watching you watching us . .


EnCase EnScript to export MFT slack

Useful EnCase EnScript for extracting contents of Slack space in the MFT from Lance Mueller.

“.. MFT slack, that is, the data that may exist between the end of a logical MFT record and the end of the physical MFT record. A typical MFT record can be anywhere between 400 to 700 bytes in length, but the MFT allocates 1024 bytes for each record. This can cause data to be left from previous records, the same way data remains in file slack at the end of a cluster.

– snip –

The EnScript will process every MFT found in the case. The EnScript only exports data in the MFT record slack area with an ASCII value between 0x20 (space) and 0x7E (tilde). A folder is created in the case default export folder named “MFT Slack” and a file with a record number is created for every MFT record that contains slack. The reason this method was used, was so if you review the exported data and find something of interest, you can quickly map it back to the exact MFT record where it came from. If a MFT record has no data in slack, then no export file is created for that record. ..”

Lance Mueller, ForensicKB, 21 February 2011 – last access 27 February 2011 – ( Full Article and to download the EnScript )