Parse and Review INDX Records

A repeatable examination workflow

Start with a question, finish with a qualified finding

Indx2Csv turns binary directory index records into rows you can examine. The useful result is not simply a CSV file: it is a traceable answer that identifies the source, parser settings, relevant row, corroborating artefact and limitation.

Use a baseline pass first. Add slack, Unicode handling or deeper scan modes in separate recovery passes so another analyst can tell which setting produced each row.

1ScopeDefine the directory and question

2BaselineParse conservatively

3RecoverChange one option at a time

4CorroborateTest names, references and time

5ReportState support and limits

1. Record the source before opening it

Create a small manifest beside the working copy. This separates known facts from parser interpretation.

Record	Example	Why it matters
Case and exhibit	DFIR-218 / E01	Connects the export to its authority and source.
Source volume	TRAINING, NTFS	Directory indexes are volume specific.
Input	Finance.wfixups.INDX	Identifies the exact extracted record set.
Extraction method	IndxCarver, standard pass	Explains how candidate records were selected.
SHA-256	Hash of the input	Detects an accidental change to the working copy.
Time basis	UTC	Makes comparisons across tools explicit.
Tool identity	filename, displayed version, repository revision	Makes the result reproducible.

Prefer extracted record sets

The tool author recommends using IndxCarver as the extraction step. Its separated outputs help distinguish records with valid fixups, records requiring different handling and false positive candidates. Keep those groups separate when you parse them.

2. Run a conservative baseline

Input

Choose the extracted INDX group that matches the target volume, directory and fixup state. Never select a previous CSV as though it were evidence.

Time

Use format 6, NanoSec precision and one explicit zone, commonly UTC 0.00. Record any conversion you make.

Structure

Confirm INDX Size from the source; 4096 is common. Start at Scan mode 0 and enable fixups only when the extracted group requires them.

Output

Use a dedicated case output folder, a recorded delimiter such as |, and dump everything when you need the richest reviewable output.

For the first pass, leave Slack off and retain the default strict name checking. This produces a useful control: allocated or normally decoded entries before recovery options increase the search surface.

The supplied interface. Select the source and output first, then verify every setting before starting the parser.

GUI sequence

1. Select Change Output and create a run specific folder such as output\baseline.
2. Select Browse INDX and choose the verified extracted record group.
3. Set timestamp format, precision, zone, delimiter, output format, scan mode, fixups and INDX size from your notes.
4. Leave Slack and Unicode off for the baseline unless the case plan already justifies them.
5. Select Start Parsing and preserve the tool log with the output.
6. Record the output filename, row count, start/end time and SHA-256 value.

Fixups are a source property

Do not toggle Apply fixups until a run succeeds. Match the option to how the records were extracted. The command line default is enabled; an input explicitly identified as wofixups commonly requires /Fixups:0.

3. Add a documented recovery pass

If the baseline does not answer the question, duplicate the run notes and change one recovery dimension at a time.

Recovery choice	Use it when	Record this limitation
Slack on	Looking for stale or unallocated index entries	A hit can be historical, overwritten or a false positive.
Unicode on	Names do not decode adequately	The author warns that Unicode plus Slack can reduce output quality. Compare both runs.
Scan mode above 0	Ordinary structure parsing misses a known fragment	Deeper modes increase candidate volume and noise. Preserve the chosen value.
Fragment verification	Examining a damaged or carved fragment	A valid looking fragment still needs source and structural context.
Strict name check off	Testing whether validation rejected a lead	Relaxing checks increases the burden of corroboration.

Name outputs so the settings remain visible, for example baseline-s0, slack-s0 and slack-s4. Never overwrite the baseline.

4. Make a reproducible command line

The GUI is convenient for exploration. A command line is easier to retain in a case note. Adapt these examples to the executable and paths you verified:

Indx2Csv64.exe /IndxFile:C:\Cases\DFIR-218\Finance.wfixups.INDX /OutputPath:C:\Cases\DFIR-218\output\baseline /TimeZone:0 /TSFormat:6 /TSPrecision:NanoSec /Separator:^| /ScanMode:0 /Slack:0 /Fixups:1 /IndxSize:4096 /OutputFormat:all

Indx2Csv64.exe /IndxFile:C:\Cases\DFIR-218\Finance.wfixups.INDX /OutputPath:C:\Cases\DFIR-218\output\slack /TimeZone:0 /TSFormat:6 /TSPrecision:NanoSec /Separator:^| /ScanMode:0 /Slack:1 /Unicode:0 /Fixups:1 /IndxSize:4096 /OutputFormat:all

The caret before | escapes the pipe in cmd.exe. If you run the command from another shell, use that shell's quoting rules and save the exact command that executed.

5. Read a row as a claim to test

Name

Is it complete, plausible for the directory and consistently decoded across runs?

File reference

Compare the MFT entry number and sequence value. Matching both is stronger than matching a name alone.

Record state

Distinguish a normal decoded entry from a slack or fragment result in every note and export.

Time fields

Confirm the configured zone and field meaning before ordering events. Do not infer activity from one timestamp alone.

Indx2Csv documentation labels the four decoded times as follows. These labels do not always match the shorthand an analyst expects, so retain the output headers and explain your mapping:

Output label	Documented meaning
CTime	File creation time
ATime	File modified time
MTime	MFT entry modified time
RTime	File last access time

Corroboration order

1. Compare the full file reference, including sequence value, with $MFT output.
2. Check the USN Journal for create, rename, move, close or delete reasons involving the same reference.
3. Compare the parent directory reference and surrounding names.
4. Check whether the row appears only with Slack, relaxed name checks or a deeper scan.
5. Use source metadata, logs or file content for any claim beyond a directory entry lead.

Interpretation checkA slack row names draft-merger-notes.docx at file reference 41220:2. The USN Journal records a rename from that name to board-pack.docx for 41220:2. What can you report?

The two artefacts support an earlier name and later rename for the same file record instanceThe logged on user definitely performed the renameThe recovered document contained merger plans

Choose the narrowest supported conclusion.

6. Write the finding another analyst can review

Question:
Source and extraction method:
Input/output SHA-256:
Indx2Csv identity and exact settings:
Relevant row, state and file reference:
Independent corroboration:
Finding and confidence:
Alternative explanations:
What the evidence does not establish:

Defensible wording

The Slack enabled Indx2Csv pass recovered the name draft-merger-notes.docx from the extracted Finance directory index at file reference 41220:2. An independently parsed USN Journal records RENAME_OLD_NAME and RENAME_NEW_NAME for the same file reference instance, ending as board-pack.docx. Together, these artefacts support that the same file instance previously used the recovered name. They do not identify the actor or establish document content.

Troubleshooting

Symptom	Check first
No output rows	Confirm input type, file size, INDX size, fixup state and whether the tool log reports decoded records.
Output is unreadable	Verify delimiter, quotation and Unicode settings; open the file with an explicit encoding and separator.
Names are implausible	Return to Scan mode 0 and strict name checking; compare a no Slack run before treating candidates as leads.
Times disagree with another tool	Compare time zone conversion, precision and field mapping. Preserve raw values.
Too many recovery hits	Filter by source record, parent reference, full file reference and expected directory; raise scan depth only with a reason.

Parameter names, defaults and examples on this page follow the official Indx2Csv project documentation. Verify them against the executable retained with your case.

PreviousOverview and setupNextPractice with Indx2Csv