# natesec/mftguard architecture

> Architecture diagram of the GitHub repository natesec/mftguard, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/natesec/mftguard
- Repository: https://github.com/natesec/mftguard

## Overview

MFTGuard is a command-line DFIR triage tool that accepts a raw $MFT file and sector size, then scans records and writes a JSON report of suspect candidates and aggregate statistics. The documented pipeline includes structural validation, USA fixup, $SI/$FN extraction, timestamp rules, candidate tracking, statistical analysis, and reporting. README descriptions support these capabilities; source excerpts show main’s orchestration and selected calls, so unsampled internal wiring is left out. Independent artifact correlation is an investigator follow-up, not an implemented runtime stage.

Main entry points: [`src/main.c`](https://github.com/natesec/mftguard/blob/master/src/main.c) (Scan Orchestrator), [`src/report.c`](https://github.com/natesec/mftguard/blob/master/src/report.c) (JSON Report), [`src/mft.c`](https://github.com/natesec/mftguard/blob/master/src/mft.c) (MFT Reader), [`src/rules.c`](https://github.com/natesec/mftguard/blob/master/src/rules.c) (Detection Rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Record Scanning"]
  node_main["Scan Orchestrator<br/>[main.c]"]
  node_mft["MFT Reader<br/>[mft.c]"]
  node_fixup["USA Fixup<br/>[fixup.c]"]
  node_attributes["Attribute Parser<br/>[attributes.c]"]
end

subgraph group_analysis["Timestamp Analysis"]
  node_rules["Detection Rules<br/>[rules.c]"]
  node_timestamps["Timestamp Utilities<br/>[timestamps.c]"]
end

subgraph group_results["Triage Results"]
  node_stats["Statistics<br/>[statistics.c]"]
  node_candidates[("Candidate Store<br/>[candidate.c]")]
  node_report["JSON Report<br/>[report.c]"]
end

node_investigator(("Investigator"))
node_mft_input["Raw $MFT"]
node_report_file["JSON Output"]

node_investigator -->|"invokes"| node_main
node_mft_input -->|"provides bytes"| node_mft
node_main -->|"opens and reads"| node_mft
node_mft -->|"applies fixup"| node_fixup
node_mft -->|"walks attributes"| node_attributes
node_main -->|"evaluates metadata"| node_rules
node_rules -->|"compares times"| node_timestamps
node_main -->|"collects outcomes"| node_stats
node_main -->|"stores flagged records"| node_candidates
node_main -->|"initializes and writes"| node_report
node_report -->|"reads aggregates"| node_stats
node_report -->|"reads candidates"| node_candidates
node_report -->|"writes JSON"| node_report_file
node_investigator -->|"reviews"| node_report_file

click node_main "https://github.com/natesec/mftguard/blob/master/src/main.c"
click node_mft "https://github.com/natesec/mftguard/blob/master/src/mft.c"
click node_fixup "https://github.com/natesec/mftguard/blob/master/src/fixup.c"
click node_attributes "https://github.com/natesec/mftguard/blob/master/src/attributes.c"
click node_rules "https://github.com/natesec/mftguard/blob/master/src/rules.c"
click node_timestamps "https://github.com/natesec/mftguard/blob/master/src/timestamps.c"
click node_stats "https://github.com/natesec/mftguard/blob/master/src/statistics.c"
click node_candidates "https://github.com/natesec/mftguard/blob/master/src/candidate.c"
click node_report "https://github.com/natesec/mftguard/blob/master/src/report.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_mft,node_fixup,node_attributes toneBlue
class node_rules,node_timestamps toneAmber
class node_stats,node_candidates,node_report toneMint
class node_investigator,node_mft_input,node_report_file toneIndigo
```

## Components

### Record Scanning

- [Scan Orchestrator](https://github.com/natesec/mftguard/blob/master/src/main.c): `src/main.c`
- [MFT Reader](https://github.com/natesec/mftguard/blob/master/src/mft.c): `src/mft.c`
- [USA Fixup](https://github.com/natesec/mftguard/blob/master/src/fixup.c): `src/fixup.c`
- [Attribute Parser](https://github.com/natesec/mftguard/blob/master/src/attributes.c): `src/attributes.c`

### Timestamp Analysis

- [Detection Rules](https://github.com/natesec/mftguard/blob/master/src/rules.c): `src/rules.c`
- [Timestamp Utilities](https://github.com/natesec/mftguard/blob/master/src/timestamps.c): `src/timestamps.c`

### Triage Results

- [Statistics](https://github.com/natesec/mftguard/blob/master/src/statistics.c): `src/statistics.c`
- [Candidate Store](https://github.com/natesec/mftguard/blob/master/src/candidate.c): `src/candidate.c`
- [JSON Report](https://github.com/natesec/mftguard/blob/master/src/report.c): `src/report.c`

### Other components

- **Investigator**
- **Raw $MFT**
- **JSON Output**

## Connections

- Investigator → Scan Orchestrator: invokes
- Raw $MFT → MFT Reader: provides bytes
- Scan Orchestrator → MFT Reader: opens and reads
- MFT Reader → USA Fixup: applies fixup
- MFT Reader → Attribute Parser: walks attributes
- Scan Orchestrator → Detection Rules: evaluates metadata
- Detection Rules → Timestamp Utilities: compares times
- Scan Orchestrator → Statistics: collects outcomes
- Scan Orchestrator → Candidate Store: stores flagged records
- Scan Orchestrator → JSON Report: initializes and writes
- JSON Report → Statistics: reads aggregates
- JSON Report → Candidate Store: reads candidates
- JSON Report → JSON Output: writes JSON
- Investigator → JSON Output: reviews