Indx2Csv

What Indx2Csv does

NTFS directory index examination

Indx2Csv, by Joakim Schicht, decodes NTFS INDX records into delimited output that can be filtered, compared and retained with an investigation. Its primary forensic use is examining $I30 directory indexes, including allocated entries and possible remnants in index slack. It can also decode the $O Object ID and $R reparse point indexes.

Use it to answer a bounded question such as “Does this directory index retain a reference to a particular name or file record?” Treat the result as directory metadata evidence and corroborate important rows with $MFT, the USN Journal, surrounding directory entries or another independent source.

Learn the workflowTry the Interactive Lab

Version aware guidance

The supplied screenshot shows Indx2Csv 1.0.0.14. The project does not present a conventional packaged release page, so record the executable filename, version shown in the title bar, repository revision or download date, and a SHA-256 value before case use. Confirm controls and output headers against the copy you actually run.

Where it fits

01PreserveVerified image or extracted INDX working copy

02ExtractIndxCarver separates candidate record sets

03ParseIndx2Csv decodes entries and optional slack

04ValidateCompare file references, names and times

Strong use case

Locate a filename or file reference lead in a directory index, including a possible older entry retained in slack, then test it against other NTFS artefacts.

Important limit

A parsed name does not by itself prove current allocation, file content, execution, user intent or the identity of an actor. Slack results can include stale data and false positives.

Understand the inputs

• Extracted INDX records
  The preferred input. The author recommends using IndxCarver, which separates false positive candidates and records with different fixup handling.
• $I30 directory index
  Holds indexed metadata for items in a directory. Large directories commonly use $INDEX_ALLOCATION; small directories can remain in resident $INDEX_ROOT data.
• $O and $R indexes
  Object ID and reparse point indexes require a different interpretation from ordinary directory entries. Keep the source index type with the output.
• Fragments and deeper scans
  Scan modes and fragment verification can recover additional candidates, but increase noise. Use them as a separate, documented recovery pass.

Install and open

1

Prepare the tool directory

Make sure Git for Windows is installed. Open Command Prompt and change to C:\Tools\JoakimSchichtTools.

2

Clone the official repository

Run the command below, then record the repository revision and hash the executable you intend to use.

3

Open the correct architecture

Launch Indx2Csv64.exe on a 64-bit Windows analysis system. The GUI opens when no command line parameters are supplied.

cd /d C:\Tools\JoakimSchichtTools
git clone https://github.com/jschicht/Indx2Csv.git

Preserved setup screenshot: clone the repository into the controlled tools directory.

Preserved tool screenshot: Indx2Csv exposes timestamp, output, fixup, slack, scan mode and INDX size controls.

Read the interface before parsing

Output and time

Timestamp format, Precision, time zone region and separators determine how decoded times are written. Use one explicit time basis across related tools.

Record handling

Apply fixups, INDX Size and Scan mode control how records are validated or searched. The common INDX size is 4096, but confirm the source rather than assuming.

Recovery options

Slack asks the parser to inspect unallocated space inside index records. Unicode can improve name decoding, but the author warns that combining Unicode with slack can reduce output quality.

Output format

Choose dump everything for a detailed review, or the l2timeline/bodyfile modes for a specific downstream workflow. Record the delimiter and quotation setting with the output.

Analyst decisionA filename appears only in an Indx2Csv slack row. What is the defensible next step?

Report that the file currently exists and name the responsible userPreserve the row, record that it came from slack, and compare its file reference and timing with `$MFT` and `$UsnJrnl`Discard every slack result because none can be useful

Choose how to handle a recovered directory index lead.

Continue the journey

01Parse and reviewSelect an input, choose a defensible baseline, parse it and validate important rows.Complete when you can explain the output and its limits.Beginner · Windows analysis host 02Interactive LabOperate a browser recreation of the supplied interface and investigate a recovered filename.Complete when your conclusion matches the evidence.Beginner · Browser only 03Full LabCreate a controlled NTFS change, extract INDX records and produce a reviewable case note.Complete when another analyst can reproduce the result.Beginner to intermediate · Isolated VM

PreviousFile system analysisNextParse and review INDX records