Indx2Csv Hands on Labs

Choose the Interactive Lab for a guided browser investigation with no installation. Use the Full Lab to create an authorised NTFS test event, extract directory index records and prepare a reviewable finding.

Interactive Lab

Browser based

Indx2Csv Interactive Lab

Expand labOpen in new tab

✓ No installation

The interactive parser requires JavaScript. You can still follow the complete real tool Full Lab below.

Full Lab

Isolated Windows lab

Indx2Csv Full Lab

Windows VM and disposable NTFS volume required

Hands on Proof of Concept

Recover the name. Trace the record. Bound the claim.

Investigate whether a Finance directory retains an earlier filename, connect the lead to the same NTFS file record instance and report only what the artefacts support.

Start the Full Lab

Outcome led, not screenshot led

Interface labels can differ by build. The objective is to produce a traceable directory index finding, not to copy every control from the screenshot. Record any meaningful difference in the executable or output you use.

Use a disposable, authorised volume

Create this scenario only in a Windows VM and NTFS volume you own or are authorised to change. Work from verified copies, keep parser output separate from the source and snapshot the VM before the exercise.

Before you begin

You need: one Windows analysis VM, administrator access, a disposable NTFS VHDX or secondary virtual disk, IndxCarver, Indx2Csv, a hashing tool and enough space for a forensic image or verified copy.

How to use this lab

Save the requested evidence at each milestone. If an expected result is missing, stop at that boundary and verify the source, extraction group and parser settings before adding a deeper scan.

Recommended first

Beginner Core Lab

Create a controlled rename, acquire the disposable volume, parse one directory index record set and correlate the result with the known event log.

Optional extension

Independent artefact correlation

Export $MFT and $UsnJrnl:$J, then test the filename and full file reference with a second parser instead of relying only on the ground truth worksheet.

1. Session 1Build and record
2. Session 2Acquire and parse
3. Session 3Corroborate and report

Objective

You are supporting case DFIR-218. A reviewer has found the current file board-pack.docx in a Finance folder and asks whether NTFS metadata supports an earlier name, draft-merger-notes.docx. Build that event on a disposable volume, examine the directory index, corroborate the lead and produce a qualified case note.

The lab deliberately creates many files. Small NTFS directories can remain in resident $INDEX_ROOT data; populating the controlled directory makes $INDEX_ALLOCATION records more likely, which is the structure examined in this exercise.

01

Activity 1: Build a controlled source

1. Create and attach a disposable NTFS VHDX or secondary virtual disk in the Windows VM. Label it INDX-LAB and record its drive letter, NTFS status, allocation unit size and system time zone.
2. Take a clean VM snapshot named pre-indx-lab.
3. Create X:\Cases\Finance, substituting the disposable drive letter for X:.
4. Create at least 250 harmless filler files in that directory. This PowerShell command writes only to the path you set:

$LabDirectory = 'X:\Cases\Finance'
New-Item -ItemType Directory -Path $LabDirectory -Force | Out-Null
1..250 | ForEach-Object { Set-Content -LiteralPath (Join-Path $LabDirectory ('invoice-{0:D3}.txt' -f $_)) -Value "Controlled lab file $_" }

1. Create draft-merger-notes.docx as a harmless text file, record the current UTC time, then rename it to board-pack.docx:

$Target = Join-Path $LabDirectory 'draft-merger-notes.docx'
Set-Content -LiteralPath $Target -Value 'Synthetic training document. No real case data.'
(Get-Date).ToUniversalTime() | Tee-Object -FilePath (Join-Path $LabDirectory 'ground-truth-utc.txt')
Rename-Item -LiteralPath $Target -NewName 'board-pack.docx'

1. Record the old name, new name, parent path and UTC time in a ground truth worksheet. Do not browse, copy or modify the directory further than necessary.
2. Shut down the VM cleanly and preserve a snapshot named post-rename-source.

Milestone 1Known event preservedThe disposable NTFS source contains a recorded rename in a populated Finance directory, and the pre/post snapshots are identifiable.

Expected result `board-pack.docx` exists in the controlled directory, `draft-merger-notes.docx` does not appear in a normal directory listing, and the worksheet records exactly what you created.

02

Activity 2: Extract and parse

1. Acquire the entire disposable volume with a trusted imaging tool, or attach a read only clone to the analysis VM. Record tool/version, source, destination, start/end time and verification hashes.
2. Create separate folders for source, extracted, output\baseline and output\slack. Never write parser output to the evidence volume.
3. Use IndxCarver against the verified working source. Preserve its log and separated candidate groups, including filenames that describe fixup handling or false positive status.
4. Hash the candidate INDX input you will parse. Select the group associated with the Finance directory where your extraction workflow allows that association.
5. Follow Parse and review INDX records to create a baseline run with format 6, NanoSec, UTC, Scan mode 0, strict name checking, Slack off and the source appropriate fixup setting.
6. Create a second output folder and repeat with Slack on. Keep Unicode off initially, as the combination of Unicode and Slack can reduce output quality.
7. Preserve the exact command or GUI settings, parser log, output filenames, row counts and SHA-256 values for both runs.

Compare the runs before searching only for the expected answer:

Review question	Baseline	Slack pass
Does board-pack.docx appear?	Record yes/no and file reference	Record yes/no and file reference
Does draft-merger-notes.docx appear?	Record yes/no and state	Record yes/no and state
Is the full file reference consistent?	Entry and sequence	Entry and sequence
Are other names implausible or truncated?	Note examples	Note added noise

A miss is still a valid result

Index slack is reused and the controlled old name is not guaranteed to survive. If it is absent, report the miss, preserve the settings and compare another snapshot or repeat the scenario. Do not escalate scan mode merely to force the expected answer.

Milestone 2Two passes preservedThe baseline and Slack outputs are separate, hashed and traceable to one extracted input and its parser settings.

Expected result The allocated/current name is reviewable and the Slack pass either supplies a bounded lead for the old name or documents that no such lead was recovered.

03

Activity 3: Corroborate and report

1. If the old name appears, record its source record, row state, parent reference, complete file reference and time fields. Never omit that it came from Slack.
2. Compare the old and current rows. A shared MFT entry number plus sequence value supports the same record instance more strongly than a similar name.
3. Compare the result with the ground truth worksheet. For the optional route, parse $MFT and $UsnJrnl:$J independently and preserve the corresponding current record and rename reasons.
4. Test a negative control: search the output for a plausible name you did not create, such as secret-acquisition-plan.docx, and record the result.
5. Explain the difference between current allocation, a Slack lead and the known rename event.
6. Write the case note below, including a result when the old name was not recovered.

Case: DFIR-218
Question and authorised scope:
Source, acquisition and extraction:
Input hash and Indx2Csv identity:
Baseline settings and result:
Slack settings and result:
Relevant name, row state and full file reference:
Ground truth or independent corroboration:
Negative control:
Conclusion and confidence:
What the evidence does not establish:
Cleanup and recovery:

Use wording such as: “The Slack enabled pass recovered an earlier name for file reference 41220:2, and the controlled event record independently documents the rename to the current name. This supports an earlier directory entry for the same file record instance. It does not identify an actor or establish file content.” Replace the example reference with your actual result.

Extend the result with independent NTFS artefacts

Export $MFT and $UsnJrnl:$J from the same verified source. Parse each with a suitable tool, then compare the entry and sequence values, parent reference, old/new names and UTC times. Record tool versions and hashes. Treat disagreement as a reason to recheck field mapping and source coverage, not something to hide.

Milestone 3Finding qualifiedAnother analyst can reproduce both passes, see the corroboration and understand precisely what the directory index evidence does and does not support.

Expected result Your case note distinguishes observed data from interpretation, includes a negative control and avoids claims about actor identity, content or execution.

Full Lab evidence checklist

This checklist applies to the VM based Full Lab. If you completed the Interactive Lab, retain its downloaded investigation summary instead.

• Core completion

  Required to demonstrate a traceable directory index examination.

  • Case question, authorised disposable volume, filesystem details, time basis and snapshot names.
  • Ground truth worksheet with old name, new name, parent path and UTC event time.
  • Acquisition identity, source/destination, times and verification hashes.
  • IndxCarver identity, exact input, log, candidate group and extracted input hash.
  • Baseline settings, log, output, row count and output hash.
  • Slack pass settings, log, output, row count and output hash.
  • Relevant name, row state, source record, parent reference, complete file reference and decoded times.
  • Qualified conclusion, confidence, limitations, negative control and cleanup.

• Good analyst practice

  Supplementary records that strengthen reproducibility and review.

  • Tool filenames, displayed versions, repository revisions or download dates, executable hashes and sources.
  • Independent `$MFT`/USN correlation or a clear statement that only controlled ground truth was used.

0 of 10 recorded Mark each item when you have saved the evidence.Reset

Troubleshooting

Symptom	First check
IndxCarver finds no useful records	Confirm the source is NTFS, the populated directory existed before acquisition and the correct source/image was selected.
Indx2Csv returns no rows	Check the extracted group, fixup state, INDX size and parser log before changing scan mode.
Old name is absent	Slack may have been reused. Preserve the negative result and repeat from a fresh snapshot if the learning objective requires a recovery.
Output has broken names	Compare Unicode off/on in separate folders, return to strict name checking and review non Slack rows first.
File references differ	Check whether the sequence value changed, whether two files reused one MFT entry, and whether sources came from the same acquisition.
Times appear shifted	Verify the source zone, Indx2Csv time zone setting and each corroborating parser's conversion.

Clean up

Protect the acquired image, hashes, parser outputs and case note according to the lab retention plan. Detach the disposable VHDX, remove temporary working copies where authorised, and restore the pre-indx-lab snapshot when you no longer need the generated artefacts.

PreviousParse and reviewNextReturn to the Indx2Csv overview