Cyber Apocalypse Day Finale | Extracting information from MFT records
Source: YouTube · Hack The Box · published Mar 27, 2025 · 25:23
This video demonstrates forensic analysis of Master File Table (MFT) records during a Cyber Apocalypse CTF workshop 3:31.
Key Takeaways:
• Gio showcases how to parse MFT files using Eric Zimmerman's tools like MFT Explorer and Timeline Explorer 5:52
• The challenge involves analyzing file metadata to answer questions about file years, deleted files, and modified files 8:55
• Converting MFT files to CSV format makes them more readable and easier to analyze 6:51
• File attributes like creation dates, modification dates, and deletion status provide crucial forensic evidence 9:07
• Excel can be used to compare timestamps and identify files modified after creation 17:24
MFT analysis is essential for digital forensics on Windows systems as it reveals file metadata including names, sizes, locations, and timestamps 23:26.
Sources:
- 3:31 Introduction to the MFT analysis workshop
- 5:52 Using Eric Zimmerman's forensic tools
- 6:51 Converting MFT to CSV format
- 8:55 Challenge questions about file metadata
- 9:07 Analyzing file attributes and deletion status
- 17:24 Using Excel to compare file timestamps
- 23:26 Importance of MFT analysis in digital forensics
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[Music] [Music] Hey, hey, hey. Hello and welcome everybody to the last day of Cyber Apocalypse. So much that I want to say. Thank you for everybody who came out today uh and throughout the entire uh weekend. This was one of the if not the most successful cyber apocalypses that we have ever had. Uh so you know very thankful for that. We have today for you our final um workshop that is going to be done by our own cyber studies well their own cyber studies Gio he's actually one of the people who's been contributing a lot to our YouTube channel if you're uh you've seen learn with hack the box you've seen his face already so uh really excited to see what he has to say about um cracking getting uh information from NFT records MFT records my that. So, yeah. Uh, like always, we are going to have a…