NTFS-Suite V0.8

v0.8: Journals, Security and Live Collect

About the tool

An NTFS forensic analysis tool for parsing, exploring and detecting suspicious activity in NTFS metafiles. It runs locally, with a case vault, audit log and plugin registry.

Core capabilities

• Parse: $MFT (reparse points, hard links, owner and security ids, DOS short name, resident executables), $UsnJrnl $J and $Secure.
• Explore: record table with filters, search, paging, After/Before date filters, saved views, column chooser, CSV/JSON copy and export, and a time zone control with every IANA zone.
• Time analyze: MACB timeline, with Sleuth Kit bodyfile import.
• Detect: timestomp, anti-forensics, masquerading, name abuse, MFT slot reuse and more, with scoring, MITRE ATT&CK mapping, finding status and grouping.
• Rules and IOCs: declarative rule engine with a Rules tab, plus IOC import (names, paths, sizes, hashes).
• Graph: NTFS anatomy map and Ownership view.
• Report: printable HTML and JSON reports, bodyfile, timeline CSV, IOC list.
• Usability: Ctrl K command palette, dark/light theme, bookmarkable page addresses, offline in-app Guide, public Samples page.

Verify your download

File	SHA-256
NTFS-Suite-v0.8.exe	1E15715796E299546947057BB6DA6772432FF3DAE7EC8AAEE5399B8666A4DF62

Check it in PowerShell:

Get-FileHash .\NTFS-Suite-v0.8.exe -Algorithm SHA256

Note: NTFS Suite reads raw volumes (\\.\C:) to collect $MFT, $UsnJrnl and $Secure, so some antivirus products may flag it. The source is open and you can build it yourself with cargo build --release.