NtfsFileExtractor Hands on Labs

Choose the Interactive Lab for a guided browser investigation, or use the Full Lab to extract and validate actual training files in a Windows VM.

Interactive Lab

Browser based

NtfsFileExtractor Interactive Lab

Expand labOpen in new tab

No installation

Enable JavaScript for the simulation. The Full Lab below provides a complete real tool exercise without it.

Full Lab

Self hosted

NtfsFileExtractor Full Lab

Windows VM and separate evidence disk required

Objective

Hands on file recovery proof of concept

Locate it. Extract it. Prove the match.

Case NFE-1042: recover a known handover document and demonstrate that the extracted bytes match the original training baseline. You will first extract the MFT, find the document's record, then collect just that document. The core lab uses an active file for a repeatable result; deleted file recovery is an optional extension.

Start the Full Lab

Prerequisites and resources

Training endpoint

Disposable Windows x64 VM; administrator rights; NTFS C:; NtfsFileExtractor; MFT Explorer or Mft2Csv. Start with 2 vCPU and 4 GB RAM, adjusting for your Windows version.

Evidence destination

A separate writable disk shown as E:, with several GB free for metadata and outputs. Confirm actual capacity before extraction. Keep exported evidence outside storage that will be rolled back.

Use your actual drive letters consistently. A second folder on C: is not a separate disk. The setup deliberately creates harmless evidence on a training VM; do not run it against original case evidence. Record the OS, versions, clock/time zone and source/destination disk identities. Snapshot the VM before setup.

1. Session 1Prepare a known document
2. Session 2Collect metadata and content
3. Session 3Verify and report

01

Activity 1: Build the environment

Your outcome: a known document with a saved baseline, ready for extraction.

1. Complete Overview and setup. Record the repository revision, displayed version and tool hash.
2. Prepare the separate E: evidence disk. Put a working copy of the tool on E: too, because it can write application logs beside its executable.
3. In PowerShell inside the training VM, run the setup below once. It stops if the case folder or training file already exists; inspect previous work before repeating.

$nfeCase = 'E:\Cases\NFE-1042'
$nfeTraining = 'C:\DFIR-Lab\handover-NFE1042.txt'
if ((Test-Path -LiteralPath $nfeCase) -or
    (Test-Path -LiteralPath $nfeTraining)) {
    throw 'Existing exercise found. Inspect your previous evidence before repeating.'
}
New-Item -ItemType Directory -Path $nfeCase | Out-Null
'metadata','document','working' | ForEach-Object {
    New-Item -ItemType Directory -Path (Join-Path $nfeCase $_) | Out-Null
}
New-Item -ItemType Directory -Path 'C:\DFIR-Lab' -Force | Out-Null
Set-Content -LiteralPath $nfeTraining -Encoding ASCII -Value 'NFE-1042: handover approved for training.'
Get-Item -LiteralPath $nfeTraining |
    Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$nfeCase\baseline-details.csv" -NoTypeInformation
Get-FileHash -LiteralPath $nfeTraining -Algorithm SHA256 |
    Export-Csv -LiteralPath "$nfeCase\baseline-sha256.csv" -NoTypeInformation

1. Open the text file and baseline CSVs. Predict that a focused extraction from its current record should return the same content and hash. Leave the file unchanged during the core lab.

Milestone 1Baseline savedYour notes identify the VM, source volume, separate output disk, tool and known document.

Stop here if setup fails

Check that E: is the intended separate disk and is writable. If the guard reports existing work, retain it and use a fresh case identifier throughout the exercise. Do not delete old evidence just to make the commands run.

Save the first two evidence checkpoints below. Good stopping point: shut down the VM cleanly; retain E: and your notes for the next session.

02

Activity 2: Extract the record and document

Your outcome: a targeted document extraction you can trace back to the training volume.

01 · Collect the metadata

1. Run the E: copy of NtfsFileExtractor with administrator rights. Select the training C: volume in the lower selector. Confirm its identity and size.
2. Choose Output → E:\Cases\NFE-1042\metadata. Keep Logfile on and Partial Init off.
3. Choose User Select → Start Extraction, then enter 0,2. Save settings, times and the resulting application log from the executable directory.
4. Inspect the output recursively, locate $MFT and $LogFile, and check their sizes and errors. Follow Run, inspect and preserve to save a hash manifest.

Do not compare hashes of separately captured live MFTs as if the filesystem had stood still. Your verification here establishes the identity of retained outputs and their working copies.

02 · Find the document's entry number

Copy the extracted MFT to the case's working folder; hash both copies and confirm equality. Open the working copy in your chosen parser. Search for handover-NFE1042.txt, confirm the C:\DFIR-Lab parent path and active status, and save the matching row with its decimal MFT entry number and sequence number as separate fields where available.

Your entry number will differ from the simulation's 7421. Do not copy the simulation number into the real tool. If the row is missing, check the selected source and parser load status before collecting again.

03 · Extract only the document

Reopen NtfsFileExtractor if needed. Reselect the same training volume, set Output to E:\Cases\NFE-1042\document, select User Select and Start Extraction, then enter your confirmed decimal entry number. Preserve this run's log and settings separately. Find the resulting document under the output tree; retain its generated path and name.

If the extraction fails, preserve the error and retry into a new folder after resolving it. A retry must remain distinguishable from the first run.

Milestone 2Targeted output retainedThe parser row, selected index and extraction log connect your output to the training source.

Save the next three evidence checkpoints. Stop here with logs and outputs intact if you need another session.

03

Activity 3: Verify and explain

Your outcome: a concise finding supported by saved evidence.

1. Open the extracted harmless text and compare it with the training sentence. Check its size against baseline-details.csv.
2. In PowerShell, set $nfeRecovered to the actual full output path, then run the comparison. Do not point it at the source file.

$nfeRecovered = Read-Host 'Paste the full path of the extracted document on E:'
$nfeExpected = (Import-Csv -LiteralPath 'E:\Cases\NFE-1042\baseline-sha256.csv').Hash
$nfeActual = (Get-FileHash -LiteralPath $nfeRecovered -Algorithm SHA256).Hash
[pscustomobject]@{
    Output = $nfeRecovered
    ExpectedSHA256 = $nfeExpected
    ActualSHA256 = $nfeActual
    Match = ($nfeActual -eq $nfeExpected)
} | Export-Csv -LiteralPath 'E:\Cases\NFE-1042\verification.csv' -NoTypeInformation

1. Open verification.csv. Match = True, matching content/size and no unresolved extraction errors are the expected result. If the hash differs, preserve the discrepancy and investigate source changes or wrong record selection.
2. Write the case note using the template below. State that this was a live training extraction. Neither the match nor the MFT row identifies who used the document.
3. Copy notes and evidence outside rollback storage and check they open there. Only then restore the disposable VM's recorded snapshot.

Case / analyst / time zone:
Source host, volume and acquisition context:
Tool version, revision and executable hash:
MFT parser version, entry number, path and status:
Output paths, sizes, run times and logs:
Baseline SHA-256 / recovered SHA-256 / comparison:
Observation and confidence:
Errors, live-source changes and recovery limits:
Next evidence to examine / cleanup record:

Milestone 3Reviewable findingAnother learner can trace the recovered document to your source and reproduce the integrity comparison.

Full Lab evidence checklist

Mark each item after saving its evidence. Progress is self reported; this page cannot verify your VM.

• Core completion

  • VM, clock, disk identities, snapshot and tool provenance saved.
  • Known document details, content and baseline SHA-256 saved.
  • Metadata output, manifest, settings and first run log retained.
  • MFT working copy hash verified and matching parser row saved.
  • Targeted record number, document output and second run log retained.
  • Content, size and complete SHA-256 comparison saved.
  • Finding explains live collection, uncertainty and next evidence.
  • Evidence exported and checked before VM rollback; cleanup recorded.

0 of 8 evidence checkpoints saved.

Start Activity 1

Self reported progress is saved in this browser. Retain your evidence separately.

Optional extension · A deleted file recovery experiment

After saving the core evidence, create a second harmless training file on a small disposable NTFS volume and record its path, content and hash. Delete only that test file, then stop using that volume and acquire a training image with your validated imaging workflow. Preserve the image hash. Use Choose Image and the Deleted mode on its verified working copy, writing to a new destination.

Compare any recovered content with the pre deletion baseline. Success is not guaranteed: allocation changes, overwrites and storage behaviour can prevent recovery. A documented failed or partial recovery is a valid experimental result. It does not prove that no document existed. Preserve the deleted naming prefix, logs and interpretation; never seed or delete files on real case evidence.

Instructor debrief

Ask the learner to show the baseline, source/record mapping, retained document and hash comparison. Have them explain why the tool's Logfile option differs from record 2, why the output disk matters, and what a hash mismatch would change in their report. Credit a well documented failed extraction with an appropriate next check; do not reward an unsupported claim of complete recovery.

PreviousExtract and verifyNextReturn to overview