Skip to content

ResidentReaper v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Mar 19:18
· 13 commits to main since this release
v0.2.0
304fcb4

ResidentReaper v0.2.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

What's New in v0.2.0

Dual MFT + USN Output

  • usn --mft now also outputs a full MFT CSV alongside the USN Journal CSV
  • Single-pass parsing: builds the path lookup and writes MFT CSV simultaneously — no extra overhead
  • MFT output is saved as <usn_output>_MFT_Output.csv in the same directory
  • Example: ResidentReaper usn -f $J -o usn.csv --mft $MFT produces both usn.csv and usn_MFT_Output.csv

Comprehensive Help Menus

  • ResidentReaper --help now shows full usage examples, all three modes, and complete CSV column listings (34 MFT columns, 13 USN columns)
  • Each subcommand (mft, usn, hunt) has detailed --help with feature descriptions
  • Documents the dual-output behavior of usn --mft

Hunt Mode — Improved Search

  • Merged separate "Name" and "Path" filters into a single Search field
  • Searches against the full combined path (ParentPath\FileName)

Hunt Mode — Better Table Layout

  • Reordered columns: Entry# → FileName → Size → Ext → FullPath → Created → Modified → Stream
  • FullPath column: Shows combined ParentPath\FileName
  • Horizontal scrolling: Long paths are fully visible

Hunt Mode — Hex Viewer

  • Inline hex viewer: Select a single entry to see resident data in classic hex dump format (Offset | Hex | ASCII)
  • Resizable panel (100–400px)
  • Copy Hex: Raw hex bytes (4D 5A 90 00 ...)
  • Copy ASCII: Printable ASCII with . for non-printable bytes
  • Copy Hex Dump: Full formatted dump (offset + hex + ASCII columns)

Core Features

MFT Parsing (mft mode)

  • 34-column CSV output, MFTECmd-compatible (99.997% cell accuracy, identical row counts)
  • Forensic flags: SI<FN timestamp anomalies, uSecZeros, Copied
  • ADS detection with Zone.Identifier content extraction
  • --allocated-only flag to filter in-use entries

USN Journal Parsing (usn mode)

  • 13-column CSV output, MFTECmd-compatible
  • Optional parent path resolution via --mft
  • Dual output: MFT CSV automatically generated when --mft is provided

Resident Hunter (hunt mode — GUI)

  • Scan $MFT for resident data (files stored inline in MFT entries)
  • Search/filter by path, extension, or size range
  • Inline hex viewer with copy options
  • Export selected or filtered entries to a directory

Downloads

Platform File
Windows ResidentReaper.exe
Linux ResidentReaper

Quick Start

# Parse $MFT to CSV
ResidentReaper mft -f $MFT -o mft_output.csv

# Parse USN Journal with path resolution (also outputs MFT CSV)
ResidentReaper usn -f $J -o usn_output.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentReaper hunt -f $MFT
Assets 4
Loading