Large .bin files in fs folder

diogo-fernan / ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Other

465 stars 95 forks source link

Large .bin files in fs folder #14

Closed BustedSec closed 5 years ago

BustedSec commented 5 years ago

I have a few questions. What program created these .bin files, how do you view their contents, and can we disable .bin files from being created somehow?

diogo-fernan commented 5 years ago

The *.bin files contain the:

boot sector of the existing drives;
Master File Table (MFT) of NTFS partitions;
$LogFile of NTFS partitions;
$UsnJrnl of NTFS partitions.

These are all binary files and require to be parsed by other tools. Have a look a the filesystem section of the configuration file at https://github.com/diogo-fernan/ir-rescue/blob/master/win/tools-win/cfg/ir-rescue-win.conf#L128 for modifying the acquisition behavior.