Skip to content

ResidentSpecter v0.1.0

Choose a tag to compare

View all tags
@ChickenLoner ChickenLoner released this 07 Mar 14:28
· 17 commits to main since this release
v0.1.0
6116805

ResidentSpecter v0.1.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

Features

  • MFT Parser — Parses $MFT to CSV with MFTECmd-compatible output (99.997% cell accuracy, identical row counts)
  • USN Journal Parser — Parses $J to CSV with MFTECmd-compatible output (98.4% accuracy), with optional parent path resolution via $MFT
  • Resident Hunter (GUI) — Scan MFT entries for resident data, browse/filter/export inline files

Usage

# Parse $MFT
ResidentSpecter.exe mft -f $MFT -o mft_output.csv

# Parse $J (USN Journal)
ResidentSpecter.exe usn -f $J -o usn_output.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentSpecter.exe hunt

Downloads

Platform File
Windows (x64) resident-specter.exe

Linux binary coming in a future release via CI.

Assets 3
Loading