MFT File Not Available

[binglot]

In the provided VM of SIFT 3.0, I mounted an NTFS partition with all the extra parameters (show_sys_files, etc.) and to my surprise the $MFT file wasn't available. All other files seem to be there (e.g. $MFTMirr) except this one. Why Googling the problem I came across this: "Note that even when show_sys_files is specified, "$MFT" may will not be visible due to bugs/mis-features in glibc." (Source: http://manpages.ubuntu.com/manpages/gutsy/man8/ntfsmount.8.html).

Another surprise was when I looked at the bodyfile generated by log2timeline and it contained MFT entries. When I dumped MFT using icat and then parsed it with log2timeline, the number of L2T generated entries was almost identical. Any ideas?

Thanks,
Bart

[ekristen]

I'll have to test this.

[ekristen]

@SANS-SIFT have you ran into any issues with $MFT not being available?

[SIFT-OWNER]

It is there. But not listed. Need to run similar command

cp $MFT /temp/MFT

Best, Rob

Sent from my Mobile Phone

On Aug 30, 2014, at 10:28 AM, Erik Kristensen notifications@github.com wrote:

@SANS-SIFT have you ran into any issues with $MFT not being available?

—
Reply to this email directly or view it on GitHub.

[ekristen]

@baltek hope that helps, I'm closing this ticket, if you have more questions feel free to comment again.

[binglot]

Hi Erik,

Thank you for your reply and following up with the question. I'll test it
tomorrow at work and should I have any problems I'll get back to you.

Regards,
Bart

Bartosz Inglot
inglotbartosz@gmail.com

On 31 August 2014 14:07, Erik Kristensen notifications@github.com wrote:

@baltek https://github.com/baltek hope that helps, I'm closing this
ticket, if you have more questions feel free to comment again.

—
Reply to this email directly or view it on GitHub
#9 (comment).