IndxCarver Hands on Labs

Choose the Interactive Lab to practise the command and evidence decisions in a browser. Use the Full Lab to build a controlled NTFS event, carve records from a verified image and prepare a finding that another analyst can review.

Interactive Lab

Browser based

IndxCarver Interactive Lab

Expand labOpen in new tab

✓ No installation

The Command Prompt simulation requires JavaScript. You can still complete the real tool Full Lab below.

Full Lab

Isolated Windows lab

IndxCarver Full Lab

Windows VM and disposable NTFS volume required

Hands on Proof of Concept

Carve the records. Test the lead. Explain the limit.

Recover NTFS directory index candidates from a verified source, preserve the complete output set and decide which records are suitable for deeper parsing.

Start the Full Lab

Outcome led, not screenshot led

This lab gives you a case question, checkpoints and expected results. File counts and recovered offsets can differ because NTFS reuse is not deterministic. Record meaningful differences and accept a well documented negative result.

Use only disposable, authorised evidence

Build this scenario on an NTFS virtual disk you own or are authorised to change. Protect the image, work from a verified copy and send every IndxCarver and parser output to separate controlled storage.

Before you begin

You need: one isolated Windows analysis VM, administrator access, a disposable NTFS VHDX or secondary virtual disk, an approved raw imaging utility, IndxCarver, Indx2Csv, a hashing utility and space for the image plus outputs.

How to use this lab

Save the requested evidence at each milestone. If an expected output is missing, stop at that boundary and check the source, command, destination and log before changing the investigation scope.

Recommended first

Beginner Core Lab

Create one known rename, image the disposable volume, carve its INDX records and parse the fixup valid candidate set.

Optional extension

Compare a damaged source

Work from a copy of the image, truncate a bounded region or use a known damaged training sample, then compare the fixup valid and fixup skipped results without changing the protected core evidence.

1. Session 1Build and image
2. Session 2Carve and verify
3. Session 3Parse and report

Objective

You are supporting case DFIR-218. The current Finance directory contains board-pack.docx. The case owner asks whether recoverable NTFS directory metadata supports the earlier name draft-merger-notes.docx. Build a known event on a disposable volume, use IndxCarver to recover candidate INDX records, parse the strongest group and report what the result does and does not establish.

01

Activity 1: Build and preserve the source

1. Create and attach a disposable NTFS VHDX or secondary virtual disk. Label it INDX-LAB and record its drive letter, volume serial number, NTFS status, allocation unit size, system time and time zone.
2. Take a clean VM snapshot named pre-indxcarver-lab.
3. Create X:\Cases\Finance, replacing X: with the disposable drive letter.
4. Populate the directory so NTFS is more likely to use $INDEX_ALLOCATION records:

$LabDirectory = 'X:\Cases\Finance'
New-Item -ItemType Directory -Path $LabDirectory -Force | Out-Null
1..250 | ForEach-Object {
  Set-Content -LiteralPath (Join-Path $LabDirectory ('invoice-{0:D3}.txt' -f $_)) -Value "Controlled lab file $_"
}

1. Create the known old name, record the UTC time and rename it:

$Target = Join-Path $LabDirectory 'draft-merger-notes.docx'
Set-Content -LiteralPath $Target -Value 'Synthetic training document. No real case data.'
(Get-Date).ToUniversalTime() | Tee-Object -FilePath (Join-Path $LabDirectory 'ground-truth-utc.txt')
Rename-Item -LiteralPath $Target -NewName 'board-pack.docx'

1. Record the old name, new name, path and UTC time in a ground truth worksheet. Avoid further activity on the disposable volume.
2. Shut down the VM cleanly. Use an approved acquisition tool to create a raw image of the disposable volume. Record source, destination, tool and version, start and finish times, image size and verification hashes.
3. Protect the acquired image and create a verified working copy named INDX-LAB-working.raw for IndxCarver.

Milestone 1Known source preservedThe controlled rename, volume identity, acquisition record, image hashes and verified working copy are attributable to the same disposable source.

Expected result The normal directory view shows `board-pack.docx`; the worksheet records the earlier name, and the raw image and working copy have matching recorded hashes.

02

Activity 2: Carve and verify

1. Record the IndxCarver executable name, displayed version, repository revision or acquisition date and SHA-256 value.
2. Create an empty folder on separate evidence storage, such as X:\DFIR-218\indxcarver. Keep it away from the image and tool directory.
3. Open Command Prompt, move to the IndxCarver directory and run:

IndxCarver64.exe /InputFile:D:\DFIR-218\working\INDX-LAB-working.raw /OutputPath:X:\DFIR-218\indxcarver

1. Record the exact command, start and finish times, visible messages and whether the prompt returned normally.
2. Confirm the output directory contains the timestamped .log, .wfixups.INDX, .wofixups.INDX and .false.positives.INDX files. An empty group is still a result worth recording.
3. Read the log. Record the input, candidate counts, false positive offsets, errors and output names.
4. Hash all generated files and record their sizes. Keep their common timestamped prefix intact.
5. Explain why .wfixups.INDX is the first parsing target and why it is still a candidate set rather than proof of a live file.

Do not tune toward the expected answer

The old name may not survive in recoverable index data. If it is absent, preserve the negative result. Do not switch inputs, ignore validation groups or widen the source merely to force a match.

Milestone 2Carve preservedThe complete output set, log, hashes, command and timing remain attributable to one verified working image.

Expected result The four output types are accounted for, the log explains the scan, and the fixup valid group is ready for a separate parser workflow.

03

Activity 3: Parse and report

1. Create separate parser output folders for wfixups and, if justified, wofixups. Never mix rows from the two source groups.
2. Use Indx2Csv or another validated INDX parser to decode .wfixups.INDX. Record the parser version, input hash, settings, output path, log, row count and output hash.
3. Search for board-pack.docx and draft-merger-notes.docx. If either appears, record its recovery state, complete file reference, parent reference and decoded timestamps.
4. Compare any old name lead with the ground truth worksheet. If you perform the optional route, compare it with independently parsed $MFT or $UsnJrnl evidence.
5. If you review .wofixups.INDX, keep that result visibly labelled as coming from candidates that did not pass the first fixup validation attempt.
6. Write a case note using this structure:

Case and question:
Source image and working-copy hashes:
IndxCarver version, hash and command:
Output groups, counts and hashes:
Parser version, settings and output:
Relevant observation and source group:
Corroboration or ground-truth comparison:
Conclusion and confidence:
Limitations and alternative explanations:

1. State explicitly that a carved entry does not by itself prove current allocation, file content, execution, user intent or who performed the rename.

Milestone 3Finding ready for reviewAnother analyst can reproduce the carve, identify the confidence group, locate the parsed row and understand the conclusion and limitations.

Expected result The case note reports either a bounded historical name lead or a defensible negative result without treating a carved candidate as a live file.

Compare the fixup skipped group

Parse .wofixups.INDX into a separate folder. Compare its accepted row count, damaged or truncated fields and relevant names with the fixup valid run. Document whether the added recovery value justifies the weaker structural basis. Do not merge the two outputs.

Full Lab evidence checklist

This checklist applies to the isolated Full Lab. If you completed the Interactive Lab, retain its downloaded investigation summary instead.

• Core completion

  Required to demonstrate a safe, attributable carve and review.

  • Case question, authority, disposable volume identity, time context and clean snapshot.
  • Known rename worksheet with old name, new name, path and UTC time.
  • Acquisition tool, source, image path, timing, size and verification hashes.
  • IndxCarver executable, version, provenance and SHA-256 value.
  • Exact input, output path, command, start and finish times.
  • Log and all three INDX groups with sizes and hashes.
  • Parser version, source group, settings, output location and output hash.
  • Observation, corroboration, conclusion, confidence and limitations.

• Good analyst practice

  Supplementary records that strengthen review and reproducibility.

  • Candidate counts, errors and relevant source offsets recorded from the log.
  • Outputs protected, training material removed and disposable VM restored.

0 of 10 recorded Mark each item when you have saved the evidence.Reset

Troubleshooting

Symptom	First check
The file picker opens instead of a scan	Confirm the /InputFile: switch and that the file path exists
Files are written beside the executable	Stop and rerun with an explicit /OutputPath: on separate storage
No .wfixups.INDX candidates are produced	Confirm the source and read the log; retain the negative result rather than forcing a match
The output folder contains files from multiple runs	Move to a new empty case linked folder and preserve the mixed folder as a documented failed attempt
Indx2Csv rejects a group	Confirm the selected group and fixup handling; keep wfixups and wofixups runs separate
A relevant filename has no reliable parent	Report a filename lead and seek $MFT, $UsnJrnl or another directory record for context

Clean up

Protect the image, carve outputs, parser outputs and case note. Remove harmless training material, detach the disposable volume, clear temporary access and restore the VM to its recorded snapshot when appropriate.

PreviousCarve and reviewNextReturn to the IndxCarver overview