665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-mft-for-deleted-file-recovery

Parse NTFS MFT records to recover deleted file metadata and timelines.

Updated Aug 27, 2026

Search Tags:#timeline #forensics #deleted-files #usn-journal #ntfs #mft #mftecmd

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-mft-for-deleted-file-recovery

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-mft-for-deleted-file-recovery
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-mft-for-deleted-file-recovery
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-mft-for-deleted-file-recovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Forensic analysts can extract and interpret deleted NTFS Master File Table (MFT) records to recover file metadata, reconstruct storage timelines, and detect timestomping across NTFS artifacts.

Core Features & Use Cases

MFT Deleted Record Detection: identifies InUse = FALSE entries, captures filenames, paths, sizes, and timestamps for deleted files.
Cross-Artifact Correlation: correlates MFT data with USN Journal, $LogFile, and MFT slack space to strengthen evidence and sequencing.
Reporting & Timelines: generates structured reports and supports timeline reconstruction for incident response and formal investigations.

Quick Start

Run the MFT Deleted File Recovery agent against an extracted $MFT file to generate a comprehensive JSON report.

Frequently Asked Questions about analyzing-mft-for-deleted-file-recovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Can I correlate MFT data with USN Journal and $LogFile records for forensic timeline reconstruction?▼

To reconstruct storage timelines and detect timestomping, you cross-reference parsed MFT data with USN Journal events and $LogFile records. Correlating these artifacts strengthens evidence sequencing and provides a structured forensic timeline.

What is the best way to detect timestomping using NTFS Master File Table artifacts?▼

Yes, this MFT analysis approach supports outputs from MFTECmd and analyzeMFT. It processes these parsed outputs alongside raw $MFT files, USN Journal events, $LogFile records, and MFT slack space across multiple files.

How do I generate a structured forensic report from extracted $MFT files?▼

The best way to detect timestomping using NTFS Master File Table artifacts is to cross-reference MFT timestamps with USN Journal and $LogFile records. Comparing these distinct metadata sources reveals discrepancies indicating altered file times.

How do I recover deleted file metadata from an NTFS MFT record?▼

You generate a structured forensic report from extracted $MFT files by running an analysis agent to parse records and assemble timelines. This produces a comprehensive JSON report containing deleted file metadata and cross-artifact correlations.

Does this MFT analysis approach support outputs from MFTECmd and analyzeMFT?▼

Yes, you can analyze MFT slack space across multiple NTFS volume files. The analysis supports parsing slack space alongside active and deleted MFT records to uncover residual metadata during incident response investigations.

Related Skills

Explore More Data & Analytics Skills→

password-recovery

Recover passwords and sensitive data from disk images and deleted files.

oss-forensics/orchestration

Orchestrate OSS forensic investigations across public GitHub repositories with phase-driven workflows.

salmanabdurrahman

forensic-disk

Analyze disk images read-only with Sleuth Kit, foremost, and bulk_extractor.

roberttmadsen13-del

github-archive

Query GitHub Archive data via BigQuery to extract forensic metadata from event payloads.