Layered NTFS Audit Trails Expose Attackers Despite Anti-Forensics

Digital forensics analysts can uncover hidden attacker activity by correlating three distinct NTFS audit structures, even when primary evidence has been manipulated. Security researcher Andrea Fortuna recently published a deep dive into NTFS forensics, arguing that the intersection of the Master File Table (MFT), the USN Journal, and the $LogFile provides a resilient history of system events.

According to Fortuna, NTFS maintains a layered audit trail across these three structures, each capturing different dimensions of file system activity. While many attackers use 'timestomping' to modify file timestamps or delete their tools to evade detection, they frequently fail to clear all three layers. Fortuna notes that "what most do not account for, because most training does not cover it carefully, is that NTFS keeps a layered audit trail spread across at least three separate structures, and cleaning one of them rarely touches the others."

The Forensic Gap

In standard digital forensics and incident response (DFIR) workflows, training often focuses heavily on the MFT. However, the MFT alone can be misleading if an attacker has successfully altered timestamps. The USN Journal and $LogFile offer a more durable record of file creations, deletions, and renames. Because these structures operate independently, a discrepancy between the MFT's reported time and the sequential logs in the USN Journal can serve as a primary indicator of compromise.

Implications for Incident Response

This correlation allows investigators to detect sophisticated anti-forensic techniques that would otherwise go unnoticed. By moving beyond simple timestamp analysis, analysts can reconstruct a full timeline of attacker behavior. This is particularly critical in high-stakes breaches where attackers employ custom tools to wipe their tracks; the persistence of data across the layered audit trail ensures that a forensic footprint remains.

Tools for Reconstruction

To access these raw NTFS structures programmatically, Fortuna recommends the use of dfir_ntfs. Developed by Maxim Suhanov, dfir_ntfs is a digital forensics tool designed specifically for parsing and analyzing NTFS and FAT file systems. When used alongside other utilities like MFTECmd, dfir_ntfs enables analysts to extract the raw data necessary to prove that a file existed or was modified, even if the file itself has been deleted from the disk.

Investigators are encouraged to integrate the analysis of the USN Journal and $LogFile into their standard triage process to ensure that anti-forensic efforts do not result in a blind spot during the investigation.