Title: 3. Examining NTFS Disks
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Examining NTFS Disks

1. New Technology File System (NTFS) was introduced with Windows NT and is the primary file system for Windows Vista.
2. Improvements over FAT file systems include:
  - NTFS provides more information about a file
  - With NTFS, you also have more control over files and folders
3. NTFS was Microsoft’s move toward a journaling file system.  In NTFS, everything written to the disk is considered a file.
4. NTFS disk, the first data set is the Partition Boot Sector.  Immediately after the Partition Boot Sector is the Master File Table (MFT).
5. NTFS results in much less file slack space.  Clusters are smaller for smaller disk drives.  See Table 6-3.
6. NTFS also uses Unicode, an international data format.

NTFS System Files

1. MFT contains information about all files on the disk, including the system files the OS uses. In the MFT, the first 15 records are reserved for system files.
2. Records in the MFT are referred to as metadata. See Table 6-4.

MFT and File Attributes

1. In the NTFS MFT, all files and folders are stored in separate records of 1024 bytes each.
2. Each record contains file or folder information.  This information is divided into record fields containing metadata.  A record field is referred to as an attribute ID. See Table 6-5.
3. File or folder information is typically stored in one of two ways in an MFT record: resident and nonresident.
4. Files larger than 512 bytes are stored outside the MFT.  An MFT record provides cluster addresses where the file is stored on the drive’s partition.  These addresses are referred to as data runs. Each MFT record starts with a header identifying it as a resident or nonresident attribute. See Figures 6-9 through 6-11.
5. When a disk is created as an NTFS file structure, the OS assigns logical clusters to the entire disk partition.  These assigned clusters are called logical cluster numbers (LCNs).  LCNs become the addresses that allow the MFT to link to nonresident files on the disk’s partition.

NTFS Data Streams

1. Data streams are ways data can be appended to existing files.  Data streams can obscure valuable evidentiary data, intentionally or by coincidence.
2. In NTFS, a data stream becomes an additional file attribute and allows the file to be associated with different applications.  You can only tell whether a file has a data stream attached by examining that file’s MFT entry.

NTFS Compressed Files

1. NTFS provides compression similar to FAT DriveSpace 3. Under NTFS, files, folders or entire volumes can be compressed.
2. Most computer forensics tools can uncompress and analyze compressed Windows data.

NTFS Encrypting File System (EFS)

1. Encrypting File System (EFS) was introduced with Windows 2000 and implements a public key and private key method of encrypting files, folders or disk volumes.
2. When EFS is used in Windows Vista Business Edition or higher, XP Professional or 2000, a recovery certificate is generated and sent to the local Windows administrator account.
3. Users can apply EFS to files stored on their local workstations or a remote server.

EFS Recovery Key Agent

1. The Recovery Key Agent implements the recovery certificate, which is in the Windows administrator account. Windows administrators can recover a key in two ways: through Windows or from an MS-DOS command prompt.
2. Windows administrators can recover a key using the following MS-DOS commands:
  - Cipher
  - Copy
  - Efsrecvr (used to decrypt EFS files)

Deleting NTFS Files

1. When a file is deleted in Windows XP, 2000 or NT, the OS renames it and moves it to the Recycle Bin.  Another method is using the Del (delete) MS-DOS command.  This method eliminates the file from the MFT listing in the same way FAT does.