Monday, February 21, 2011

EnCase EnScript to export MFT slack

During a recent EnScript training class, a student asked about how to programmatically export MFT slack, that is, the data that may exist between the end of a logical MFT record and the end of the physical MFT record. A typical MFT record can be anywhere between 400 to 700 bytes in length, but the MFT allocates 1024 bytes for each record. This can cause data to be left from previous records, the same way data remains in file slack at the end of a cluster.

I wrote this EnScript during the class to demonstrate some of the fundamental programming principles and decided I would post it in case someone has a need for it.

This EnScript will process every MFT found in the case. The EnScript only exports data in the MFT record slack area with an ASCII value between 0x20 (space)  and  0x7E (tilde). A folder is created in the case default export folder named "MFT Slack" and a file with a record number is created for every MFT record that contains slack. The reason this method was used, was so if you review the exported data and find something of interest, you can quickly map it back to the exact MFT record where it came from. If a MFT record has no data in slack, then no export file is created for that record.

Download here


Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles