Extracting information from MFT records by @Cyber Studies | Hack The Box
Source: YouTube · Hack The Box · published Mar 26, 2025 · 20:17
The video walks through a CTF challenge involving Windows forensics, focusing on analyzing an MFT (Master File Table) file to extract file metadata and answer specific questions. The key goal is to identify files based on creation, modification, deletion, and location using forensic tools like MFT Explorer and Excel. 0:51-1:10
Key Takeaways:
• The two years associated with the files are 2023 and 2024, identified by scanning file timestamps in the MFT CSV 2:01-2:32.
• The first human-generated document found is "final_annual_report.xlsx", matching the prompt for a document created 6:11-6:44.
• The deleted file is "market_pl.xlsx", identified by its "in use" status being unchecked in the MFT 8:44-9:10.
• The important text file is "credentials.txt", located in the "documents" directory under the MFT visual explorer 12:00-12:20.
• A file copied is "financial_statement_draft.xlsx", detected via the "copied" attribute in the MFT timeline 13:28-13:44.
• The file modified after creation is "project_proposal.pdf", identified by a timestamp differential in Excel 17:31-17:59.
MFT parsing is essential in digital forensics for retrieving metadata like file names, sizes, timestamps, and creation/modification history from Windows NTFS systems. 19:46-20:13
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
How's it going? My name is Gio with the Cyber Studies YouTube channel and the Learn with Hack the Box series. On today's episode, we're going to do a brief walkthrough on the Pursuit of the Track CTF event from last year's Cyber Apocalypse CTF. So, covering topics like things like the master file table or the MFT and some record analysis on an incident in this fictional scenario. So, without further delay, let's dig into this challenge. All right, so here I am in the cyber apocalypse workshops from the previous year. This is a private room, so I don't think you're going to have access to this. However, you can actually go into the Hack the Box labs, go into the Sherlocks, and there's a BFT room that you can do. It's very similar to this in nature. We actually covered it in a previous video…