-
Notifications
You must be signed in to change notification settings - Fork 36
/
example.txt
58 lines (56 loc) · 10.7 KB
/
example.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
PS C:\Users\Garret\workspace\osquery\build\windows10> .\osquery\Release\osqueryi.exe --allow_unsafe --disable_extensions=false --extension .\external\extension_ntfs\Release\ntfs_fo
rensics.ext.exe --interval 60
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> Connecting to the running osquery instance...
osquery> select * from ntfs_part_data;
+--------------------+---------+---------------------+
| device | address | description |
+--------------------+---------+---------------------+
| \\.\PhysicalDrive0 | 0 | Primary Table (#0) |
| \\.\PhysicalDrive0 | 1 | Unallocated |
| \\.\PhysicalDrive0 | 2 | NTFS / exFAT (0x07) |
| \\.\PhysicalDrive0 | 3 | Unallocated |
| \\.\PhysicalDrive0 | 4 | Unknown Type (0x27) |
| \\.\PhysicalDrive0 | 5 | Unallocated |
+--------------------+---------+---------------------+
osquery> select * from ntfs_file_data where device="\\.\PhysicalDrive0" and partition=2 AND path="/Users/Garret/test_dir";
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
| device | partition | filename | path | directory | btime | mtime | ctime | atime | fn_btime | fn_mtime | fn_ctime | fn_atime | type | active | flags | ADS | allocated | size | inode | object_id | uid | gid | sid |
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
| \\.\PhysicalDrive0 | 2 | test_dir | /Users/Garret/test_dir | /Users/Garret | 131681617385403263 | 131683876627452045 | 131683876627452045 | 131683876627452045 | 131681617385403263 | 131681617385403263 | 131681617385403263 | 131681617385403263 | Directory | 1 | 0 | 0 | 0 | 0 | 84607 | 5bdb3bdba93fe81190689801a7a7327e | 0 | | S-1-5-32-544 |
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
osquery> select * from ntfs_file_data where device="\\.\PhysicalDrive0" and partition=2 AND inode=84607;
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
| device | partition | filename | path | directory | btime | mtime | ctime | atime | fn_btime | fn_mtime | fn_ctime | fn_atime | type | active | flags | ADS | allocated | size | inode | object_id | uid | gid | sid |
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
| \\.\PhysicalDrive0 | 2 | test_dir | /Users/Garret/test_dir | /Users/Garret | 131681617385403263 | 131683876627452045 | 131683876627452045 | 131683876627452045 | 131681617385403263 | 131681617385403263 | 131681617385403263 | 131681617385403263 | Directory | 1 | 0 | 0 | 0 | 0 | 84607 | 5bdb3bdba93fe81190689801a7a7327e | 0 | | S-1-5-32-544 |
+--------------------+-----------+----------+------------------------+---------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+-----------+--------+-------+-----+-----------+------+-------+----------------------------------+-----+-----+--------------+
osquery> select * from ntfs_file_data where device="\\.\PhysicalDrive0" and partition=2 AND directory="/Users/Garret/test_dir";
+--------------------+-----------+-------------+------------------------------------+------------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+------+--------+-------+-----+-----------+------+--------+----------------------------------+-----+-----+-----------------------------------------------+
| device | partition | filename | path | directory | btime | mtime | ctime | atime | fn_btime | fn_mtime | fn_ctime | fn_atime | type | active | flags | ADS | allocated | size | inode | object_id | uid | gid | sid |
+--------------------+-----------+-------------+------------------------------------+------------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+------+--------+-------+-----+-----------+------+--------+----------------------------------+-----+-----+-----------------------------------------------+
| \\.\PhysicalDrive0 | 2 | aaa.txt.txt | /Users/Garret/test_dir/aaa.txt.txt | /Users/Garret/test_dir | 131683876608490305 | 131683876608490305 | 131683876628512178 | 131683876608490305 | 131683876608490305 | 131683876608490305 | 131683876608490305 | 131683876608490305 | File | 1 | 32 | 0 | 0 | 0 | 292897 | d6f03bdba93fe81190689801a7a7327e | 0 | | S-1-5-21-562564853-3214126587-4156000382-1000 |
+--------------------+-----------+-------------+------------------------------------+------------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+--------------------+------+--------+-------+-----+-----------+------+--------+----------------------------------+-----+-----+-----------------------------------------------+
osquery> select * from ntfs_indx_data where device="\\.\PhysicalDrive0" and partition=2 and parent_inode=84607;
+--------------------+-----------+--------------+------------------------+--------------+------------+----------------+-----------+--------------------+--------------------+--------------------+--------------------+-------+-------+
| device | partition | parent_inode | parent_path | filename | inode | allocated_size | real_size | btime | mtime | ctime | atime | flags | slack |
+--------------------+-----------+--------------+------------------------+--------------+------------+----------------+-----------+--------------------+--------------------+--------------------+--------------------+-------+-------+
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | aaa.txt.txt | 292897 | 0 | 0 | 131683876608490305 | 131683876608490305 | 131683876628512178 | 131683876608490305 | 32 | 0 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | AAATXT~1.TXT | 292897 | 0 | 0 | 131683876608490305 | 131683876608490305 | 131683876628512178 | 131683876608490305 | 32 | 0 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBEFFA~1.TXT | 294361 | 0 | 0 | 131683847363249997 | 131681622781756810 | 131681622791132278 | 131683847363249997 | 32 | 3720 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF103~1.TXT | 270759 | 0 | 0 | 131683847350108913 | 131681622781756810 | 131681622791132278 | 131683847350108913 | 32 | 3832 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF495~1.TXT | 270765 | 0 | 0 | 131683847353389206 | 131681622781756810 | 131681622791132278 | 131683847353389206 | 32 | 3944 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBED26~1.TXT | 8589934608 | 0 | 0 | 131683847356619493 | 131681622781756810 | 131681622791132278 | 131683847356619493 | 32 | 280 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF495~1.TXT | 8589934608 | 0 | 0 | 131683847353389206 | 131681622781756810 | 131681622791132278 | 131683847353389206 | 32 | 512 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF495~1.TXT | 8589934608 | 0 | 0 | 131683847353389206 | 131681622781756810 | 131681622791132278 | 131683847353389206 | 32 | 632 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF495~1.TXT | 8589934608 | 0 | 0 | 131683847353389206 | 131681622781756810 | 131681622791132278 | 131683847353389206 | 32 | 864 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | BBF495~1.TXT | 8589934608 | 0 | 0 | 131683847353389206 | 131681622781756810 | 131681622791132278 | 131683847353389206 | 32 | 984 |
| \\.\PhysicalDrive0 | 2 | 84607 | /Users/Garret/test_dir | NEWTEX~1.TXT | 298603 | 0 | 0 | 131683848632056623 | 131683848632056623 | 131683848632056623 | 131683848632056623 | 32 | 2104 |
+--------------------+-----------+--------------+------------------------+--------------+------------+----------------+-----------+--------------------+--------------------+--------------------+--------------------+-------+-------+
osquery> select count(inode) from ntfs_file_data WHERE partition=2 AND device="\\.\PhysicalDrive0";
+--------------+
| count(inode) |
+--------------+
| 423858 |
+--------------+
osquery>