Forest Global Training Partners

Cyber Risks · Trail of Bits Blog

Using osquery for remote forensics

Summary: Trail of Bits and Crypsis describe a new NTFS forensics extension for osquery that lets analysts query deeper filesystem metadata remotely, including the $STANDARD_INFORMATION and $FILE_NAME timestamps stored in the Master File Table. The extension surfaces timestamp mismatches, forged timestamps with zeroed nanosecond precision, and leftover $FILE_NAME entries in directory index slack after files are deleted.

What you should know: Attackers who timestomp files to hide their timeline leave detectable inconsistencies, and NTFS keeps copies of deleted files' $FILE_NAME attributes in directory index slack - but in the article's own example, three deleted files left artifacts for only two, so recovery is always partial.

Read the original at Trail of Bits Blog ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026