# Controlled NTFS Operations ## Purpose This controlled Windows/NTFS experiment creates a small, repeatable set of filesystem operations for later forensic comparison using PowerShell/API-visible timestamps, NTFS `$STANDARD_INFORMATION` (`$SI`), NTFS `$FILE_NAME` (`$FN`), and the USN Journal. **Important:** Use a disposable Windows Sandbox/VM. Do not perform this experiment against real evidence. ------------------------------------------------------------------------ # Initial Setup - Install Eric Zimmerman Forensic Tools Perform these steps before beginning the controlled NTFS operations. ## A. Open PowerShell 7 as Administrator Confirm the PowerShell version: ``` powershell $PSVersionTable ``` ## B. Create the Zimmerman Tools Directory ``` powershell New-Item -ItemType Directory -Path C:\ZimmermanTools -Force Set-Location C:\ZimmermanTools ``` ## C. Download the Official Zimmerman Tools Downloader ``` powershell Invoke-WebRequest -Uri "https://raw.githubusercontent.com/EricZimmerman/Get-ZimmermanTools/master/Get-ZimmermanTools.ps1" -OutFile ".\Get-ZimmermanTools.ps1" ``` Verify that the downloader exists: ``` powershell Get-Item .\Get-ZimmermanTools.ps1 ``` Record its SHA-256 hash: ``` powershell Get-FileHash .\Get-ZimmermanTools.ps1 -Algorithm SHA256 ``` ## D. Allow the Downloader to Run in This PowerShell Session This changes execution policy only for the current PowerShell process: ``` powershell Set-ExecutionPolicy -Scope Process Bypass -Force ``` ## E. Download the Zimmerman Toolset ``` powershell .\Get-ZimmermanTools.ps1 -Dest C:\ZimmermanTools ``` Allow the download process to complete. ## F. Verify MFTECmd Installation Locate MFTECmd: ``` powershell Get-ChildItem C:\ZimmermanTools -Filter MFTECmd.exe -Recurse | Select-Object FullName,Length,LastWriteTime ``` Record the SHA-256 hash of MFTECmd: ``` powershell Get-ChildItem C:\ZimmermanTools -Filter MFTECmd.exe -Recurse | Get-FileHash -Algorithm SHA256 ``` Run MFTECmd and confirm that its help/banner appears: ``` powershell C:\ZimmermanTools\net9\MFTECmd.exe ``` The tool should display its command-line options. Confirm that `--at` is available. This option includes all timestamps from NTFS `0x30` (`$FILE_NAME`) attributes during later MFT analysis. ## G. Record the Installed Zimmerman Tools ``` powershell Get-ChildItem C:\ZimmermanTools -Recurse -Filter *.exe | Select-Object FullName,Length,LastWriteTime ``` ## H. Do Not Analyze the Live MFT At this stage, install and verify the tools only. Do not attempt to parse or copy the live `C:\$MFT`. The controlled operations below will be performed in the disposable Windows VM. After the operations are complete, acquire the NTFS volume as an E01 or raw forensic image. The image will then be used for `$MFT`, `$STANDARD_INFORMATION`, `$FILE_NAME`, and `$UsnJrnl` analysis. ------------------------------------------------------------------------ ## 0. Create the Test Directory and Record the Environment Create and enter the working directory: ``` powershell New-Item -ItemType Directory -Path C:\ForensicTest -Force Set-Location C:\ForensicTest ``` Record the current environment: ``` powershell Get-Date -Format o w32tm /query /status fsutil behavior query disablelastaccess Get-Volume C ``` **Forensic question:** What system time, NTFS volume, and LastAccessTime policy existed when the experiment began? ------------------------------------------------------------------------ ## 1. Create the Baseline Evidence File Create the controlled source file: ``` powershell "FORENSIC TIMESTAMP VALIDATION" | Set-Content .\Original.txt $F = "C:\ForensicTest\Original.txt" ``` Assign known UTC timestamps: ``` powershell [IO.File]::SetCreationTimeUtc($F, "2024-01-02T02:54:05Z") [IO.File]::SetLastWriteTimeUtc($F, "2024-01-02T03:04:05Z") [IO.File]::SetLastAccessTimeUtc($F, "2024-01-02T03:14:05Z") ``` Record the baseline: ``` powershell Get-Item $F | Select-Object FullName,Length,CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash $F -Algorithm SHA256 ``` **Forensic question:** What do `$SI` and `$FN` contain after timestamps are intentionally set through Windows APIs? ------------------------------------------------------------------------ ## 2. Hash / Read the Original ``` powershell Start-Sleep 5 Get-FileHash $F -Algorithm SHA256 Get-Item $F | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc ``` **Forensic question:** Can reading/hash calculation affect `LastAccessTime` even though file content and SHA-256 remain unchanged? ------------------------------------------------------------------------ ## 3. Normal Copy-Item ``` powershell Copy-Item $F C:\ForensicTest\CopyItem.txt Get-Item .\CopyItem.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc Get-FileHash .\CopyItem.txt -Algorithm SHA256 ``` **Forensic question:** Which timestamps are inherited, and which belong to the newly created NTFS destination object? ------------------------------------------------------------------------ ## 4. Copy-Item -Force Create a pre-existing destination and then overwrite it: ``` powershell "OLD CONTENT" | Set-Content .\CopyForce.txt Start-Sleep 5 Copy-Item $F .\CopyForce.txt -Force Get-Item .\CopyForce.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\CopyForce.txt -Algorithm SHA256 ``` **Forensic question:** What actually happens when `-Force` overwrites an existing NTFS object? **Teaching point:** `-Force` should not be assumed to mean preserve forensic timestamps. ------------------------------------------------------------------------ ## 5. Robocopy /COPY:DAT ``` powershell New-Item -ItemType Directory C:\ForensicTest\RoboDAT -Force robocopy C:\ForensicTest C:\ForensicTest\RoboDAT Original.txt /COPY:DAT /R:0 /W:0 Get-Item .\RoboDAT\Original.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\RoboDAT\Original.txt -Algorithm SHA256 ``` **Forensic question:** What does Data + Attributes + Timestamps (`DAT`) preservation actually look like at the NTFS `$SI` and `$FN` layers? ------------------------------------------------------------------------ ## 6. Robocopy /COPYALL ``` powershell New-Item -ItemType Directory C:\ForensicTest\RoboALL -Force robocopy C:\ForensicTest C:\ForensicTest\RoboALL Original.txt /COPYALL /R:0 /W:0 Get-Item .\RoboALL\Original.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-Acl $F | Format-List Get-Acl .\RoboALL\Original.txt | Format-List Get-FileHash .\RoboALL\Original.txt -Algorithm SHA256 ``` **Forensic question:** What additional NTFS metadata does `/COPYALL` preserve compared with `/COPY:DAT`? ------------------------------------------------------------------------ ## 7. Same-Volume Rename ``` powershell Copy-Item $F .\BeforeRename.txt Get-Item .\BeforeRename.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\BeforeRename.txt -Algorithm SHA256 Start-Sleep 5 Rename-Item .\BeforeRename.txt AfterRename.txt Get-Item .\AfterRename.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\AfterRename.txt -Algorithm SHA256 ``` **Forensic question:** Which `$SI` and `$FN` values change when the filename changes but the file remains on the same NTFS volume? ------------------------------------------------------------------------ ## 8. Modify File Contents ``` powershell Copy-Item $F .\Modified.txt Start-Sleep 5 Add-Content .\Modified.txt "CONTENT MODIFIED" Get-Item .\Modified.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\Modified.txt -Algorithm SHA256 ``` **Forensic question:** Which NTFS timestamps respond to an actual content modification? ------------------------------------------------------------------------ ## 9. Change Metadata Only ``` powershell Copy-Item $F .\AttributeChange.txt Start-Sleep 5 attrib +R .\AttributeChange.txt Get-Item .\AttributeChange.txt | Select-Object CreationTimeUtc,LastWriteTimeUtc,LastAccessTimeUtc,Attributes Get-FileHash .\AttributeChange.txt -Algorithm SHA256 ``` **Forensic question:** Can NTFS metadata change while file content and SHA-256 remain unchanged? ------------------------------------------------------------------------ ## 10. Delete a Controlled File ``` powershell Copy-Item $F .\DeleteMe.txt Start-Sleep 5 Remove-Item .\DeleteMe.txt Test-Path .\DeleteMe.txt ``` Expected result: ``` text False ``` **Forensic question:** What evidence of the create/delete sequence remains in `$UsnJrnl` and potentially `$MFT`? ------------------------------------------------------------------------ # Expected Final Directory ``` text C:\ForensicTest\ Original.txt CopyItem.txt CopyForce.txt AfterRename.txt Modified.txt AttributeChange.txt RoboDAT\ Original.txt RoboALL\ Original.txt ``` `DeleteMe.txt` should intentionally be absent. ------------------------------------------------------------------------ # STOP - Preserve the Filesystem After completing Operation 10, do not perform additional experimental file operations in the VM. Acquire the NTFS volume using an appropriate forensic acquisition method. Preserve the filesystem context needed to examine: - `$MFT` - `$STANDARD_INFORMATION` (`$SI`) - `$FILE_NAME` (`$FN`) - `$Extend\$UsnJrnl` - `$J` - File content and associated NTFS metadata An E01 or raw forensic image of the NTFS volume is appropriate for this controlled experiment. ------------------------------------------------------------------------ # Core Forensic Principles Being Tested 1. **Hash equality proves content equality - not metadata equality.** 2. **Reading content can have filesystem-metadata consequences.** 3. **Copying a file can create a new filesystem object even when content is identical.** 4. **Preserve timestamps must identify exactly which timestamps and which NTFS attributes are being discussed.** 5. **Never interpret a timestamp in isolation - correlate `$SI`, `$FN`, `$UsnJrnl`, and other relevant artifacts.** **Lab mantra:** Measure -\> Preserve -\> Transfer -\> Verify -\> Explain every difference.