Mft2Csv Hands-on Labs

Choose the Interactive Lab for a guided browser investigation using a simulated Mft2Csv interface. Use the Full Lab when you are ready to process an authorised $MFT, validate the CSV, and preserve a reproducible finding.

Interactive Lab

Full Lab

Isolated Windows VM · 75–120 min

Mft2Csv Full Lab

Authorised NTFS evidence required

Hands-on NTFS export proof of concept

Configure it. Export it. Defend it.

Turn a verified $MFT into reviewable CSV, investigate a deleted-file lead, test path and timestamp limitations, and package a finding another analyst can reproduce.

⏱ Setup and core exercise: 75–120 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Outcome-led, not screenshot-led

Releases and interface labels can differ. Use the evidence boundaries, decisions, checkpoints, and expected results below. Record meaningful differences rather than trying to reproduce the supplied screenshot pixel for pixel.

Use supplied or authorised evidence

Do not scan a physical drive, mounted system, shadow copy, image, or $MFT without authority. Retain protected evidence, process a verified working source, and keep outputs in a separate case directory.

Before you begin

You need: an isolated Windows analysis VM, a recorded Mft2Csv release, a supplied or authorised complete $MFT, its manifest or known SHA-256, at least 2 GB of free output space, a CSV viewer, and separate evidence, working, output, and notes folders.

How to use this lab

Complete each milestone in order. Stop if source identity, working-copy integrity, time basis, output destination, parser completion, or import settings cannot be demonstrated.

Recommended first

Beginner Core Lab

Process one verified extracted $MFT with conservative settings, validate the output, and investigate invoice-review.txt across all matching rows.

Expected time: 75–120 minutes.

Optional extension

Compare one controlled option

Repeat the export with either split CSV or slack scanning in a new output directory, then explain exactly what changed and why the additional results require qualification.

Expected time: one additional 30–45 minute session.

1. Session 1Prepare and verify
2. Session 2Configure and export
3. Session 3Filter and report

Objective

You are supporting case SUSA-M2C-117. Triage identifies invoice-review.txt on authorised workstation WIN11-LAB01, with relevant activity near 2026-08-18 10:20Z. Produce a traceable Mft2Csv export, identify the case-relevant record among plausible matches, evaluate its allocation and timestamp context, and determine what independent evidence is needed before reporting a rename or deletion sequence.

The core succeeds when another analyst can reproduce the export and filter from the same verified source, identify the same record, and understand the conclusion and its limits.

01

Activity 1: Establish the case boundary

1. Record case identifier, question, authority, examiner, source host and volume, collection time, source time zone, and analysis time zone.
2. Verify the protected $MFT and create a named working copy whose SHA-256 matches it.
3. Record the Mft2Csv archive and executable paths, hashes, source, displayed version, and workstation time.
4. Create separate evidence\protected, working, output\core, screenshots, and notes locations.
5. Confirm the output directory is not inside the protected evidence or tool directory.
6. Record the intended configuration before opening the tool.

Case / question / authority:
Host / volume / source time basis:
Protected $MFT path / bytes / SHA-256:
Working $MFT path / bytes / SHA-256:
Mft2Csv path / version / SHA-256:
Output directory:
Planned format / time zone / delimiter / encoding / precision:

Milestone 1Evidence basis verifiedThe retained source, matching working copy, tool build, time basis, and separate output destination are recorded.

Expected result A reviewer can identify exactly which `$MFT` will be processed, prove the working copy matches the protected source, and predict where every derived file will be written.

02

Activity 2: Export and validate

1. Launch Mft2Csv and record the version in the title bar.
2. Select Choose $MFT and open the verified working copy. Do not select the protected source.
3. Configure the supplied core scenario:
4. output format: all;
5. time zone: UTC: 0.00 because the supplied case timestamps are normalized to UTC;
6. separator: pipe (|);
7. record size: 1024;
8. timestamp format: 6;
9. precision: NanoSec;
10. Unicode: enabled; and
11. Skip Fixups, Broken $MFT, Scan slack, resident extraction, quotation mark, and split CSV: disabled.
12. Use Set Output Path and select output\core.
13. Re-read the source, time, output, and advanced controls before selecting Start Processing.
14. Preserve the status pane at completion, including record detection, record count, warnings, errors, and the generated timestamped Mft2Csv_YYYY-MM-DD_HH-MM-SS folder name.
15. Inventory and hash the complete timestamped folder. It should include the primary Mft.csv, Mft.log, and companion CSV and SQL files; record actual filenames rather than assuming only one CSV was created.
16. Open Mft.csv through an explicit import flow. Select the recorded delimiter and Unicode-compatible encoding; confirm columns do not collapse into one field.

Why conservative settings?

The core uses a complete extracted $MFT. Recovery-oriented flags and slack extraction would add uncertainty without answering the bounded case question. The optional extension is the place to compare one specialist option.

Milestone 2Export validatedMft2Csv completed against the verified working source, outputs are preserved, and the CSV imports with the documented structure.

Expected result The status pane reports a completed decode, a timestamped run folder contains non-empty Mft.csv, Mft.log, and companion files, field families are visible as separate columns, and every output can be traced to the recorded source and configuration.

03

Activity 3: Investigate and report

1. Preserve an untouched complete output, then perform analysis on an identified review copy when practical.
2. Filter the filename field for invoice-review.txt and common name variants. Record the exact filter, active sort, total matches, and CSV identity.
3. Compare every candidate using record and sequence, parent reference, namespace, allocation state, size, and available path context.
4. For the case-relevant row, record record and sequence, header allocation and integrity fields, parent identity and resolved path, exact SI/FN timestamp columns, DATA/resident/ADS indicators, and RecordOffset inside the $MFT.
5. Test the displayed path. For an unused record, check whether parent sequence context and independent $UsnJrnl:$J or $I30 evidence support it.
6. Compare SI and FN values. List normal explanations before treating a difference as suspicious.
7. Write a bounded finding that distinguishes the Mft2Csv observation from journal or directory-index corroboration.

Case question and authority:
Source, working copy, and hashes:
Mft2Csv version and configuration:
Output files, hashes, import settings, and row count:
Filter, sort, candidates, and selected record:
Observed HEADER, SI, FN, DATA, path, and integrity fields:
Corroborating source, parser, and matching identifiers:
Supported conclusion and confidence:
Path, timestamp, parser, and coverage limitations:
Next evidence and preservation actions:

An acceptable finding may support that a named unused MFT record exists with a particular identity and metadata, while separately parsed journal records support a partial rename/deletion sequence. It must not invent an actor, intent, execution, or guaranteed recoverable content.

Milestone 3Finding is reviewableEvery claim links to preserved output or corroborating evidence, and the report states both confidence and limitations.

Expected result A second analyst can reproduce the export and filtering decisions and can tell which conclusions come from `$MFT` metadata versus another source.

Extend the core by scanning slack

Create output\scan-slack, keep every other setting identical, enable only Scan slack, and repeat the export. Compare output files, row counts, additional $I30 material, warnings, and processing time. Explain why slack results are leads that require validation, not automatically current directory history.

Full Lab evidence checklist

This checklist applies to the evidence-based Full Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead.

• Core completion

  Required to demonstrate a traceable export and bounded finding.

  • Authority, case question, examiner, host, volume, collection context, and time basis.
  • Protected source and verified working-copy paths, byte sizes, hashes, and confirmed match.
  • Mft2Csv release, executable path, version, hash, source, and workstation time.
  • Source mode, output format, time zone, timestamp format and precision, delimiter, encoding, record size, and advanced flags.
  • Timestamped run-folder path, completion status, Mft.csv, Mft.log, companion outputs, warnings, sizes, hashes, and CSV import settings.
  • Filename stem or variant filter, sort, match count, compared candidates, and selected record identity.
  • HEADER, SI, FN, DATA, parent, integrity, and RecordOffset fields preserved with exact column names.
  • Observation, interpretation, confidence, limitations, corroboration, and next evidence.

• Good analyst practice

  Supplementary records that improve reproducibility.

  • Case directory layout, screenshots, notes, retained complete output, and review-copy identity.
  • Outputs protected, temporary data handled under policy, and disposable VM restored.

0 of 10 recorded Mark each item after saving the evidence.Reset

Troubleshooting

Symptom	First check
The application does not start	Confirm executable architecture, extraction completeness, blocked files, security-control events, and required privileges
The selected $MFT does not parse	Recheck source type, byte size, hash, record size, acquisition completeness, and status messages before using recovery flags
CSV opens in one column	Import with the recorded pipe separator and correct text encoding instead of accepting spreadsheet defaults
Timestamps appear shifted	Recheck the selected Mft2Csv time-zone offset, source time basis, output header, and downstream display behavior
Deleted paths look implausible	Validate parent record and sequence reuse with USN, $I30, image context, and neighbouring records
Output is unexpectedly large	Confirm all, split CSV, slack scanning, and resident extraction settings plus available storage

Clean up

Close the tool and review application, preserve the protected source, parser log, complete output, evidence summary, hashes, screenshots, and notes, then remove disposable copies according to lab policy. Restore the isolated analysis VM when appropriate.

PreviousReview and interpret