After I posted on the lack of NTFS $FILE_NAME data provided by the major GUI forensic tools, there were several great comments left for that post that described a variety of tools from people like Harlan, David Kovar and Mark Menz. While these are great tools from three forensic gurus, I’m still a bit perplexed why the major GUI software tool makers don’t just deal with parsing this data head on.
I’ve had at least one person tell me that EnCase could do this with an EnScript. Of course, EnCase can do a lot of things with EnScripting. The rub is that I don’t want to use an EnScript for something that should be part of the standard GUI column view along with the $STANDARD_INFORMATION time stamp values. For example, I want to be able to quickly view the $FILE_NAME information for the files stored in particular folder or volume for timeline purposes. One of the primary reasons we use GUI forensic tools like EnCase and FTK is that they serve as overall file system examination tools. We can use them to examine our evidence from a high level and then decide which of the more specialized tools we wish to employ to drill down on specific artifacts.
I don’t expect EnCase or FTK to do everything for me. That’s why we have people like Craig Wilson, Rob Lee, Harlan Carvey, Mark McKinnon, Lee Whitfield, Paul Sanderson, Kristin Gudjonsson and all of the rest of the fantastic forensic tool developers out there who make great tools for specific purposes that compliment the major GUI tools. However, I do expect them to parse basic $MFT record information which includes $FILE_NAME time stamps.
Since I made my original post, I discovered that the fine people over at Technology Pathways are doing this at least with a free version of their Pro Discover tool. Pro Discover Basic is a very basic GUI forensic tool, but it does what every major GUI tool should do which is to parse both the $STANDARD_INFORMATION and $FILE_NAME time stamps in glorious column form.
EnCase doesn’t do this at all. FTK is sort of…kind of…starting to move in this direction. If you look in the comments section of my previous post on this issue, you’ll see that a couple Access Data engineers were nice enough to drop by and explain that FTK 3.1 parses this data….sometimes. I say “sometimes” because it doesn’t do it as part of the normal column view and it reportedly only shows the data to the examiner if the $FILE_NAME values are different form the $STANDARD_INFORMATION values. I have no idea why Access Data is making it this complex. I absolutely do not want this level of hand holding from my forensic tools. I want to be able to see for myself what the time stamp values are for a given file. Concealing basic time stamp information from me because they think it’s…I guess…not important isn’t helpful.
If the Guidance Software and Access Data think that having the extra $FILE_NAME columns in their standard GUI file system view would somehow confuse the examiner or clutter the interface, then they can make them turned off by default and require the examiner to “opt in” to see them.
What am I missing here?
Forensic 4cast Awards
The Forensic 4cast awards are upon us! If you haven’t voted yet, you still have time before the awards presentation at the SANS Forensics and Incident Response Summit on July 8th. You can also attend the award ceremony for free even if you aren’t attending the summit. Lastly, the fine people over at Disk Labs have sponsored the actual awards which are pretty amazing looking.
