IndxCarver

What IndxCarver does

NTFS directory index recovery

IndxCarver, by Joakim Schicht, scans an input file for NTFS INDX record signatures and checks the structure of each candidate. It is useful when healthy directory indexes are unavailable, such as when an examiner has a memory image, a damaged volume image or a bounded chunk of unallocated data.

The tool writes recovered records into separate groups according to whether NTFS fixup validation succeeded. This separation helps you decide what to parse first and which candidates need more caution. IndxCarver recovers record containers; a parser such as Indx2Csv is still needed to turn those records into reviewable directory entries.

Learn the workflowTry the Interactive Lab

Version aware guidance

The supplied screenshot shows IndxCarver 1.0.0.5. The official repository provides 32-bit and 64-bit executables rather than a conventional packaged release. Record the executable name, displayed version, repository revision or acquisition date, source URL and SHA-256 value for the copy used in a case.

Where it fits in an investigation

01PreserveProtect the original and verify a working input file

02CarveScan for candidate INDX records

03SeparateKeep fixup valid, fixup skipped and false positive groups distinct

04DecodeParse candidates and test important entries against another artefact

Strong use case

Recover directory index records from a verified unallocated data chunk or memory image when normal filesystem traversal cannot provide the required directory context.

Important limit

A carved signature is a candidate, not proof that a file currently exists. The source can contain stale, fragmented, damaged or coincidental data, and an individual record may no longer have reliable path context.

Understand the input boundary

• The input must be a file
  IndxCarver does not take a physical drive identifier as its command line input. Supply an image, memory dump or exported data chunk created through an authorised acquisition workflow.
• A smaller input can be easier to defend
  If the case question concerns unallocated space from one verified volume, a documented exported chunk reduces scan time and makes the examined boundary clear.
• Use a verified working copy
  Record the source identifier and hash before scanning. Keep the original protected and write every generated file to a separate case folder.
• Retain the acquisition context
  A carved record is easier to interpret when the volume, byte range, acquisition tool, time context and export method remain available.

Read the four outputs

Review first

.wfixups.INDX

Candidates for which the update sequence array was verified and fixups were applied. These usually provide the strongest starting set, but they still require parsing and source correlation.

Review carefully

.wofixups.INDX

Candidates retained after fixup validation did not succeed and the tool retried without applying fixups. Damage, reuse or incomplete data can affect interpretation.

Triage, do not promote

.false.positives.INDX

Signature hits that failed the tool's structural tests. Keep them with the run when relevant, but do not treat the filename or signature alone as a valid directory record.

Preserve with every run

.log

The verbose run record includes candidate and false positive offsets. It connects each output set to the scan and helps another analyst review exclusions or return to the source bytes.

Install and open

1

Prepare the tools directory

Install Git for Windows, open Command Prompt and change to C:\Tools\JoakimSchichtTools.

2

Clone the official repository

Record the repository revision and hash the executable before case use. The project includes separate 32-bit and 64-bit builds.

3

Check the executable

Run IndxCarver64.exe without arguments on a 64-bit analysis host. It displays the version and opens a file picker. Cancel the picker after confirming the tool starts.

cd /d C:\Tools\JoakimSchichtTools
git clone https://github.com/jschicht/IndxCarver.git
cd IndxCarver
IndxCarver64.exe

Preserved setup screenshot: clone the repository into the controlled tools directory.

Preserved tool screenshot: starting the executable without an input parameter opens a file picker. A recorded command is preferable for repeatable case work.

Understand the command

IndxCarver64.exe /InputFile:D:\DFIR-218\working\unallocated.bin /OutputPath:X:\DFIR-218\carved

ExecutableUse the build that matches the analysis host.InputPoint to the verified image or exported chunk.OutputUse a separate, case linked directory.

If /InputFile: is omitted, IndxCarver opens a file picker. If /OutputPath: is omitted, output defaults to the program directory. For case work, specify both parameters so the run can be repeated and generated evidence does not become mixed with the tool files.

What the tool can establish

• It can identify structurally plausible INDX records
  The tool searches for signatures and validates record structure, including an initial fixup attempt.
• It cannot restore full filesystem context by itself
  A carved record may lack its live parent path, current allocation state or surrounding filesystem relationships.
• A successful fixup improves confidence, not certainty
  The wfixups group should be reviewed first, but every important entry still needs decoding and corroboration.
• The log is part of the evidence trail
  Preserve candidate counts, offsets, errors, output filenames and hashes instead of retaining only the most promising record group.

Analyst decisionIndxCarver creates all three INDX groups and a log. Which is the most defensible first action?

Hash every output, read the log and parse the `.wfixups.INDX` set firstKeep only `.wfixups.INDX` and delete the restTreat every false positive hit as a recovered file

Choose how to begin reviewing a completed carve.

Continue the journey

01Carve and reviewPrepare a verified input, run the command, preserve all four outputs and hand valid candidates to a parser.Complete when another analyst can reproduce the scan.Beginner · Windows analysis host 02Interactive LabUse a realistic Command Prompt simulation to carve a bounded input and classify the returned evidence.Complete when your evidence decision matches the evidence.Beginner · Browser only 03Full LabCreate a controlled rename, export unallocated data and complete a traceable IndxCarver-to-Indx2Csv workflow.Complete when the finding and its limits are reviewable.Beginner to intermediate · Isolated VM

PreviousFile system analysisNextCarve and review INDX records