959f25 |
| | | | | | 2c8eac3f306e9fd1e693784a |
+----------------------------------------------------------------------------------------------------------------+
| 5 | 1 | 100 | Volume Header Block | Offset and Size | Offset : 0000000002110000 |
| | | | | | Size : 0000000000002000 |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### EFS-backup
<table>
<tr><td>efs.backup disk=0 volume=4 password=123456</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for certificates
- 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B
[+] Finding corresponding private keys
- 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a
[+] Finding corresponding masterkeys
- 9ac19509-54d3-48bc-8c67-4cfb01d73498
[+] Exporting 1 certificates and keys (pass: backup)
- ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok
Exported to 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx
</td></tr>
</table>
### EFS-decrypt
<table>
<tr><td>efs.decrypt disk=0 volume=4 from=c:\cat.png pfx=z:\my_backup.pfx password=backup output=c:\socute.png</td></tr>
<tr><td>
[+] Loading PKCS12 input file
[-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b
[-] Reading record: 13525
[+] Parsing $EFS streams
[-] 1 data decryption field(s) found
[+] Decrypting FEK
[-] FEK
+----------------------------------------------------------------------------------+
| Property | Value |
+----------------------------------------------------------------------------------+
| Entropy | 32 |
| Algorithm | CALG_AES_256 |
| Key (256bits) | 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |
+----------------------------------------------------------------------------------+
[+] Decrypting file
[-] Decrypted file written to c:\socute.png (1.94 MiB)
</td></tr>
</table>
### EFS-certificate
<table>
<tr><td>efs.certificate disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
8 directories found
[+] Searching for certificates
8 certificate(s) found
[+] Certificates
+-----------------------------------------------------------------------------------------------------------------------------------+
| Id | User | File | Certificate |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 0 | Bobby | Name : 02728B6DF5573C5955A4DFF22319441C889C367B | Friendly Name : APNS certificate Direct |
| | | Record : 00000001d2d5h | |
| | | Size : 850.00 bytes | |
| | | | |
| | | Creation : 2019-05-11 15:59:29 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 1 | Bobby | Name : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Friendly Name : APNS certificate |
| | | Record : 00000000b5a4h | |
| | | Size : 824.00 bytes | |
| | | | |
| | | Creation : 2021-03-03 18:02:33 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bobby | Name : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Container : ef456e5b-36e4-4eda-a80b-e234611306d4 |
| | | Record : 00000000ab23h | Provider : Microsoft Enhanced Cryptographic Provider v1.0 |
| | | Size : 1.15 KiB | Type : PROV_RSA_FULL |
| | | | KeySpec : AT_KEYEXCHANGE |
| | | Creation : 2020-08-17 13:20:03 | |
+-----------------------------------------------------------------------------------------------------------------------------------+
..........
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4</td></tr>
<tr><td>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading certificate file record: 46500
[+] Certificate
+--------------------------------------------------------------------------------------------------------------------------+
| Id | Property | Value |
+--------------------------------------------------------------------------------------------------------------------------+
| 0 | File | Creation : 2021-03-03 18:02:33 |
| | | Size : 824.00 bytes |
+--------------------------------------------------------------------------------------------------------------------------+
| 1 | SHA1_HASH_PROP_ID | 14A67663C51C66FF5CAD89B4DC34495864338C67 |
+--------------------------------------------------------------------------------------------------------------------------+
| 2 | FRIENDLY_NAME_PROP_ID | APNS certificate |
+--------------------------------------------------------------------------------------------------------------------------+
| 3 | KEY_IDENTIFIER_PROP_ID | 82B87AE4F2251242252A2644D98169F34F909CA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 4 | SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID | DB532C4794A15E5D0392C7C605FCBCA8 |
+--------------------------------------------------------------------------------------------------------------------------+
| 5 | CERTIFICATE_FILE | Data: |
| | | Version: 3 (0x2) |
| | | Serial Number: |
| | | 01:20:cb:ab:28:8a:97:ee:99:cc |
| | | Signature Algorithm: sha1WithRSAEncryption |
| | | Issuer: C=US, O=Apple Inc., OU=Apple iPhone, CN=Apple iPhone Device CA |
| | | Validity |
| | | Not Before: Mar 3 15:57:33 2021 GMT |
| | | Not After : Mar 3 16:02:33 2022 GMT |
| | | Subject: CN=1A6032AA-91A2-4B1D-B6AF-5509FC173686 |
| | | Subject Public Key Info: |
| | | Public Key Algorithm: rsaEncryption |
| | | RSA Public-Key: (1024 bit) |
| | | Modulus: |
| | | 00:a2:75:db:69:8d:c9:b3:fd:96:4d:28:b9:43:94: |
| | | db:7d:73:53:88:c9:79:e9:fa:de:e4:12:14:2c:de: |
...
| | | a7:6b:d0:01:9e:dc:66:27:ef:2e:20:7e:e5:2a:42: |
| | | 9e:6f:85:9c:b6:8f:be:d3:05 |
| | | Exponent: 65537 (0x10001) |
| | | X509v3 extensions: |
| | | X509v3 Authority Key Identifier: |
| | | keyid:B2:FE:21:23:44:86:95:6A:79:D5:81:26:8E:73:10:D8:A7:4C:8E:74 |
| | | X509v3 Subject Key Identifier: |
| | | 82:B8:7A:E4:F2:25:12:42:25:2A:26:44:D9:81:69:F3:4F:90:9C:A8 |
| | | X509v3 Basic Constraints: critical |
| | | CA:FALSE |
| | | X509v3 Key Usage: critical |
| | | Digital Signature, Key Encipherment |
| | | X509v3 Extended Key Usage: critical |
| | | TLS Web Server Authentication, TLS Web Client Authentication |
| | | 1.2.840.113635.100.6.10.6: |
| | | .. |
| | | Signature Algorithm: sha1WithRSAEncryption |
| | | 28:54:6c:d9:4e:97:f5:dd:1f:79:4a:6a:74:42:ad:6e:a1:11: |
...
| | | 27:58:3b:d5:1e:c3:71:af:6b:bd:fe:5d:ad:4d:bd:82:fa:53: |
| | | ff:0c |
+--------------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>efs.certificate disk=0 volume=4 inode=0xb5a4 output=mycert</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading certificate file record: 46500
[+] Certificate exported to mycert.pem
</td></tr>
</table>
### EFS-key
<table>
<tr><td>efs.key disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}
[+] Listing user directories:
8 directories found
[+] Searching for keys
9713 key(s) found
[+] Keys
+------------------------------------------------------------------------------------------------------------------+
| Id | User | Keyfile | Name | Creation Date |
+------------------------------------------------------------------------------------------------------------------+
| 0 | User1 | Name : 0004f7ed30db...017ee8d52ca6 | {15676EB3-D258-410F-85CB-9AB29E642CB3} | 2021-05-19 14:10:15 |
| | | Record : 0000000246c5h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 1 | User1 | Name : 0016875547ba...f7a9606b4177 | {BA4B66DC-8C1D-4FDF-A1EF-78B64411D1AD} | 2020-02-03 19:37:39 |
| | | Record : 000000019f19h | | |
| | | Size : 4.00 KiBs | | |
+------------------------------------------------------------------------------------------------------------------+
| 2 | User1 | Name : 002a02ec680e...9a0a8d52ca67 | {3A3E1CF2-5AC2-4717-8006-D7C0F2936435} | 2019-06-26 15:50:50 |
..........
</td></tr>
<tr><td>efs.key disk=0 volume=4 inode=742107</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading key file record: 742107
[+] Key
+------------------------------------------------------------------------------------------------------------------+
| Id | Property | Value |
+------------------------------------------------------------------------------------------------------------------+
| 0 | File | Creation : 2021-09-23 22:16:43 |
| | | Size : 4.00 KiBs |
+------------------------------------------------------------------------------------------------------------------+
| 1 | Version | 0 |
+------------------------------------------------------------------------------------------------------------------+
| 2 | Name | ef456e5b-43e4-4eda-a80b-e234611306d4 |
+------------------------------------------------------------------------------------------------------------------+
| 3 | Flags | 00000000h |
+------------------------------------------------------------------------------------------------------------------+
| 4 | PublicKey | Magic : 31415352h (RSA1) |
| | | Size : 2048 |
| | | Exponent : 65537 |
| | | |
| | | Permissions : CRYPT_ENCRYPT |
| | | CRYPT_DECRYPT |
| | | CRYPT_EXPORT |
| | | CRYPT_READ |
...
| | | |
| | | Modulus : 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+------------------------------------------------------------------------------------------------------------------+
| 5 | Encrypted PrivateKey | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Clé privée CryptoAPI |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : ABABD5324CCE0254BC726C3BF5A777D38BC4D75CACC2360EF3276EB4DC42FF6A |
| | | |
| | | HMAC : - |
| | | HMAC2 : D24F0B0AF684AE986F1328EAAFC01DA346D2BADE2B84CBE3C94CCB338D449EA6 |
| | | |
| | | Encrypted Data : D7DAD9229C91DBC9608852A4411527D7 |
| | | 58DB27E19596DD118F2D70F68CC7913C |
...
| | | 7870F6C68DA1B9139BF6E39725F4E72E |
| | | 4EC435C947F127CA3E333CB5E2F43978 |
| | | |
| | | Signature Data : 6077C027E6714A81C2710C5D334758F9AD463117DA4CBA8D0D05B5845A662E8F |
| | | 5E38DCCAB05DA5DD6C8328F5CF925F378F229790D30A2BCC91D5E3370AE50FED |
+------------------------------------------------------------------------------------------------------------------+
| 6 | Hash | 0000000000000000000000000000000000000000 |
+------------------------------------------------------------------------------------------------------------------+
| 7 | ExportFlag | Version : 1 |
| | | Provider GUID : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} |
| | | MasterKey Version : 1 |
| | | MasterKey GUID : {9ac19509-54d3-48bc-8c67-4cfb01d73498} |
| | | |
| | | Description : Export Flag |
| | | Flags : 00000000h |
| | | |
| | | Encryption Alg : CALG_AES_256 |
| | | Hash Alg : CALG_SHA_512 |
| | | |
| | | Salt : 772935C3582F625367716CE87D9626A524F15B9B7FF07166BB2C704B1223CB06 |
| | | |
| | | HMAC : - |
| | | HMAC2 : 3BCA74ED2C83767F06D9FF907817FE85FBA65FDB72A94E9D8F2C7CF1D8E7DCA2 |
| | | |
| | | Encrypted Data : 875A6429226F11DFD3690D43BE633287 |
| | | |
| | | Signature Data : FD97F69A214C37D0DA968B5AA18EE7C80D475F72F650C8DCAE887C97E850DCD6 |
| | | 9FA17D397A2375E362DE6F17193E3D084C06B0DCDB38E6C746150C1056145178 |
+------------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34fac126105ce30...178c5bff4979eb</td></tr>
<tr><td>[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在读取密钥文件记录: 742107
[-] 密钥
加密算法 : CALG_AES_256
哈希算法 : CALG_SHA_512
盐值 : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] 正在解密密钥
[+] 密钥成功解密
[+] 导出标志 : 00000001 (ALLOW_EXPORT_FLAG)
[+] 明文密钥 (2048位) :
+----------------------------------------------------------+
| Id | 属性 | 值 |
+----------------------------------------------------------+
| 0 | Magic | RSA2 |
+----------------------------------------------------------+
| 1 | Bitsize | 2048 |
+----------------------------------------------------------+
| 2 | 指数 | 65537 |
+----------------------------------------------------------+
| 3 | 模数 | 96883F07FF78DA8354D037A94F897BD7 |
...
| | | FA77A3D04DD10D044761E65355B335B5 |
+----------------------------------------------------------+
| 4 | 素数1 | C02F585644ED6326FF82368B0AD9ECD4 |
...
| | | 65F7DE6D173FEBEF95BE491FB222E07B |
+----------------------------------------------------------+
| 5 | 素数2 | C884376BBC50C2A14C495894FBF980DE |
...
| | | 6759E812B6385B9151EBED8DCD65238F |
+----------------------------------------------------------+
| 6 | 指数1 | 0E33B17876918051427271EB667AE238 |
...
| | | 69349EF83ACE9B75D20004D155CDA3FF |
+----------------------------------------------------------+
| 7 | 指数2 | 5BF265077E1EFA60C47E8DA423B751A4 |
...
| | | E7008F2EA5684A74E4BFEEFAAB48C979 |
+----------------------------------------------------------+
| 8 | 系数 | 7D68AA3844F096959C23BD59E4BE3147 |
...
| | | 592ABC1BEDEBA6F5B4BDE3D0F9BEF7C5 |
+----------------------------------------------------------+
| 9 | 私有指数 | 2462A061AD85A7C3B0DF7764CC5DDDFA |
| | | 40D83B3FBF0D9D016C419E6B6744AD73 |
...
| | | 47685BDEB0FABDC21AF5CABBA13D138D |
| | | F39FC063F1F20323E3220229E29FA42D |
+----------------------------------------------------------+
</td></tr>
<tr><td> efs.key disk=0 volume=4 inode=742107 masterkey=34...eb output=mykey</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在读取密钥文件记录: 742107
[-] 密钥
加密算法 : CALG_AES_256
哈希算法 : CALG_SHA_512
盐值 : ABABD5324CCE0254BC726C33F5A777D38BC4D75CACC2360EF3276EB4DC42FF6A
[+] 正在解密密钥
[+] 密钥成功解密
[+] 公钥已导出到 mykey.pub.pem.
[+] 私钥已导出到 mykey.priv.pem.
</td></tr>
</table>
### EFS-masterkey
<table>
<tr><td>efs.masterkey disk=0 volume=4</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在列出用户目录
找到 8 个目录
[+] 正在搜索密钥
找到 19 个密钥，2 个首选文件
[+] 主密钥
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| Id | 用户 | 密钥文件 | 密钥 | 创建日期 |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 0 | DefaultAppPool | 名称 : e4ed144f-6522-4471-8893-a6e29e175ba6 | 主密钥 | 2021-08-17 14:54:41 |
| | | 记录 : 000000031848h | 版本 : 2 | |
| | | 大小 : 468.00 字节 | 算法 : CALG_SHA_512 - CALG_AES_256 | |
| | | | 盐值 : FA737C82899CC3F61A3B332B15FDC241 | |
| | | | 轮数 : 8000 | |
| | | | 备份密钥 | |
| | | | 版本 : 2 | |
| | | | 算法 : CALG_SHA_512 - CALG_AES_256 | |
| | | | 盐值 : DF0651C903763132BC3043BF144A7DDD | |
| | | | 轮数 : 8000 | |
| | | | 凭证历史 | |
| | | | 版本 : 3 | |
| | | | GUID : {00000000-0000-0000-0000-000000000000} | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 1 | DefaultAppPool | 名称 : 首选 | 首选 | 2021-08-17 14:54:41 |
| | | 记录 : 00000003184ah | GUID : {e4ed144f-6522-4471-8893-a6e29e175ba6} | |
| | | 大小 : 24.00 字节 | 续订 : 2021-11-15 12:54:41 | |
+--------------------------------------------------------------------------------------------------------------------------------------------------+
| 2 | Bob | 名称 : 26bd8b3d-e87f-4df3-a1af-18f434788090 | 主密钥 | 2021-03-05 01:16:42 |
| | | 记录 : 000000004f4ah | 版本 : 2 | |
| | | 大小 : 468.00 字节 | 算法 : CALG_SHA_512 - CALG_AES_256 | |
| | | | 盐值 : 39B575D1816DE8224B9E11C38E35EB34 | |
| | | | 轮数 : 8000 | |
| | | | 备份密钥 | |
..........
</td></tr>
<tr><td>efs.masterkey disk=0 volume=4 inode=0x80544</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在读取主密钥文件记录: 525636
[+] 主密钥
+--------------------------------------------------------------------+
| Id | 属性 | 值 |
+--------------------------------------------------------------------+
| 0 | 文件 | 创建 : 2020-07-06 05:56:06 |
| | | 大小 : 468.00 字节 |
+--------------------------------------------------------------------+
| 1 | 版本 | 2 |
+--------------------------------------------------------------------+
| 2 | GUID | 9ac19509-54d3-48bc-8c67-4cfb01d73498 |
+--------------------------------------------------------------------+
| 3 | 策略 | 00000005h |
+--------------------------------------------------------------------+
| 4 | 主密钥 | 版本 : 2 |
| | | 盐值 : 3ED4CDBCC4073D6724A512061D0597E1 |
| | | 轮数 : 8000 |
| | | 哈希算法 : CALG_SHA_512 |
| | | 加密算法 : CALG_AES_256 |
| | | 加密密钥 : 3610946FE1A7B9099D0AFA7658325014 |
| | | 296D1F0E5BA93249858BE3ACCC8FD7A8 |
| | | F62DB6808833FC303095C6588BDE3826 |
| | | 80ABF391222CD77661BCCB637DDAC490 |
| | | B5FC02C854EF45490EE10851EF524DE2 |
| | | 85DD508F905216D528D3DC3336830FF9 |
| | | 690472730A03D64CF892E06B9AA35692 |
| | | AB7679E908D487119030B73CB87E6F9F |
| | | 731F65609CB8ACA972BCC9042B27B9B4 |
+--------------------------------------------------------------------+
| 5 | 备份密钥 | 版本 : 2 |
| | | 盐值 : B60E21F9578D02A97964D7B10151BE69 |
| | | 轮数 : 8000 |
| | | 哈希算法 : CALG_SHA_512 |
| | | 加密算法 : CALG_AES_256 |
| | | 加密密钥 : CD5D3684873D6A1D66520FB1642779E1 |
| | | D78A649F02DDFE7C069F9B5F8FF9F005 |
| | | 7DC01E0A6AA9A815C8887BC1BF5B88E6 |
| | | E797DC5F4A3A0535B3217BADC7FAD38E |
| | | 798C1846423C8631DE472D790B308B2D |
| | | F15340B87FCD55A98DAEE92196235CF9 |
| | | B328FAF475C05A911DF19C99D54D5A3C |
+--------------------------------------------------------------------+
| 6 | 凭证历史 | 版本 : 3 |
| | | GUID : {20e0b482-797f-429e-b4a0-30020731ef0a} |
+--------------------------------------------------------------------+
</td></tr>
<tr><td> efs.masterkey disk=0 volume=4 inode=0x80544 sid="S-1-5-21-1521398...3175218-1001" password="ntfst00l"</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在读取主密钥文件记录: 525636
[-] 主密钥
加密算法 : CALG_AES_256
哈希算法 : CALG_SHA_512
轮数 : 8000
盐值 : 3ED4CDBCC4073D6724A512061D0597E1
[+] 正在解密主密钥
[+] 明文主密钥 (256位):
34FAC126105CE302421A0FC7E3933FEC5639AA6BFF95000E6DA83AE67522EAB6
0AF58A27D834883B65611878B258AAAECD8983E3718E00F276178C5BFF4979EB
</td></tr>
</table>
### 重解析点
<table>
<tr><td>reparse disk=0 volume=4</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] 正在读取 $Extend\$Reparse
[+] 找到 104 个条目
+----------------------------------------------------------------------------------------------------------------+
| Id | MFT 索引 | 文件名 | 类型 | 目标/数据 |
+----------------------------------------------------------------------------------------------------------------+
| 0 | 00000eb3 | debian.exe | AppExecLink | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4 |
| | | | | |
| | | | | TheDebianProject.DebianGNULinux_ |
| | | | | 76v4gfsz19hv4!debian |
| | | | | |
| | | | | C:\Program Files\WindowsApps\The |
| | | | | DebianProject.DebianGNULinux_1.2 |
| | | | | .0.0_x64__76v4gfsz19hv4\debian.e |
| | | | | xe |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 13 | 000007f9 | BaseLayer | 挂载点 | \??\Volume{629458e4-0000-0000-00 |
| | | | | 00-010000000000}\ |
+----------------------------------------------------------------------------------------------------------------+
| 14 | 00013e24 | Watchdog | 挂载点 | \??\C:\Program Files\NVIDIA Corp |
| | | | | oration\NvContainer\Watchdog |
+----------------------------------------------------------------------------------------------------------------+
...
+----------------------------------------------------------------------------------------------------------------+
| 102 | 00035861 | C2R64.dll | 符号链接 | \??\C:\Program Files\Common File |
| | | | | s\Microsoft Shared\ClickToRun\C2 |
| | | | | R64.dll |
+----------------------------------------------------------------------------------------------------------------+
| 103 | 000986b0 | All Users | 符号链接 | \??\C:\ProgramData |
+----------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### 日志文件转储
<table>
<tr><td>logfile.dump disk=4 volume=1 output=logfile.csv format=csv</td></tr>
<tr><td>
[+] 正在打开 \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] 正在读取 $LogFile 记录
[-] $LogFile 大小 : 4.14 MiB
[+] 正在解析 $LogFile 重新启动页
[-] 最新重新启动页 LSN : 5274485
[-] 卷标记为已干净卸载
[-] 找到客户端 : [1] NTFS
[+] 正在解析 $LogFile 记录页
[-] $LogFile 记录页数: 86
[+] 正在解析 $LogFile 记录: 601
[+] 正在关闭卷
</td></tr>
<tr><td>logfile.csv 示例</td></tr>
<tr><td><pre>LSN,ClientPreviousLSN,UndoNextLSN,ClientID,RecordType,TransactionID,RedoOperation,UndoOperation,MFTClusterIndex,TargetVCN,TargetLCN
5269000,5268967,5268967,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269019,5269000,5269000,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269044,5269019,5269019,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269063,5269044,5269044,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269082,5269063,5269063,0,1,24,UpdateNonresidentValue,Noop,0,0,37594
5269103,5269082,5269082,0,1,24,SetNewAttributeSizes,SetNewAttributeSizes,2,10,43700
5269122,5269103,0,0,1,24,ForgetTransaction,CompensationLogRecord,0,0,18446744073709551615
5269133,0,0,0,1,24,UpdateResidentValue,UpdateResidentValue,2,13,43703</pre>
</td></tr>
</table>
### USN 分析
<table>
<tr><td>从转储：usn.analyze from=usn_dump rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr></tr>
<tr><td>从运行中的系统：usn.analyze disk=4 volume=1 rules=d:\rules.json output=d:\usn_analyze_results.csv format=csv</td></tr>
<tr><td>
[+] 正在从以下位置加载规则：d:\rules.json
[-] 已加载 4 条规则
[+] 正在创建 d:\usn_analyze_results.csv
[-] 模式：快速
[+] 正在打开 \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[+] 正在搜索 $Extend\$UsnJrnl
[-] 在文件记录中找到：116
[-] $J 流大小：31.70 KiB（可能为稀疏）
[+] 正在处理 USN 记录：192（31.70 KiB）- 9 个匹配项
[+] 正在关闭卷
[+] 摘要：
+------------------------------------------------------+
| 索引 | 类别 | 值 | % |
+------------------------------------------------------+
| 0 | 文件创建 | 125 | 65.10 |
| 1 | 文件删除 | 0 | 0.00 |
| 2 | 文件重命名 | 8 | 4.17 |
| 3 | 最新 | 2022-03-28 23:23:12 | |
| 4 | 最旧 | 2022-03-28 13:20:08 | |
| 5 | 记录数 | 192 | 100.00 |
+------------------------------------------------------+
[+] 规则结果：
+------------------------------------------+
| 索引 | 规则 ID | 计数 | % |
+------------------------------------------+
| 0 | executable-create | 9 | 4.69 |
| 1 | ccleaner | 2 | 1.04 |
| 2 | lsass-dump | 1 | 0.52 |
+------------------------------------------+
</td></tr>
</table>
### USN 转储
<table>
<tr><td>usn.dump disk=4 volume=1 output=usn.csv format=csv</td></tr>
<tr><td>[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Finding $Extend\$UsnJrnl record
[+] Found in file record: 88008
[+] $J stream size: 60.24 GiBs (could be sparse)
[+] Creating d:\mft_c.csv
[+] Loading $MFT records
[+] Processing $MFT records: 1.37 GiB
[+] 1436928 record loaded
[+] Processing entry: 322667 (34.12 MiBs)
[+] Closing volume
</td></tr>
<tr><td>usn.csv 示例</td></tr>
<tr><td><pre>MajorVersion,MinorVersion,FileReferenceNumber,FileReferenceSequenceNumber,ParentFileReferenceNumber,ParentFileReferenceSequenceNumber,Usn,Timestamp,Reason,SourceInfo,SecurityId,FileAttributes,Filename
2,0,53,4,5,5,0,2020-02-26 21:43:36,FILE_CREATE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,96,2020-02-26 21:43:36,FILE_CREATE+CLOSE,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,192,2020-02-26 21:43:38,RENAME_OLD_NAME,0,0,DIRECTORY,volume:\Nouveau dossier
2,0,53,4,5,5,288,2020-02-26 21:43:38,RENAME_NEW_NAME,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,360,2020-02-26 21:43:38,RENAME_NEW_NAME+CLOSE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,432,2020-02-26 21:43:39,OBJECT_ID_CHANGE,0,0,DIRECTORY,volume:\test
2,0,53,4,5,5,504,2020-02-26 21:43:39,OBJECT_ID_CHANGE+CLOSE,0,0,DIRECTORY,volume:\test
2,0,54,2,53,4,576,2020-02-26 21:43:41,FILE_CREATE,0,0,ARCHIVE,volume:\test\Nouveau document texte.txt</pre>
</td></tr>
</table>
### 卷影副本
<table>
<tr><td>shadow disk=0 volume=4</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] VSS header found at 0x1e00
+---------------------------------------------------------------------------------------------------------------+
| SetID/ID | Count | Date | Details |
+---------------------------------------------------------------------------------------------------------------+
| {857c9ac4-ee4f-4bc6-b822-59e935a7120f} | 1 | 2020-09-21 00:15:38 | Service Machine : WORK-PC10 |
| | | | Originating Machine: WORK-PC10 |
| {3d102db1-8de2-4e7d-8ba5-e0dd4f67740d} | | | State : Created |
| | | | Flags : 0x0042000d |
| | | | - Persistent |
| | | | - Client Accessible |
| | | | - No Auto Release |
| | | | - Differential |
| | | | - Auto Recover |
+---------------------------------------------------------------------------------------------------------------+
| {83bc8af4-8802-4466-ae38-717f6474616a} | 1 | 2020-09-22 06:10:00 | Service Machine : WORK-PC10 |
| | | | Originating Machine: WORK-PC10 |
| {e668c329-66a2-4ebd-beef-3c6bca81cbf7} | | | State : Created |
| | | | Flags : 0x0042000d |
| | | | - Persistent |
| | | | - Client Accessible |
| | | | - No Auto Release |
| | | | - Differential |
| | | | - Auto Recover |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>
### 数据流
<table>
<tr><td>streams disk=0 volume=4 from=c:\test.pdf</td></tr>
<tr><td>
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Source : c:\test.pdf
[-] Record Num : 13525 (000034d5h)
[+] Alternate data stream(s):
+-----------------------------+
| Id | Name | Size |
+-----------------------------+
| 0 | Zone.Identifier | 27 |
+-----------------------------+
</td></tr>
</table>
### 恢复删除
<table>
<tr><td>undelete disk=4 volume=1</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading $MFT record
[+] $MFT size : 256.00 KiBs (~256 records)
[+] Reading $BITMAP record
[+] $BITMAP size : 16.00 KiBs
[+] Searching deleted files
[+] Processed data size : 262144 (100%)
[+] Duration : 7ms
找到的已删除文件
-------------------
+---------------------------------------------------------------------------------------------------------------+
| Id | MFT Index | Flag | Filename | Size | Deletion Date | % Recoverable |
+---------------------------------------------------------------------------------------------------------------+
| 0 | 00000029 | | .\$RECYCLE.BIN\[...]\$RAV85W4.jpg | 5.10 KiBs | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
| 1 | 00000035 | | .\$RECYCLE.BIN\[...]\$IAV85W4.jpg | 58.00 bytes | 2020-02-26 21:29:03 | 100.00 |
+---------------------------------------------------------------------------------------------------------------+
</td></tr>
<tr><td>undelete disk=2 volume=1 format=csv output=mydeletedfiles.csv</td></tr>
<tr><td>
[+] Opening \\?\Volume{498eed94-0000-0000-007e-000000000000}\
[-] $MFT size :34.00 MiBs (~34816 records)
[-] $BITMAP size :14.32 MiBs
[+] Searching deleted files
[-] Processed data: 35651584 (100%)
[-] Duration : 425ms
[+] Deleted files : 127
[+] Writing results to mydeletedfiles.csv (csv) file
[+] Done
</td></tr>
<tr><td>undelete disk=4 volume=1 inode=41 output=restored_kitten.jpg</td></tr>
<tr><td>
[+] Opening \\?\Volume{00000001-0000-0000-0000-000000000000}\
[+] Reading file record : 41
[+] Extracting $RAV85W4.jpg to restored_kitten.jpg
[+] 5219 bytes written
</td></tr>
</table>
### 命令行
<table>
<tr><td>shell disk=4 volume=1</td></tr>
<tr><td>
disk4:volume1:> ls
Inode | Type | Name | Size | Creation Date | Attributes
---------------------------------------------------------------------------------------
4 | | $AttrDef | 2560 | 2020-02-26 16:35:29 | Hi Sy
8 | | $BadClus | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Bad | 536866816 | |
6 | | $Bitmap | 16384 | 2020-02-26 16:35:29 | Hi Sy
7 | | $Boot | 8192 | 2020-02-26 16:35:29 | Hi Sy
11 | DIR | $Extend | | 2020-02-26 16:35:29 | Hi Sy
2 | | $LogFile | 4341760 | 2020-02-26 16:35:29 | Hi Sy
0 | | $MFT | 262144 | 2020-02-26 16:35:29 | Hi Sy
1 | | $MFTMirr | 4096 | 2020-02-26 16:35:29 | Hi Sy
50 | DIR | $RECYCLE.BIN | | 2020-02-26 16:40:34 | Hi Sy
9 | | $Secure | 0 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $SDS | 264200 | |
10 | | $UpCase | 131072 | 2020-02-26 16:35:29 | Hi Sy
| ADS | $Info | 32 | |
3 | | $Volume | 0 | 2020-02-26 16:35:29 | Hi Sy
5 | DIR | . | | 2020-02-26 16:35:29 | Hi Sy
85010 | | 7z1900-x64.exe | 1447178 | 2020-07-29 17:19:49 | Ar
| ADS | Zone.Identifier | 123 | |
42 | | hello.txt | 5 | 2020-02-26 21:27:33 | Ar
39 | | kitten1.jpg | 23486 | 2020-02-26 16:37:23 | Ar
| ADS | Zone.Identifier | 154 | |
40 | | kitten2.jpg | 79678 | 2020-02-26 16:37:55 | Ar
| ADS | Zone.Identifier | 303 | |
41 | | kitten3.jpg | 5219 | 2020-02-26 16:38:16 | Ar
| ADS | Zone.Identifier | 262 | |
36 | DIR | System Volume Information | | 2020-02-26 16:35:29 | Hi Sy
disk4:volume1:> pwd
\
disk4:volume1:> cat hello.txt
Hey !
disk4:volume1:> cat 7z1900-x64.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://www.7-zip.org/download.html
HostUrl=https://www.7-zip.org/a/7z1900-x64.exe
disk4:volume1:> cp kitten3.jpg z:\custestkitten.jpg
1 file copied
disk4:volume1:> exit
</td></tr>
</table>
### SMART
<table>
<tr><td>smart disk=1</td></tr>
<tr><td>
Version : 1 revision 1
Type : SATA/IDE Master on primary channel
Capabilities : ATA, ATAPI, S.M.A.R.T
Status : Passed
-- Device ID
+---------------------------------------------------------------------------------------------------+
| Property | Value |
+---------------------------------------------------------------------------------------------------+
| General Configuration | 0040h |
| Number of Cylinders | 16383 |
| Reserved | c837h |
| Number Of Heads | 16 |
| Bytes Per Track | 0 |
| Bytes Per Sector | 0 |
| Sectors Per Track | 63 |
| Vendor Unique | |
| Seria Number | S2RBNX0H606448W |
| Buffer Type | 0 |
| Buffer Size | 0 |
| ECC Size | 0 |
| Firmware Revision | EMT02B6Q |
| Model Number | Samsung SSD 850 EVO 500GB |
| Maximum Number of Sectors On R/W | 32769 |
| Double Word IO | 16385 |
| Capabilities | Reserved : 0000h |
| | DMA Support : True |
| | LBA Support : True |
| | DisIORDY : True |
| | IORDY : True |
| | Requires ATA soft start : False |
| | Overlap Operation support: True |
| | Command Queue Support : False |
| | Interleaved DMA Support : False |
| Reserved1 | 4000h |
| PIO Timing | 512 |
| DMA Timing | 512 |
| Field Validity | CHS Number : True |
| | Cycle Number : True |
| | Ultra DMA : True |
| Current numbers of cylinders | 16383 |
| Current numbers of heads | 16 |
| Current numbers of sectors per track | 63 |
| Multiple Sector Setting | 16514064 |
| Total Number of Sectors Addressable (LBA) | 268435455 |
| Singleword DMA Transfer Support | 0 |
| Multiword DMA Transfer Support | Mode 0 (4.17Mb/s) |
| | Mode 1 (13.3Mb/s) |
| | Mode 2 (16.7Mb/s) |
| Advanced PIO Modes | 0003h |
| Minimum Multiword DMA Transfer Cycle Time per Word | 120 |
| Recommended Multiword DMA Transfer Cycle Time per Word | 120 |
| Minimum PIO Transfer Cycle Time (No Flow Control) | 120 |
| Minimum PIO Transfer Cycle Time (Flow Control) | 120 |
| ATA Support | ATA-2 |
| | ATA-3 |
| | ATA-4 |
| | ATA/ATAPI-5 |
| | ATA/ATAPI-6 |
| | ATA/ATAPI-7 |
| | ATA/ATAPI-8 |
| | ATA/ATAPI-9 |
| Ultra DMA Transfer Support | Mode 0 (16.7MB/s) |
| | Mode 1 (25.0MB/s) |
| | Mode 2 (33.3MB/s) |
| | Mode 3 (44.4MB/s) |
| | Mode 4 (66.7MB/s) |
| | Mode 5 (100.0MB/s) (selected) |
| | Mode 6 (133.0MB/s) |
+---------------------------------------------------------------------------------------------------+
-- Attributes
+-------------------------------------------------------------------------------------------------------------------+
| Index | Name | Flags | Raw | Value | Worst | Threshold | Status |
+-------------------------------------------------------------------------------------------------------------------+
| 05h | Reallocated Sector Count | 0033h | 000000000000h | 100 | 100 | 10 | Ok |
| 09h | Power-On Hours Count | 0032h | 000000008d54h | 92 | 92 | 0 | Ok |
| 0ch | Power Cycle Count | 0032h | 0000000000f5h | 99 | 99 | 0 | Ok |
| b1h | Wear Range Delta | 0013h | 00000000005eh | 95 | 95 | 0 | Ok |
| b3h | Used Reserved Block Count (Total) | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| b5h | Program Fail Count Total | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b6h | Erase Fail Count | 0032h | 000000000000h | 100 | 100 | 10 | Ok |
| b7h | Sata Down Shift Error Count | 0013h | 000000000000h | 100 | 100 | 10 | Ok |
| bbh | Reported Uncorrectable Errors | 0032h | 000000000000h | 100 | 100 | 0 | Ok |
| beh | Temperature Difference From 100 | 0032h | 000000000020h | 68 | 50 | 0 | Ok |
| c3h | Hardware Ecc Recovered | 001ah | 000000000000h | 200 | 200 | 0 | Ok |
| c7h | Udma Crc Error Rate | 003eh | 000000000000h | 100 | 100 | 0 | Ok |
| ebh | Good Block Count And System Free Block Count | 0012h | 000000000071h | 99 | 99 | 0 | Ok |
| f1h | Lifetime Writes From Host Gib | 0032h | 00154bf298c9h | 99 | 99 | 0 | Ok |
+-------------------------------------------------------------------------------------------------------------------+
</td></tr>
</table>