# Metafiles, MFT, Journaling, ADS

#### 1. Key Concepts & Definitions

1. **Metafiles (NTFS metadata files)**
   * In NTFS, several "special" metafiles store file system metadata: e.g., `$MFT` (Master File Table), `$LogFile`, `$UsnJrnl`, `$Bitmap`, etc.
   * These metafiles are themselves stored as MFT entries and are critical for understanding the structure, history, and changes on an NTFS volume. 
2. **MFT (Master File Table)**
   * The **MFT** is the core metadata structure in NTFS: each file or directory corresponds to an MFT record.
   * Each MFT record contains a set of *attributes*, such as: `$STANDARD_INFORMATION` (timestamps), `$FILE_NAME`, `$DATA` (the file’s content), and possibly others. 
   * Attributes can be *resident* (stored inside the MFT record) or *non-resident* (stored elsewhere on disk, referenced by data runs). 
3. **NTFS Journaling**
   * **$LogFile**: NTFS maintains a journal for metadata changes. Before critical metadata changes are committed, they’re first written to `$LogFile`. This helps preserve consistency in case of crashes. 
   * **USN Journal (`$UsnJrnl`)**: Tracks changes to file system objects (create, delete, modify). It is often used in forensic analysis to reconstruct file activity. 
4. **Alternate Data Streams (ADS)**
   * ADS is an NTFS feature that allows a file to have multiple data streams. The default (unnamed) stream is usually `:$DATA`, but additional named streams can exist. 
   * These streams are not visible in regular Explorer listings, and their size is not reflected in the standard file size shown to the user. 
   * ADS can be used for legitimate metadata storage, but malicious actors may hide data (scripts, malware) in ADS. 

***

#### 2. Forensic Value & Use Cases

* **Hidden Data & Steganography**: ADS provides a covert storage channel. Investigators must check for ADS to uncover hidden payloads or evidence. 
* **File Timeline & Recovery**:
  * The MFT provides creation, modification, and metadata timestamps, which are essential for timeline reconstruction. 
  * The USN Journal (`$UsnJrnl`) helps detect operations (file creation / deletion / modification) even if the file is deleted. 
* **Crash / Anti-Forensics Investigation**: The `$LogFile` journal can be used to detect incomplete operations or metadata rollback (e.g., due to system crash). 
* **Metadata Anomalies**: By analyzing MFT attributes, you can detect anomalies like mismatched timestamps, strange attribute usage, or suspicious attribute counts (e.g., many `$DATA` attributes in one record).

***

#### 3. Forensic Analysis Techniques & Tools

1. **MFT Analysis**
   * Use tools like **MFTECmd** (Eric Zimmerman) to parse the MFT and extract attribute-level data like `$STANDARD_INFORMATION`, `$FILE_NAME`, `$DATA`, etc. 
   * Manually review MFT records: identify resident vs non-resident attributes, timestamps, and metadata flags.
   * Look for zombie (deleted) MFT records to recover information about deleted files.
2. **Journal Parsing / Replay**
   * Parse `$LogFile` to reconstruct metadata modification transactions. Because `$LogFile` is a transactional journal, it can help you understand what metadata changes (e.g., file renames, attribute changes) happened.
   * Use `$UsnJrnl` to build a record of file system changes (create, delete, modify). This is particularly useful for timeline reconstruction during investigations.
3. **Alternate Data Streams (ADS) Analysis**
   * Enumerate ADS on files using tools: built-in Windows APIs (`FindFirstStreamW` / `FindNextStreamW`), or forensic tools like **ADS Examiner**. 
   * Read the content of named streams and analyze it: sometimes ADS contain executables, scripts, or other hidden data.
   * If a file is deleted, its ADS streams may persist in the MFT record. ADS Examiner (or similar) can help locate ADS even for deleted files. 
4. **Journaling Forensics**
   * Use ESE-based tools or specialized parsers to interpret `$UsnJrnl` entries.
   * Reconstruct a timeline of file creations, modifications, and deletions.
   * Cross-correlate journal entries with MFT and log file data to validate sequence of events and detect anomalies (e.g., metadata changes that were not “committed” cleanly).

***

#### 4. Workflow for Forensic Investigation

Here’s a suggested workflow when investigating NTFS volume with interest in metafiles, MFT, journaling, and ADS:

1. **Image Acquisition**
   * Capture a forensic image of the volume (bit-by-bit) to preserve all metadata, MFT, journal files, and ADS data.
   * Compute hashes for integrity.
2. **Initial Parsing**
   * Parse the MFT using a tool like MFTECmd to extract the list of all files, their attributes, timestamps, and any additional data streams.
   * Export output to a CSV or timeline viewer.
3. **Journal Analysis**
   * Extract and parse `$UsnJrnl` to list all file system events (create / delete / rename / modify).
   * Parse `$LogFile` (if feasible) to understand internal NTFS metadata operations (redo/undo records).
4. **ADS Enumeration & Extraction**
   * Use ADS enumeration tools (or custom scripts) to find all ADS on the volume.
   * Extract the content of each ADS; analyze it (strings, file headers, binary content) to see if it contains malicious or suspicious data.
5. **Timeline & Correlation**
   * Build a timeline combining MFT (file metadata), USN Journal (changes), and ADS activity.
   * Correlate with other artifacts: event logs, registry, prefetch, etc., to contextualize hidden data and file system activity.
6. **Anomaly Detection**
   * Look for:
     * MFT record with many `$DATA` streams.
     * ADS with executable content.
     * Journal entries (USN) showing creation or deletion of metadata without corresponding MFT record changes.
     * Metadata timestamp inconsistencies (e.g., MFT `MFT Changed` vs `Modified`).
7. **Reporting**
   * Document all found ADS, their parent files, and content.
   * Provide a timeline of metadata changes and suspicious activity.
   * Highlight any evidence of data hiding (e.g., via ADS), anti-forensic behavior (e.g., abnormal journal entries), or suspicious file system usage.