ntfs-forensic

Forensic-grade NTFS reader for Rust. A clean, from-scratch implementation that reads files and directories from any Read + Seek source — and goes beyond a normal filesystem driver to surface the artifacts an examiner needs: timestomping indicators, alternate data streams, deleted MFT records, and record slack that a "clean" reader is designed to hide.

It is the NTFS FS-layer foundation for the SecurityRonin forensic family: usnjrnl-forensic and issen consume it as their single, auditable NTFS engine.

Rust library

[dependencies]
ntfs-forensic = "0.1"

Quick start

use ntfs_forensic::NtfsFs;
use std::fs::File;

// Open an NTFS volume (a raw partition image, or any Read + Seek source).
let mut fs = NtfsFs::open(File::open("ntfs.img")?)?;

// Read a file by path…
let hosts = fs.read_file(r"\Windows\System32\drivers\etc\hosts")?;

// …or list the root directory (MFT record 5).
let root = fs.read_record(5)?;
for entry in fs.directory_entries(&root)? {
    if let Some(name) = entry.file_name {
        println!("{}", name.name);
    }
}
# Ok::<(), ntfs_forensic::NtfsError>(())

What makes this different from a general-purpose NTFS crate

Most NTFS crates answer one question: "what files are on this volume?" ntfs-forensic answers the questions a digital forensics examiner actually needs:

Forensic capabilities

Every analysis is a pure function over already-parsed structures — exact and side-effect free.

Timestomping detection

NTFS keeps two timestamp sets: $STANDARD_INFORMATION (updatable via the Win32 API — what timestomp tools target) and $FILE_NAME (set by the kernel on create/rename). Divergence between them, or $SI times landing on a whole second, is a tampering tell.

use ntfs_forensic::detect_timestomp;

let flags = detect_timestomp(&std_info, &file_name);
if flags.is_suspicious() {
    // si_created_before_fn, created_mismatch, si_whole_second
    eprintln!("timestomp indicators: {flags:?}");
}

Alternate data streams

use ntfs_forensic::alternate_data_streams;

for ads in alternate_data_streams(&attributes) {
    println!("ADS: {}", ads.name.as_deref().unwrap_or(""));  // e.g. "Zone.Identifier"
}

Deleted records and record slack

use ntfs_forensic::{carve_file_records, is_deleted, record_slack, MftRecordHeader};

// Scan a raw $MFT for FILE/BAAD records at record-size boundaries.
for offset in carve_file_records(&mft_bytes, 1024) {
    let header = MftRecordHeader::parse(&mft_bytes[offset..])?;
    if is_deleted(&header) {
        // residue past the record's used size may hold a previous resident attribute
        let slack = record_slack(&mft_bytes[offset..offset + 1024], &header);
        println!("deleted record {} ({} slack bytes)", header.record_number, slack.len());
    }
}
# Ok::<(), ntfs_forensic::NtfsError>(())

Opening a partition inside a whole disk

OffsetReader re-bases a partition to offset 0 and structurally cannot read past the partition boundary — feed it the offset and length from mbr-forensic / gpt-forensic:

use ntfs_forensic::{NtfsFs, OffsetReader};
use std::fs::File;

let part = OffsetReader::new(File::open("disk.img")?, 1_048_576, 500_000_000)?;
let mut fs = NtfsFs::open(part)?;
# Ok::<(), ntfs_forensic::NtfsError>(())

API

All parsers accept &[u8] or a Read + Seek source and return a typed Result<_, NtfsError>.

Security

ntfs-forensic is designed for use on untrusted disk images from potentially compromised systems:

• No panics on malicious input — every length and offset is validated against both the structure's declared size and the actual buffer; arithmetic is checked or saturating
• #![forbid(unsafe_code)] across the whole crate
• Bounded allocations — try_reserve_exact and explicit ceilings refuse allocation bombs (e.g. a crafted runlist or LZNT1 stream)
• Loop caps — attribute chains, runlists, and index entries are bounded against non-terminating walks
• Fixup verification — torn writes and USA tampering surface as FixupMismatch rather than silently-wrong output
• Partition isolation — OffsetReader makes reading past the volume boundary structurally impossible
• Fuzz-tested — seven cargo-fuzz targets, tens of millions of executions; the one panic they found (an LZNT1 chunk-size overflow) is fixed and pinned as a regression test

Running the fuzz targets

# Requires nightly Rust and cargo-fuzz
rustup install nightly
cargo install cargo-fuzz

cargo +nightly fuzz run compress     # LZNT1 — loops + back-references
cargo +nightly fuzz run record       # MFT record + fixup
cargo +nightly fuzz run attributes   # attribute chain walking

Testing

140 unit tests plus a real-image cross-validation test, covering every public API, every error path, and adversarial inputs (truncated records, crafted runlists, torn fixups, out-of-bounds indexes). The boot parser is cross-validated against The Sleuth Kit's fsstat on a real disk image. No source line is left uncovered — enforced in CI.

cargo test
cargo install cargo-llvm-cov
cargo llvm-cov --lib --show-missing-lines

Aggregate line coverage can read slightly under 100% because the generic, reader-agnostic functions (NtfsFs<R>, OffsetReader<R>) are monomorphized once per reader type in the tests; the CI gate confirms no source line is left uncovered (zero zero-hit lines in lcov).

Related

ntfs-forensic reads an NTFS volume. To get a Read + Seek over a disk image, and to locate the NTFS partition within it, these crates compose upstream:

Sibling crates

One forensic reader per filesystem — each a Read + Seek library that composes with the container and partition crates above:

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd