Skip to content

ResidentReaper v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Mar 19:41
· 12 commits to main since this release
v1.0.0
20313b3

ResidentReaper v1.0.0

A fast NTFS forensic tool written in Rust — parses $MFT and $J (USN Journal) artifacts, and hunts for resident data hidden inside MFT entries.

Features

MFT Parsing (mft mode)

  • 34-column CSV output, MFTECmd-compatible (99.997% cell accuracy, identical row counts)
  • Forensic flags: SI<FN timestamp anomalies, uSecZeros, Copied
  • ADS detection with Zone.Identifier content extraction
  • --allocated-only flag to filter in-use entries only

USN Journal Parsing (usn mode)

  • 13-column CSV output, MFTECmd-compatible
  • Optional parent path resolution via --mft
  • Dual output: When --mft is provided, a full MFT CSV is also produced automatically in a single pass — no extra overhead

Resident Hunter (hunt mode — GUI)

  • Scan $MFT for resident data (files stored inline in MFT entries)
  • Unified search: Search by full path (parent path + filename combined)
  • Filter by extension (comma-separated) and size range
  • Inline hex viewer: Select an entry to view its data in classic hex dump format
  • Copy options: Copy Hex, Copy ASCII, or Copy Hex Dump to clipboard
  • Export selected or filtered entries to a directory
  • Sortable, resizable columns with horizontal scrolling

Auto-Named Output

  • -o is now optional for both mft and usn commands
  • Default output uses timestamped filenames: <yyyyMMddHHmmss>_MFT_Output.csv / <yyyyMMddHHmmss>_J_Output.csv
  • When using usn --mft without -o, both files get clean independent timestamp names

Comprehensive Help

  • ResidentReaper --help shows full usage examples, all three modes, and complete CSV column listings
  • Each subcommand has detailed --help with feature descriptions

Quick Start

# Parse $MFT (auto-named output)
ResidentReaper mft -f $MFT

# Parse USN Journal with path resolution (outputs both USN + MFT CSVs)
ResidentReaper usn -f $J --mft $MFT

# Parse with custom output path
ResidentReaper mft -f $MFT -o mft_output.csv
ResidentReaper usn -f $J -o usn.csv --mft $MFT

# Launch Resident Hunter GUI
ResidentReaper hunt -f $MFT

Downloads

Platform File
Windows ResidentReaper.exe
Linux ResidentReaper

MFTECmd Compatibility

Metric $MFT $J (USN Journal)
Row count Exact match Exact match
Column headers Identical (34 / 13 columns) Identical
Cell accuracy 99.997% 98.4%*
Timestamps Identical (7-digit fractional seconds) Identical

*ParentPath differences due to sequence number validation for reused MFT entries.

Assets 4
Loading