NtfsFileExtractor¶

NTFS evidence recovery

Recover a file from its NTFS record.

NtfsFileExtractor by Joakim Schicht reads an NTFS volume or image and saves selected files for examination. It can reach content that Windows Explorer does not show. Deleted content is recoverable only when its data remains available.

START WITH THE SOURCEEvidence image
LOCATE THE ENTRYMFT record
SAVE AND CHECKRecovered file

What you will learn¶

01 / SOURCE

Select¶

Confirm the image or NTFS volume belongs to your case.

02 / COLLECTION

Extract¶

Choose a record and save its files to separate storage.

03 / REVIEW

Validate¶

Check the output and explain what the evidence supports.

How the evidence moves¶

01 SourceVerified NTFS image
02 RecordIdentify an MFT entry
03 ExtractSave to evidence storage
04 ReviewInspect and hash

The Master File Table (MFT) is NTFS's file catalogue. A record number identifies an entry within one volume; it is not a filename, a byte offset, or a universal ID. Correlate the record with its source and path before extracting it.

When is this tool useful?

Use it when you need a focused copy of file content from NTFS. Keep the source, acquisition record and output together. Extraction alone cannot show who used a file.

Deleted data may be incomplete or overwritten. Inspect and hash the output before calling a recovery successful. Never run a recovered program to test it.

Accessing NtfsFileExtractor in SUSA¶

The original setup and screenshots are retained below. Use an authorised training VM for the first run. Record the download URL, repository revision, displayed version and executable SHA-256; the screenshots show v4.0.0.6, not a promise of the latest release.

Open a command prompt and navigate to C:\Tools\JoakimSchichtTools\.

Clone the GitHub repository by running:

git clone https://github.com/jschicht/NtfsFileExtractor.git

Navigate to C:\Tools\JoakimSchichtTools\NtfsFileExtractor and open NTFS_File_Extractor64 to verify the installation. Select Yes when prompted by User Account Control.

Before the first extraction

The default output is the program directory. Choose a separate evidence destination explicitly. Keep the tool and its run logs off an original evidence volume too. The screenshot's selected C: drive is an example, not a source recommendation.

Read the interface¶

Area in the screenshot	Your decision
Upper drive selector	Physical drive or shadow copy discovery when needed.
Lower volume selector	Confirm the NTFS volume you intend to read.
Choose Image / Choose Output	Set the evidence input and destination independently.
All / Deleted / Active / User Select	Choose the scope before starting.
Start Extraction	Begin the selected operation; User Select then asks for record numbers.
Logfile / Partial Init	Keep logging enabled and leave Partial Init off for these exercises.

The project README documents the source and extraction modes. The implementation shows that Logfile controls the tool's run log; it does not select the NTFS $LogFile artifact.