v1.2.0 — USN Journal Rewind

USN Journal Rewind

ResidentReaper now reconstructs historically accurate parent paths for every USN Journal event — not just the file's current location on disk.

The Problem

When a file is deleted or renamed after a USN event is recorded, standard MFT-based path resolution shows where the file ended up, not where it was. Forensic tools including MFTECmd mark these as PathUnknown. This hides staging directories, exfiltration paths, and malware drop locations.

The Solution

v1.2.0 implements true reverse-chronological rewind — the same technique described in CyberCX's USN Journal Rewind research:

• Collects all journal records, then walks newest → oldest
• RenameOldName events overwrite the path map, exposing the pre-rename name for all earlier records
• All other events use or_insert — first-seen going backwards = most recent state
• Each record's ParentPath is resolved before updating the map, so it reflects filesystem state at the exact moment of the event
• MFT supplements the rewind map for entries that never appeared in the journal

Results (328,613 records, real-world sample)

Metric	Value
Agreement with usnjrnl_rewind.py (CyberCX)	98.62%
Records resolved that py cannot	+4,547 (deleted parents in journal, not MFT)
Records py resolves that we cannot	0
Remaining differences	4 (rename timing edge case)

New Flag

--raw    Disable rewind — fall back to MFT-only path resolution (pre-v1.2 behavior)

New Files

• ARCHITECTURE.md — full module map, data flow diagrams, CSV column specs
• CLAUDE.md — project constraints and algorithm invariants for AI-assisted development

Usage

# Rewind active by default — resolves historical paths
ResidentReaper usn -f $J

# Rewind + MFT — also writes MFT CSV, fills entries absent from journal
ResidentReaper usn -f $J -m $MFT

# Disable rewind — MFT-only, current state (pre-v1.2 behavior)
ResidentReaper usn -f $J -m $MFT --raw

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's Changed

• Use zigbuild for glibc 2.17 compatible Linux builds by @ChickenLoner in #1

New Contributors

• @ChickenLoner made their first contribution in #1

Full Changelog: v1.0.0...v1.1.0

ResidentReaper v1.0.0

ResidentReaper v1.0.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

---

Features

MFT Parsing (mft mode)

• 34-column CSV output, MFTECmd-compatible (99.997% cell accuracy, identical row counts)
• Forensic flags: SI<FN timestamp anomalies, uSecZeros, Copied
• ADS detection with Zone.Identifier content extraction
• --allocated-only flag to filter in-use entries only

USN Journal Parsing (usn mode)

• 13-column CSV output, MFTECmd-compatible
• Optional parent path resolution via --mft
• Dual output: When --mft is provided, a full MFT CSV is also produced automatically in a single pass — no extra overhead

Resident Hunter (hunt mode — GUI)

• Scan $MFT for resident data (files stored inline in MFT entries)
• Unified search: Search by full path (parent path + filename combined)
• Filter by extension (comma-separated) and size range
• Inline hex viewer: Select an entry to view its data in classic hex dump format
• Copy options: Copy Hex, Copy ASCII, or Copy Hex Dump to clipboard
• Export selected or filtered entries to a directory
• Sortable, resizable columns with horizontal scrolling

Auto-Named Output

• -o is now optional for both mft and usn commands
• Default output uses timestamped filenames: <yyyyMMddHHmmss>_MFT_Output.csv / <yyyyMMddHHmmss>_J_Output.csv
• When using usn --mft without -o, both files get clean independent timestamp names

Comprehensive Help

• ResidentReaper --help shows full usage examples, all three modes, and complete CSV column listings
• Each subcommand has detailed --help with feature descriptions

---

Quick Start

# Parse $MFT (auto-named output)
ResidentReaper mft -f $MFT

# Parse USN Journal with path resolution (outputs both USN + MFT CSVs)
ResidentReaper usn -f $J --mft $MFT

# Parse with custom output path
ResidentReaper mft -f $MFT -o mft_output.csv
ResidentReaper usn -f $J -o usn.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentReaper hunt -f $MFT

Downloads

Platform	File
Windows	ResidentReaper.exe
Linux	ResidentReaper

MFTECmd Compatibility

Metric	$MFT	$J (USN Journal)
Row count	Exact match	Exact match
Column headers	Identical (34 / 13 columns)	Identical
Cell accuracy	99.997%	98.4%*
Timestamps	Identical (7-digit fractional seconds)	Identical

*ParentPath differences due to sequence number validation for reused MFT entries.

ResidentReaper v0.2.0

ResidentReaper v0.2.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

---

What's New in v0.2.0

Dual MFT + USN Output

• usn --mft now also outputs a full MFT CSV alongside the USN Journal CSV
• Single-pass parsing: builds the path lookup and writes MFT CSV simultaneously — no extra overhead
• MFT output is saved as <usn_output>_MFT_Output.csv in the same directory
• Example: ResidentReaper usn -f $J -o usn.csv --mft $MFT produces both usn.csv and usn_MFT_Output.csv

Comprehensive Help Menus

• ResidentReaper --help now shows full usage examples, all three modes, and complete CSV column listings (34 MFT columns, 13 USN columns)
• Each subcommand (mft, usn, hunt) has detailed --help with feature descriptions
• Documents the dual-output behavior of usn --mft

Hunt Mode — Improved Search

• Merged separate "Name" and "Path" filters into a single Search field
• Searches against the full combined path (ParentPath\FileName)

Hunt Mode — Better Table Layout

• Reordered columns: Entry# → FileName → Size → Ext → FullPath → Created → Modified → Stream
• FullPath column: Shows combined ParentPath\FileName
• Horizontal scrolling: Long paths are fully visible

Hunt Mode — Hex Viewer

• Inline hex viewer: Select a single entry to see resident data in classic hex dump format (Offset | Hex | ASCII)
• Resizable panel (100–400px)
• Copy Hex: Raw hex bytes (4D 5A 90 00 ...)
• Copy ASCII: Printable ASCII with . for non-printable bytes
• Copy Hex Dump: Full formatted dump (offset + hex + ASCII columns)

---

Core Features

MFT Parsing (mft mode)

• 34-column CSV output, MFTECmd-compatible (99.997% cell accuracy, identical row counts)
• Forensic flags: SI<FN timestamp anomalies, uSecZeros, Copied
• ADS detection with Zone.Identifier content extraction
• --allocated-only flag to filter in-use entries

USN Journal Parsing (usn mode)

• 13-column CSV output, MFTECmd-compatible
• Optional parent path resolution via --mft
• Dual output: MFT CSV automatically generated when --mft is provided

Resident Hunter (hunt mode — GUI)

• Scan $MFT for resident data (files stored inline in MFT entries)
• Search/filter by path, extension, or size range
• Inline hex viewer with copy options
• Export selected or filtered entries to a directory

---

Downloads

Platform	File
Windows	ResidentReaper.exe
Linux	ResidentReaper

Quick Start

# Parse $MFT to CSV
ResidentReaper mft -f $MFT -o mft_output.csv

# Parse USN Journal with path resolution (also outputs MFT CSV)
ResidentReaper usn -f $J -o usn_output.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentReaper hunt -f $MFT

ResidentSpecter v0.1.0

ResidentSpecter v0.1.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

Features

• MFT Parser — Parses $MFT to CSV with MFTECmd-compatible output (99.997% cell accuracy, identical row counts)
• USN Journal Parser — Parses $J to CSV with MFTECmd-compatible output (98.4% accuracy), with optional parent path resolution via $MFT
• Resident Hunter (GUI) — Scan MFT entries for resident data, browse/filter/export inline files

Usage

# Parse $MFT
ResidentSpecter.exe mft -f $MFT -o mft_output.csv

# Parse $J (USN Journal)
ResidentSpecter.exe usn -f $J -o usn_output.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentSpecter.exe hunt

Downloads

Platform	File
Windows (x64)	resident-specter.exe

Linux binary coming in a future release via CI.