How natesec/mftguard works
MFTGuard is a command-line DFIR triage tool that accepts a raw $MFT file and sector size, then scans records and writes a JSON report of suspect candidates and aggregate statistics. The documented pipeline includes structural validation, USA fixup, $SI/$FN extraction, timestamp rules, candidate tracking, statistical analysis, and reporting. README descriptions support these capabilities; source excerpts show main’s orchestration and selected calls, so unsampled internal wiring is left out. Independent artifact correlation is an investigator follow-up, not an implemented runtime stage.
Main entry points: main.c Scan Orchestrator · report.c JSON Report · mft.c MFT Reader · rules.c Detection Rules
Components 12
Record Scanning
- Scan Orchestrator
src/main.c - MFT Reader
src/mft.c - USA Fixup
src/fixup.c - Attribute Parser
src/attributes.c
Timestamp Analysis
- Detection Rules
src/rules.c - Timestamp Utilities
src/timestamps.c
Triage Results
- Statistics
src/statistics.c - Candidate Store
src/candidate.c - JSON Report
src/report.c
Other components
- Investigator
- Raw $MFT
- JSON Output
Connections 14
- Investigator → Scan Orchestrator: invokes
- Raw $MFT → MFT Reader: provides bytes
- Scan Orchestrator → MFT Reader: opens and reads
- MFT Reader → USA Fixup: applies fixup
- MFT Reader → Attribute Parser: walks attributes
- Scan Orchestrator → Detection Rules: evaluates metadata
- Detection Rules → Timestamp Utilities: compares times
- Scan Orchestrator → Statistics: collects outcomes
- Scan Orchestrator → Candidate Store: stores flagged records
- Scan Orchestrator → JSON Report: initializes and writes
- JSON Report → Statistics: reads aggregates
- JSON Report → Candidate Store: reads candidates
- JSON Report → JSON Output: writes JSON
- Investigator → JSON Output: reviews