MFTparser.EnScript

include "GSI_Basic"
include "GSI_LogLib"


class MyDialog: DialogClass  {

// Variables go here

  String           BookmarkFolderName,
                   Desc;

  ButtonClass      _Help;
  StringEditClass  _bookmarkFolderName;

  MyDialog():

    // Object placement goes here

    Desc( "MFT Parser\n\n"
          "This EnScript will parse MFT records from files chosen in the case. An Encase search function is performed to find all MFT signatures (“FILE”)"
          " then validate and sort the records into four categories. These categories include Complete MFT record, Partially Parsed MFT record, Cannot Parse (Unable"
          " to Parse but valid header properties), and Not a MFT record.\n\n"

          "Complete MFT Record\n\n"
          "This category’s function is fully parsing the following attributes:\n"
          "•	Standard Information\n"
          "•	File Name\n"
          "•	Object ID\n"
          "•	Volume Name\n"
          "•	Volume Information\n"
          "•	Data – this attribute is shown in ANSI string format\n"
          "•	Index Root\n"
          "•	Index allocation – only the non-resident attribute information\n"
          "•	Reparse Point\n"
          "**All other Attributes are ignored.\n\n"
          "These fully parsed records are imported into the EnCase “Records” Tab were the user must choose Local fields to view all columns of information.\n\n"

          "Partially Parsed MFT Record\n\n"
          "This category’s function will parse only the MFT header and the first valid timestamp."
          "Because the header cannot be correctly parsed, the common offsets for the header one time stamp will "
          "be extracted from the data.\n\n"

          "Cannot Parse\n\n"
          "This category’s function will take any MFT record that does not contain any valid information"
          " in the header and bookmark up to 1024 bytes.\n\n"

          "Not a MFT record\n\n"
          "This category’s function will ignore false positives that the encase search function finds.\n\n"

          "Tested on Encase v6.18\n"
 // Help dialogue text
         );


    DialogClass(null, "MFT Record Search and Parser"),
    _Help(this, "Help", START, START, DEFAULT, DEFAULT, 0),
    _bookmarkFolderName(this, "Bookmark folder name", START, NEXT, 150, DEFAULT, 0, BookmarkFolderName, 150, 0)

{
}

// help button
  virtual void ChildEvent(const EventClass &event) {
  //  Happens when something changes in the dialog (Incl. focus)
    if (_Help.Matches(event))
      SystemClass::Message(SystemClass::MBOK, "Help", Desc);
    DialogClass::ChildEvent(event);
  }

  virtual bool CanClose()  {
    return true;
  }
}
//------------------------------------------------------

class MFT_HeaderClass {
String Signature;            // 4 bytes
  uint Offset_Fixup_Array,   // 2
       Entries_inUpdate_Seq; // 2
 ulong LogFile_Seq_Num;      // 8
  ulong Inc_Seq_Count,       // 2
       Link_Count,           // 2
       Offset_1st_Attr,      // 2
       Alloc_Stat,           // 2
       Log_MFT_Size,         // 4
       Phys_MFT_Size;        // 4
 ulong File_Reference;       // 8
 ulong Attr_count,           // 2
       Fixup_code_attr,      // 2
       MFT_record_num,       // 4 (NTFS 3.1 and greater)
       Fixup_code_value;     // 2
  bool NFTS_3X_greater;      // is NTFS 3.0 and greater
String Alloc_flag;           // string for flags
// functions
  void Read(EntryFileClass &file, long startposition){
     NFTS_3X_greater = false; // initialize

     //begin parsing
     file.Seek(startposition);

     file.ReadString(Signature, 4);
     Offset_Fixup_Array  = file.ReadBinaryInt(2,0);
     Entries_inUpdate_Seq = file.ReadBinaryInt(2,0);
     LogFile_Seq_Num = file.ReadBinaryInt(8,0);
     Inc_Seq_Count = file.ReadBinaryInt(2,0);
     Link_Count = file.ReadBinaryInt(2,0);
     Offset_1st_Attr = file.ReadBinaryInt(2,0);

     //check for NTFS type
     if (Offset_1st_Attr == 48)
        NFTS_3X_greater = false;
     else
        NFTS_3X_greater = true;

     Alloc_Stat = file.ReadBinaryInt(2,0);
     Alloc_flag = GetFlags(Alloc_Stat);

     Log_MFT_Size = file.ReadBinaryInt(4,0);
     Phys_MFT_Size = file.ReadBinaryInt(4,0);
     File_Reference = file.ReadBinaryInt(8,0);
     if (Offset_Fixup_Array == 40 && !NFTS_3X_greater){ // NTFS 3.0 and earlier
        Fixup_code_attr = file.ReadBinaryInt(2,0);
        file.Skip(2);
     }
     else if (Offset_Fixup_Array == 42){
        Attr_count = file.ReadBinaryInt(2,0);
        Fixup_code_attr = file.ReadBinaryInt(2,0);
     }
     else if (NFTS_3X_greater){
        Attr_count = file.ReadBinaryInt(2,0);
        Fixup_code_attr = file.ReadBinaryInt(2,0);
        MFT_record_num = file.ReadBinaryInt(4,0);// (NTFS 3.1 and greater)
        Fixup_code_value = file.ReadBinaryInt(2,0);
     }
     file.Seek(startposition+Offset_1st_Attr); // goto first attribute
  }
  String GetFlags(long val){
     String flag;
     switch(val){
        case 0: flag = "Deleted"; break;
        case 1: flag = "Allocated File"; break;
        case 2: flag = "Allocated Directory"; break;
        case 4: flag = " "; //no info
        case 8: flag = " "; //no info
        default: flag = " "; break;
     }
     return flag;
  }
  void Record(DataPropertyClass &record){
     record.NewDataPropertyType("Offset to Fixup Array", DataPropertyClass::LONG, Offset_Fixup_Array);
     record.NewDataPropertyType("Entries in Fixup Array", DataPropertyClass::LONG, Entries_inUpdate_Seq);
     record.NewDataPropertyType("$LogFile Sequence Number", DataPropertyClass::LONG, LogFile_Seq_Num);
     record.NewDataPropertyType("Incremental Sequence Count", DataPropertyClass::LONG,Inc_Seq_Count);
     record.NewDataPropertyType("Link Count", DataPropertyClass::LONG, Link_Count);
     record.NewDataPropertyType("Offset to First Attribute", DataPropertyClass::LONG, Offset_1st_Attr);
     record.NewDataPropertyType("Allocation Status", DataPropertyClass::STRING, Alloc_flag);
     record.NewDataPropertyType("Logical Record Size", DataPropertyClass::LONG, Log_MFT_Size);
     record.NewDataPropertyType("Physical Record Size", DataPropertyClass::LONG,Phys_MFT_Size);
     record.NewDataPropertyType("File Reference to Base Record", DataPropertyClass::LONG, File_Reference);
     record.NewDataPropertyType("Attribute Count", DataPropertyClass::LONG, Attr_count);
     record.NewDataPropertyType("Fixup Codes & Attributes", DataPropertyClass::LONG, Fixup_code_attr);
     record.NewDataPropertyType("Record Number", DataPropertyClass::LONG, MFT_record_num);
     record.NewDataPropertyType("Fixup Code", DataPropertyClass::LONG, Fixup_code_value);
  }
}
//------------------------------------------------------

class Attribute_HeaderClass {
  uint Attr_TypeID;      // 4 bytes
 ulong Attr_Size;        // 4
  uint Res_nonRes_Flag;  // 1
 ulong StreamName_Size,  // 1
       SteamName_Offset, // 2
       C_S_E_Flag;       // 2
  uint Attr_ID;          // 2
// if Resident Attribute
 ulong Content_Size,     // 4
       Content_Offset;   // 2
// if Non-Resident Attribute
 ulong VCN_start,        // 8
       VCN_end;          // 8
  uint Runlist_Offset,   // 2
       Compress_Use,     // 2
       Unused;           // 4
 ulong Alloc_Size,       // 8
       Actual_size,      // 8
       Inital_Size;      // 8
 ulong ContiguousClusters, // bytes?
       StartExtentCluster; // bytes?
 String Runlist_S; // bytes?


// functions
  void Read(EntryFileClass &file, long AttrPos){
     file.Seek(AttrPos);
     Attr_TypeID = file.ReadBinaryInt(4,0);
     Attr_Size = file.ReadBinaryInt(4,0);
     if(Attr_Size != 0){
        Res_nonRes_Flag = file.ReadBinaryInt(1,0);
        StreamName_Size = file.ReadBinaryInt(1,0);
        SteamName_Offset = file.ReadBinaryInt(2,0);
        C_S_E_Flag = file.ReadBinaryInt(2,0);
        Attr_ID = file.ReadBinaryInt(2,0);
        if (Res_nonRes_Flag == 0){ // resident attribute
           int currentpos = file.GetPos();
           Content_Size = file.ReadBinaryInt(4,0);
           Content_Offset = file.ReadBinaryInt(2,0);
           file.Seek(AttrPos+Content_Offset); // go to offset
           int begofcontent = file.GetPos();
           Content_Size = Content_Size - (begofcontent-currentpos);
        }
        else if (Res_nonRes_Flag == 1){ // non-resident attribute
           VCN_start = file.ReadBinaryInt(8,0);
           VCN_end = file.ReadBinaryInt(8,0);
           Runlist_Offset = file.ReadBinaryInt(2,0);
           Compress_Use = file.ReadBinaryInt(2,0);
           Unused = file.ReadBinaryInt(4,0);
           Alloc_Size = file.ReadBinaryInt(8,0);
           Actual_size = file.ReadBinaryInt(8,0);
           Inital_Size = file.ReadBinaryInt(8,0);
           file.Seek(AttrPos+Runlist_Offset);
           bool isRunlistEnd = false;

           while(!isRunlistEnd && file.GetPos() < AttrPos+Attr_Size){
             uint ByteToNibble = file.ReadBinaryInt(1,0);  // Read starting byte
             uint HiNibble = ((ByteToNibble >> 4) & 0x0f);
             uint LowNibble = ((ByteToNibble) & 0x0f);
             if (ByteToNibble == 0)
                isRunlistEnd = true;
             else {
                ContiguousClusters = file.ReadBinaryInt(LowNibble,0);
                StartExtentCluster = file.ReadBinaryInt(HiNibble,0);
                Runlist_S += "CL: " +ContiguousClusters + " EC: " +StartExtentCluster+"; ";
             }
           }
           file.Seek(AttrPos+Attr_Size);
       }
       else
          file.Seek(AttrPos+Attr_Size);
     }
  }
  void RecordNonResData(DataPropertyClass &record, String AttrTypeID){
    record.NewDataPropertyType(AttrTypeID +"-Physical File Size", DataPropertyClass::LONG, Alloc_Size);
    record.NewDataPropertyType(AttrTypeID +"-Logical File Size", DataPropertyClass::LONG, Actual_size);
    record.NewDataPropertyType(AttrTypeID +"-Number of Contiguous Clusters and Starting Extent Cluster", DataPropertyClass::STRING, Runlist_S);

  }
}
//------------------------------------------------------

class Standard_InfoClass {
   DateClass Create_Time,    // 8 bytes
             Modify_Time,    // 8
             MFT_Mod_Time,   // 8
             LastAcess_Time; // 8
       ulong FileType_Flag,  // 4
             Max_version,    // 4
             VersionNum,     // 4
             Class_ID,       // 4
             Owner_ID,       // 4 (v3.0<)
             Security_ID,    // 4 (v3.0<)
             Quota_Charged,  // 4 (v3.0<(
             Update_Seq_num; // 8

      String Update_Seq_num_S;// 8

   void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
      file.Seek(beginOfContent);
      file.ReadWinDate(Create_Time);   // 8 bytes
      file.ReadWinDate(Modify_Time);   // 8 bytes
      file.ReadWinDate(MFT_Mod_Time);  // 8 bytes
      file.ReadWinDate(LastAcess_Time);// 8 bytes
      FileType_Flag = file.ReadBinaryInt(4,0);
      Max_version = file.ReadBinaryInt(4,0);
      VersionNum = file.ReadBinaryInt(4,0);
      Class_ID = file.ReadBinaryInt(4,0);
      Owner_ID = file.ReadBinaryInt(4,0);
      Security_ID = file.ReadBinaryInt(4,0);
      Quota_Charged = file.ReadBinaryInt(4,0);
      Update_Seq_num = file.ReadBinaryInt(8,0);
      Update_Seq_num_S = Update_Seq_num;
      file.Seek(beginOfContent+Content_Size); // end of content
   }
   void Record(DataPropertyClass &record){
     record.NewDataPropertyType("StandardInfo Created", DataPropertyClass::DATE,Create_Time);   // 8 bytes
     record.NewDataPropertyType("StandardInfo Modified", DataPropertyClass::DATE,Modify_Time);
     record.NewDataPropertyType("StandardInfo MFT Modified", DataPropertyClass::DATE,MFT_Mod_Time);
     record.NewDataPropertyType("StandardInfo Last Accessed", DataPropertyClass::DATE,LastAcess_Time);
     record.NewDataPropertyType("File Type Flag", DataPropertyClass::LONG, FileType_Flag);
     record.NewDataPropertyType("Max Number of Versions", DataPropertyClass::LONG, Max_version);
     record.NewDataPropertyType("Version Number", DataPropertyClass::LONG, VersionNum);
     record.NewDataPropertyType("Class ID", DataPropertyClass::LONG,Class_ID);
     record.NewDataPropertyType("Owner ID", DataPropertyClass::LONG,Owner_ID);
     record.NewDataPropertyType("Security ID", DataPropertyClass::LONG,Security_ID);
     record.NewDataPropertyType("Quota Charged", DataPropertyClass::LONG, Quota_Charged);
     record.NewDataPropertyType("Update Sequence Num", DataPropertyClass::STRING, Update_Seq_num_S);
  }

}
//------------------------------------------------------

class Object_IDClass{
   String Object_id;
   void Read(EntryFileClass &file, int beginOfContent, int Content_Size, bool NFTS_3X_greater){
     file.Seek(beginOfContent);
     if (NFTS_3X_greater){
        Object_id = TransHex(file,16,"", false);
     }
     file.Seek(beginOfContent+Content_Size);
   }
   String GetHex(int val, String delimiter){

        String b = String::FormatInt(val, int::BaseTypes base=int::HEX);
        int str_len = b.GetLength();
        if (str_len < 2)
           b = "0"+b;
        delimiter = delimiter + b;

     return delimiter;
   }

   String TransHex(EntryFileClass &file, int val, const String & delimiter, bool reverse){
     String Hex;
     for(int i=0; i<val;i++){
       int c = file.ReadBinaryInt(1);
       if(reverse==false)
          Hex+=GetHex(c, delimiter);
       else
          Hex = GetHex(c, delimiter) + Hex;
     }
     return Hex;
   }

}
//----------------------------------------------------
class File_NameClass{
      ulong MFT_Parent_Dir;      //  6 bytes
       uint SeqNum_Parent_Dir;   //  2
   DateClass File_Create_Time,   // 8
             File_Mod_Time,      // 8
             File_MFT_Time,      // 8
             File_LA_Time;       // 8
      ulong Alloc_Size_Index,    // 8
             Actual_Size_Index;  // 8
       ulong File_Type_Flags,    // 4
             Reparse_Value;      // 4
        uint Filename_Len,       // 1
             Filename_Type;      // 1
      String FileName_string,    // File Name
             FileType_Flags;     // 4

   void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
     file.Seek(beginOfContent);
     MFT_Parent_Dir = file.ReadBinaryInt(6,0);
     SeqNum_Parent_Dir = file.ReadBinaryInt(2,0);
     file.ReadWinDate(File_Create_Time);
     file.ReadWinDate(File_Mod_Time);
     file.ReadWinDate(File_MFT_Time);
     file.ReadWinDate(File_LA_Time);
     Alloc_Size_Index = file.ReadBinaryInt(8,0);
     Actual_Size_Index = file.ReadBinaryInt(8,0);
     File_Type_Flags = file.ReadBinaryInt(4,0);
     FileType_Flags = Map_Attribute(File_Type_Flags);
     Reparse_Value = file.ReadBinaryInt(4,0);
     Filename_Len = file.ReadBinaryInt(1,0);
     Filename_Type = file.ReadBinaryInt(1,0);
     file.SetCodePage(1200); // or 1200
     file.ReadString(FileName_string, Filename_Len);
     file.Seek(beginOfContent+Content_Size); // end of content
   }

   String Map_Attribute(long attr){
      String attr_s();
      attr_s = (attr & 0x00000001) ? "Read-Only " : "";
      attr_s += (attr & 0x00000002) ? "Hidden " : "";
      attr_s += (attr & 0x00000004) ? "System " : "";
      attr_s += (attr & 0x00000008) ? "! " : "";
      attr_s += (attr & 0x00000010) ? "Directory " : "";
      attr_s += (attr & 0x00000020) ? "Archive " : "";
      attr_s += (attr & 0x00000040) ? "Device " : "";
      attr_s += (attr & 0x00000080) ? "Normal " : "";
      attr_s += (attr & 0x00000100) ? "Temporary " : "";
      attr_s += (attr & 0x00000200) ? "SparseFile " : "";
      attr_s += (attr & 0x00000400) ? "ReparsePoint " : "";
      attr_s += (attr & 0x00000800) ? "Compressed " : "";
      attr_s += (attr & 0x00001000) ? "Offline " : "";
      attr_s += (attr & 0x00002000) ? "NotContentIndexed " : "";
      attr_s += (attr & 0x00004000) ? "Encrypted " : "";
      return attr_s;

   }
   void Record(DataPropertyClass &record){
      record.NewDataPropertyType("Parent Directory MFT#", DataPropertyClass::LONG, MFT_Parent_Dir);
      record.NewDataPropertyType("Parent Directory Sequence#", DataPropertyClass::LONG, SeqNum_Parent_Dir);  //  2
      record.NewDataPropertyType("FileName Created", DataPropertyClass::DATE,File_Create_Time);   // 8
      record.NewDataPropertyType("FileName Modified", DataPropertyClass::DATE,File_Mod_Time);      // 8
      record.NewDataPropertyType("FileName MFT Modified", DataPropertyClass::DATE,File_MFT_Time);      // 8
      record.NewDataPropertyType("FileName LastAccessed", DataPropertyClass::DATE,File_LA_Time);      // 8
      record.NewDataPropertyType("Physical File Size", DataPropertyClass::LONG, Alloc_Size_Index);   // 8
      record.NewDataPropertyType("Logical File Size", DataPropertyClass::LONG, Actual_Size_Index);  // 8
      record.NewDataPropertyType("Dos Attributes", DataPropertyClass::STRING, FileType_Flags);    // 4
      record.NewDataPropertyType("Reparse Value", DataPropertyClass::LONG, Reparse_Value);      // 4
      if (Filename_Type == 0)
        record.NewDataPropertyType("Posix FileName", DataPropertyClass::STRING, FileName_string);
      else if (Filename_Type == 1)
        record.NewDataPropertyType("Win32 FileName", DataPropertyClass::STRING, FileName_string);
      else if (Filename_Type == 2)
        record.NewDataPropertyType("DOS Short FileName", DataPropertyClass::STRING, FileName_string);
      else
        record.NewDataPropertyType("FileName", DataPropertyClass::STRING, FileName_string);    // File Name
   }
}
//----------------------------------------------------

class Data_Class{
 String DATA_string;
  void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
     file.Seek(beginOfContent);
     file.SetCodePage(20127);
     file.ReadString(DATA_string, Content_Size);
     file.SetCodePage(CodePageClass::ANSI);
     file.Seek(beginOfContent+Content_Size); // end of content
  }
}
//----------------------------------------------------
class Volume_NameClass{
    String Volume_Name;
    void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
       file.Seek(beginOfContent);
       file.SetCodePage(CodePageClass::UNICODE);
       file.ReadString(Volume_Name, Content_Size);
       file.SetCodePage(CodePageClass::ANSI);
       file.Seek(beginOfContent+Content_Size); // end of content
   }
}
//-------------------------------------------------------------
class Volume_InfoClass {
   //long NTFS_version_num, // 2
   //     Volume_Flag;      // 2
 String NTFS_version_num,   // 2
        Volume_Flag;        // 2

    void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
       file.Seek(beginOfContent);
       NTFS_version_num = TransHex(file, 2, " ", false);
       Volume_Flag = TransHex(file, 2, " ", false);
       //NTFS_version_num  = file.ReadBinaryInt(2,0);
       //Volume_Flag = file.ReadBinaryInt(2,0);
       file.Seek(beginOfContent+Content_Size); // end of content
   }
   String GetHex(int val, String delimiter){

        String b = String::FormatInt(val, int::BaseTypes base=int::HEX);
        int str_len = b.GetLength();
        if (str_len < 2)
           b = "0"+b;
        delimiter = delimiter + b;

     return delimiter;
   }

   String TransHex(EntryFileClass &file, int val, const String & delimiter, bool reverse){
     String Hex;
     for(int i=0; i<val;i++){
       int c = file.ReadBinaryInt(1);
       if(reverse==false)
          Hex+=GetHex(c, delimiter);
       else
          Hex = GetHex(c, delimiter) + Hex;
     }
     return Hex;
   }
}
//------------------------------------------------------
class Bitmap_AttritbuteClass{
   long Indexed_Flag;     // 1
                          // padding is 1 byte
 String Attribute_Name;   // 4
   long BinaryMap;        // 8

}
//------------------------------------------------------
class ReparsePointClass {
   long ReparsePointID;   // 4
   String ReparseName;    // variable
   void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
       file.Seek(beginOfContent);
       ReparsePointID = file.ReadBinaryInt(4,0);
       file.Skip(12);
       file.SetCodePage(CodePageClass::UNICODE);
       file.ReadString(ReparseName, (Content_Size-16));
       file.SetCodePage(CodePageClass::ANSI);
       file.Seek(beginOfContent+Content_Size); // end of content
   }
}
class Index_RootClass{
// Index Root Attribute

  long Attr_Type_Index,    // 4 bytes
       Coll_Sort_rule,     // 4
       IndexSize_bytes,    // 4
       IndexSize_clusters, // 1
       Unused_blank;       // 3

// Index Root Node Header

  ulong IndexEntry_offset,   // 4
       IndexUsedEntry_end,   // 4
       IndexAllocEntry_end,  // 4
       Child_flag,
       Node_int;             // 4
       String  Child_Nodes;

   void Read(EntryFileClass &file, int beginOfContent, int Content_Size){
       Attr_Type_Index = file.ReadBinaryInt(4,0);
       Coll_Sort_rule = file.ReadBinaryInt(4,0);
       IndexSize_bytes = file.ReadBinaryInt(4,0);
       IndexSize_clusters = file.ReadBinaryInt(1,0);
       Unused_blank = file.ReadBinaryInt(3,0);

       //begin node header
       ulong entrystartpos = file.GetPos();

       IndexEntry_offset = file.ReadBinaryInt(4,0);
       IndexUsedEntry_end = file.ReadBinaryInt(4,0);
       IndexAllocEntry_end = file.ReadBinaryInt(4,0);
       Child_flag = file.ReadBinaryInt(4,0);
       ulong nodestartpos = file.GetPos();

       //Index entries
       if (Child_flag == 1)
       {
         while(file.GetPos() < (entrystartpos+IndexAllocEntry_end)){
            ulong startofentry = file.GetPos();
            ulong ChildNodeMFT = file.ReadBinaryInt(4,0);
            Child_Nodes += ChildNodeMFT + ", ";
            file.Skip(4);
            ulong lengthofEntry = file.ReadBinaryInt(2,0);
            file.Seek(startofentry+lengthofEntry);
         }
         file.Seek(beginOfContent+Content_Size);
       }
       else
         file.Seek(beginOfContent+Content_Size); // end of content
   }
   void Record(DataPropertyClass &record){
      record.NewDataPropertyType("Size of Index Records", DataPropertyClass::LONG, IndexSize_bytes);
      if (Child_flag == 1)
      {
          record.NewDataPropertyType("Children Exist", DataPropertyClass::STRING, "Yes");
          record.NewDataPropertyType("Child Node MFT#s", DataPropertyClass::STRING, Child_Nodes);  //  2
      }
      else
         record.NewDataPropertyType("Children Exist", DataPropertyClass::STRING, "No");

   }

}
// Below is for future iterations
/*class IndexAllocationClass {
// Index Allocation

   int A_Attr_Type_Index, //  4 bytes
       A_Coll_Sort_rule, //  4
       A_IndexSize_bytes, //  4
       A_IndexSize_clusters, //  1
       A_Unused_blank; // 3

// Index Allocation Node Header

   int A_IndexEntry_offset, //  4
       A_IndexUsedEntry_end, // 4
       A_IndexAllocEntry_end, // 4
       A_Child_flag,
       A_Node_int; //  4
       String  A_Node_data;
}*/

//------------------------------------

class MainClass {
   MainClass() :
   dialogbox(),
   Log("MFT validator and parser", LogClass::WARN)
   {
   }

//------------------------------------
   LogClass Log;
   MyDialog dialogbox;
   FileClass File;
   BookmarkFolderClass RootFolder, SubFolder, SubPartialRecords, SubCannotParse;
   RecordFolderClass rootfolder,subfolder;// create a folder for all parsing.
   RecordFolderClass CompleteRecords, PartialRecords;
   int Count; // number of records processed
   int PCount; // number of parsed records processed
   int BCount; // number of Bookmarked records processed





//--------------------------------------
   void Signature_Search(EntryClass &entry){
      Console.WriteLine("\nBegin Searching and parsing for NTFS MFT records\n");
      Count = 0;
      // Creating the record folder

      SearchClass s();
      s.AddKeyword("FILE", KeywordClass::ANSI | KeywordClass::CASE | KeywordClass::GREP);
      s.AddKeyword("BAAD", KeywordClass::ANSI | KeywordClass::CASE | KeywordClass::GREP);

     if (s.Create()){
         EntryFileClass file();
         if (file.Open(entry,FileClass::SLACK | FileClass::NOUNERASE)){
            file.SetCodePage(CodePageClass::ANSI);
            s.Find(file, -1,-1,0);
            if(s.GetHits().Count()>0){
               SystemClass::StatusRange("Search Hits Found", 1);
               Console.WriteLine("Found "+s.GetHits().Count()+ " possible MFT records. Initiating Parse of "+ entry.FullPath());
               SubFolder = new BookmarkFolderClass(RootFolder, entry.FullPath());
               SubPartialRecords = new BookmarkFolderClass(SubFolder, "Partially Parsed Records");
               SubCannotParse = new BookmarkFolderClass(SubFolder, "Cannot Parse Records");

               subfolder = new RecordFolderClass(rootfolder, entry.FullPath(), entry.GetVolume());
               CompleteRecords = new RecordFolderClass(subfolder, "Complete MFT Records", entry.GetVolume());
               PartialRecords = new RecordFolderClass(subfolder, "Partially Parsed MFT Records", entry.GetVolume());
            }
            Console.WriteLine("Processing Results...");
            SystemClass::StatusRange("Validation and Parsing", 1);
            forall(SearchClass::HitClass h in s.GetHits()){

               Parse(entry, h.Offset());
               file.Seek(h.Offset());
            }
         }
         else
            Log.Warn("Unable to open "+entry.FullPath()+" for reading.");
      }
   }
//----------------------------------------------------------------------
   int MFT_Validation(EntryFileClass &file, long startposition){
      MFT_HeaderClass main_header();
      Attribute_HeaderClass attr_header();
      bool isHeader = false;
      bool isOFA = false;
      bool isValidOffset = false;
      bool isValidAttr = false;
      int header_type = 0;

      //----------checking process--------------

      //file.SetCodePage(1252);
      file.ReadString(main_header.Signature,4);// get to check sig
      if (main_header.Signature == "FILE" || main_header.Signature == "BAAD"){ // dec of x45/x4c/x49x/46 (FILE)
         isHeader = true;
         main_header.Offset_Fixup_Array = file.ReadBinaryInt(2,0); // check


         if (main_header.Offset_Fixup_Array == 48 || main_header.Offset_Fixup_Array == 42 || main_header.Offset_Fixup_Array == 40) { // 40 or x28 is windows 98/XP and earlier versions
            isOFA = true;
            file.Seek(startposition+20); // go get he attrib offset
            main_header.Offset_1st_Attr = file.ReadBinaryInt(2,0); // get the first attribute
            if (main_header.Offset_1st_Attr == 56 || main_header.Offset_1st_Attr == 48 || main_header.Offset_1st_Attr == 44){
               isValidOffset = true;
               file.Seek(startposition+main_header.Offset_1st_Attr); // go get the 1st attribute ID
               attr_header.Attr_TypeID = file.ReadBinaryInt(4,0); // get the first attribute ID
               if (attr_header.Attr_TypeID == 16 || attr_header.Attr_TypeID == 32 || attr_header.Attr_TypeID == 48 || attr_header.Attr_TypeID == 64 ||
                   attr_header.Attr_TypeID == 80 || attr_header.Attr_TypeID == 96 || attr_header.Attr_TypeID == 112 || attr_header.Attr_TypeID == 128 ||
                   attr_header.Attr_TypeID == 144 || attr_header.Attr_TypeID == 160 || attr_header.Attr_TypeID == 176 || attr_header.Attr_TypeID == 192 ||
                   attr_header.Attr_TypeID == 208 || attr_header.Attr_TypeID == 224 || attr_header.Attr_TypeID == 256 || attr_header.Attr_TypeID == 4294967295)
                  isValidAttr = true;
               else
                  isValidAttr = false;
            }
            else {
               file.Seek(startposition+56); // try to go get the 1st attribute ID
               attr_header.Attr_TypeID = file.ReadBinaryInt(4,0);
               if (attr_header.Attr_TypeID == 16 || attr_header.Attr_TypeID == 32 || attr_header.Attr_TypeID == 48 || attr_header.Attr_TypeID == 64 ||
                   attr_header.Attr_TypeID == 80 || attr_header.Attr_TypeID == 96 || attr_header.Attr_TypeID == 112 || attr_header.Attr_TypeID == 128 ||
                   attr_header.Attr_TypeID == 144 || attr_header.Attr_TypeID == 160 || attr_header.Attr_TypeID == 176 || attr_header.Attr_TypeID == 192 ||
                   attr_header.Attr_TypeID == 208 || attr_header.Attr_TypeID == 224 || attr_header.Attr_TypeID == 256 || attr_header.Attr_TypeID == 4294967295)
                  isValidAttr = true;
               else
                  isValidAttr = false;
            }//end else
         }
      }
      if (isHeader && isOFA && isValidOffset && isValidAttr){//Continue Parsing as a valid MFT
         header_type = 3;
      }
      else if (isHeader && isOFA && isValidOffset && !isValidAttr){  //Continue Parsing as a Partial MFT (only for STA & FileName)
         header_type = 2;
      }
      else if (isHeader && isOFA && !isValidOffset && !isValidAttr){ // Send to bookmarks
         header_type = 1;
      }
      else{
         header_type = 0;
      }
      return header_type;
   }

//------------------------------------
   void Parse (EntryClass &entry, ulong startposition){
      // initialization
      EntryFileClass file();

      MFT_HeaderClass main_header();
      Attribute_HeaderClass attr_header();
      Standard_InfoClass standard_info();
      File_NameClass file_name();
      Object_IDClass object_id();
      Data_Class data_attr();
      Volume_InfoClass volume_info();
      Volume_NameClass volume_name();
      ReparsePointClass reparse_point();
      Index_RootClass index_root();
      ulong endposition;
      // begin the validation
      if (file.Open(entry,FileClass::SLACK | FileClass::NOUNERASE)){
          file.SetCodePage(CodePageClass::ANSI);
          file.Seek(startposition);

          int MFT_Valid_Type = MFT_Validation(file, startposition);
          file.Seek(startposition);
          // begin the parsing
          if (MFT_Valid_Type == 3){//Continue Parsing as a valid MFT
               Count++;
               EmailClass rec(CompleteRecords, entry.FullPath(), 0, entry, 0, 0);
               DataPropertyClass record();
               new DataPropertyClass(record,DataPropertyClass::PR_NULL, entry.Name());
               main_header.Read(file, startposition);
               record.NewDataPropertyType("MFT File Offset Location", DataPropertyClass::LONG, startposition);
               main_header.Record(record);
               endposition = startposition+main_header.Log_MFT_Size;
               //Console.WriteLine(Count+"  Start: " + startposition + "  End  : " + endposition + " 1st Attr : " +main_header.Offset_1st_Attr );
               while(file.GetPos() < endposition){
                   ulong AttrPos = file.GetPos();
                   attr_header.Read(file, AttrPos);

                   //Console.WriteLine("AttributeID : " +attr_header.Attr_TypeID);
                   if(attr_header.Attr_Size != 0){
                      switch(attr_header.Attr_TypeID){
                        case 16: // Standard Info
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              standard_info.Read(file, beginOfContent, attr_header.Content_Size);
                              standard_info.Record(record);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Standard Info");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 32://Attribute List
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 48: // File Name Attribute
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              file_name.Read(file, beginOfContent, attr_header.Content_Size);
                              file_name.Record(record);
                              //Console.WriteLine("FN: "+file_name.FileName_string);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "FileName");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 64: // Object ID
                            if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              object_id.Read(file, beginOfContent, attr_header.Content_Size, main_header.NFTS_3X_greater);
                              record.NewDataPropertyType("Object ID", DataPropertyClass::STRING,object_id.Object_id);
                            }
                            else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Object ID");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 80: // Security Descriptor
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 96:// Volume name
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              volume_name.Read(file, beginOfContent, attr_header.Content_Size);
                              record.NewDataPropertyType("Volume Name", DataPropertyClass::STRING,volume_name.Volume_Name);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Volume Name");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 112: // Volume Info
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              volume_info.Read(file, beginOfContent, attr_header.Content_Size);
                              record.NewDataPropertyType("NTFS Version", DataPropertyClass::STRING,volume_info.NTFS_version_num);
                              record.NewDataPropertyType("Volume Flag", DataPropertyClass::STRING,volume_info.Volume_Flag);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Volume Info");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 128: // Data
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              data_attr.Read(file, beginOfContent, attr_header.Content_Size);
                              record.NewDataPropertyType("Data Attribute", DataPropertyClass::STRING,data_attr.DATA_string);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){

                              attr_header.RecordNonResData(record, "Data");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 144: // Index Root
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              index_root.Read(file, beginOfContent, attr_header.Content_Size);
                              index_root.Record(record);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Index Root");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 160: //Index Allocation
                           if (attr_header.Res_nonRes_Flag == 0){
                              Console.WriteLine("resident :"+file.GetPos());
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Index Allocation");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 176: // Bitmap
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 192:// Reparse Point
                           if (attr_header.Res_nonRes_Flag == 0){ // resident attribute
                              ulong beginOfContent = file.GetPos();
                              reparse_point.Read(file, beginOfContent, attr_header.Content_Size);
                              record.NewDataPropertyType("Reparse Point ID", DataPropertyClass::LONG,reparse_point.ReparsePointID);
                              record.NewDataPropertyType("Volume GUID", DataPropertyClass::STRING,reparse_point.ReparseName);
                           }
                           else if (attr_header.Res_nonRes_Flag == 1){
                              attr_header.RecordNonResData(record, "Reparse Point");
                           }
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 208://EA info - Ignored
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 224://EA info - Ignored
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 256: // Log Utility Stream - Ignored
                           file.Seek(AttrPos+attr_header.Attr_Size); // end of attribute
                           break;
                        case 4294967295:
                           file.Seek(endposition);break;
                        default:file.Seek(endposition);break;
                      }
                   }
               }
               rec.SetFields(record);

          }
          else if (MFT_Valid_Type == 2){  //Continue Parsing as a Partial MFT (only for STA & FName)
               PCount++;
               EmailClass Prec(PartialRecords, entry.FullPath(), 0, entry, 0, 0);
               DataPropertyClass Precord();
               new DataPropertyClass(Precord,DataPropertyClass::PR_NULL, entry.Name());
               Precord.NewDataPropertyType("MFT File Offset Location", DataPropertyClass::LONG, startposition);
               file.Skip(29);// skip until after the attribute offset


               while(file.GetPos() < (startposition+1003)) // less than the 1024 bytes
               {
                  bool timestampisfound = false;
                  timestampisfound = false;
                  uint checkbyte = file.ReadBinaryInt(1,0);

                  if ( checkbyte == 192 || checkbyte == 193 ||checkbyte == 194 ||checkbyte == 195 ||checkbyte == 196 ||checkbyte == 197 ||checkbyte == 198 ||
                       checkbyte == 199 ||checkbyte == 200 ||checkbyte == 201 ||checkbyte == 202 ||checkbyte == 203 ||checkbyte == 204 ||checkbyte == 205 ||
                       checkbyte == 206 ||checkbyte == 207){

                     ulong checkbyte_2 = file.ReadBinaryInt(1,0);
                     if (checkbyte_2 == 1){
                        if((file.GetPos()-startposition) > 31 && (file.GetPos()-startposition) < 74){
                           ulong currentpos = file.GetPos();
                           file.Seek(currentpos-8);

                           DateClass Timestamp; // unknown time stamp
                           file.ReadWinDate(Timestamp);

                           Precord.NewDataPropertyType("Unknown Timestamp", DataPropertyClass::DATE,Timestamp);
                           timestampisfound = true;
                        }
                     }
                  }
                  if (timestampisfound)break;
               }

               Prec.SetFields(Precord);
               SubPartialRecords.AddBookmark(entry, startposition, 1024, entry.FullPath(), BookmarkClass::INREPORT, BookmarkClass::NONE);
          }
          else if (MFT_Valid_Type == 1 ){ // Send to bookmarks
             BCount++;
             SubCannotParse.AddBookmark(entry, startposition, 1024, entry.FullPath(), BookmarkClass::INREPORT, BookmarkClass::NONE);
          }
          else if (MFT_Valid_Type == 0){ // ignore
               //continue;
          }
          else
               int endpos = file.GetPos(); // used for nothing yet
      }
   }

//------------------------------------

  void Main(CaseClass c){

     dialogbox.BookmarkFolderName = "Invalid MFT Records";
     if (dialogbox.Execute() == SystemClass::OK)  {
        RootFolder = new BookmarkFolderClass(c.BookmarkRoot(), dialogbox.BookmarkFolderName); // Create bookmark folder

        SystemClass::ClearConsole(1);
         if (c) {
             DateClass StartEndTime();
             Console.WriteLine("================================================================================================================\n" +
                               "MFT Parser (Tested on Encase v6.18)");
             StartEndTime.Now();
                  Console.WriteLine ("     Start Time: " + StartEndTime.GetString("dd-MMM-yyyy", "HH:mm:ss", DateClass::GetTimeZoneBias()));

            forall (EntryClass entry in c.EntryRoot()){
               if (entry.IsSelected()){

                  rootfolder = new RecordFolderClass(null, "MFT Parser", entry.GetVolume());

                  Console.WriteLine ("================================================================================================================\n" +
                               "The following information is from " + entry.FullPath() + ":");

                  EmailClass rec(rootfolder, entry.Name(), 0 ,entry, 0,0);
                  DataPropertyClass dp();
                  new DataPropertyClass(dp,DataPropertyClass::PR_FULL_PATH, entry.FullPath());
                  SystemClass::StatusRange("Searching for MFT Signatures", 1);
                  Signature_Search(entry);
                  ulong Full_Count = Count + PCount + BCount;
                  Console.WriteLine("\nTotal records: " +Full_Count+"\n\nTotal Complete Records: " +Count+"\n\nTotal Parsed Records: "+PCount+"\n\nTotal Bookmarked Records: "+BCount);
                  Console.WriteLine("\n\n================================================================================================================");
               }
            }
            StartEndTime.Now();
                  Console.WriteLine ("     End Time: " + StartEndTime.GetString("dd-MMM-yyyy", "HH:mm:ss", DateClass::GetTimeZoneBias()));
                  Console.WriteLine("================================================================================================================");
                  Console.WriteLine("Results are also displayed in the Records tab.\nSee the 'Additional Fields' column or to view in columns:\n" +
                                  "  -Right Click\n  -Show Columns\n  -uncheck and check 'Local Fields'\n  -click OK");
                  Console.WriteLine("================================================================================================================");
         }
         else
            SystemClass::Message(16, "Error", "You must first have a Case open or Windows System");
     }
  }
}