# Atlant Scalpel

Surgical NTFS timeline extraction for DFIR. Scope a live volume, disk image, or VSS shadow copy by time, file type, path, or filename — then carve a verified, full-fidelity binary slice of `$MFT`/`$UsnJrnl:$J`, or export a plaso-ready super-timeline.
Version 1.0 · Windows x64 · Atlant Security · atlantsecurity.com

## §Overview

Atlant Scalpel loads an NTFS Master File Table (`$MFT`) and the USN Change Journal (`$UsnJrnl:$J`), lets you pick a date/time window and narrow by file type, path and filename, and then carves a smaller-but-still-valid binary slice of those artifacts for that window — alongside analyst-ready CSV and timeline exports.

What makes it different: binary carvers filter by structure only; date-range tools emit text or rows only. Scalpel sits at the intersection — it filters by a timestamp window and emits a valid binary artifact that re-parses in MFTECmd, analyzeMFT and The Sleuth Kit without modification. The result is a forensic exhibit that is a fraction of the original size yet defensible in court.

Output | What you get
--- | ---
Binary `$MFT` slice | Position-preserving, sparse, re-parse-verified. Keeps in-window records, system metafiles and every ancestor directory.
Binary `$J` slice | USN records verbatim, original offsets preserved via sparse gaps.
`slice.manifest.json` | Chain-of-custody sidecar: tool/version, UTC time, source, window, record counts, verification result and the filters applied.
CSV / timeline | MFT (MFTECmd 34-col), USN, enriched MFT+USN, TSK bodyfile, and log2timeline `l2t_csv`.

## §Requirements & elevation

- OS: Windows 10/11 x64. The build is self-contained — no .NET install is required on the target host.
- Administrator: required only for raw device sources — a live volume (`\\.\C:`) and VSS shadow copies. The app self-elevates on launch (you will see a UAC prompt).
- No elevation needed for file-based sources: an extracted `$MFT`/`$J` or a disk image.

Analyst-host hygiene Every dependency runs from the application image; nothing is extracted to `%TEMP%` at launch, so the host you are analyzing stays untouched.

## §Quick start

1. Load a source — click Load ▾ and pick an `$MFT` file, a disk image, or a live volume.
2. Set the window — the From field defaults to the first of the current month; adjust From/To with the calendar pickers, then click Apply window.
3. Narrow it — type file types, paths, or a filename. Use Add filter to stack several conditions (see Compound filters).
4. Review — the grid shows matching records with MACB timestamps and timestomp pills; the counter reads “N of M in window”.
5. Export — Slice… carves the verified binary artifact, or Export CSV… writes a timeline.

## 1Load a source

Open the Load ▾ menu and choose:

Menu item | Use for | Admin?
--- | --- | ---
Open `$MFT` file… | An extracted `$MFT` (FTK Imager / KAPE / RawCopy). Attach the journal afterwards with Attach $J…. | No
Open disk image… | Raw/dd, VHD, VHDX, VMDK. Partitions are enumerated and the NTFS volume is presented automatically. | No
Open volume… | A live or mounted NTFS volume (`\\.\C:`). Mount an E01 in FTK / Arsenal Image Mounter and point at the drive letter. | Yes
Open shadow copy… | A Volume Shadow Copy snapshot — read a point-in-time view of the past. | Yes
Load sample | A built-in synthetic volume for evaluation and training. | No

E01 / EWF images There is no native E01 reader yet. Mount the E01 with FTK Imager or Arsenal Image Mounter, then use Open volume… with the resulting drive letter.

Large volumes take time to parse (a multi-GB `$MFT` is read and indexed in full). The status bar shows progress; you can cancel a load in flight.

## 2Time window & density

The From and To fields define an inclusive UTC window. A record is in-window when any of its `$STANDARD_INFORMATION` timestamps falls inside it. Click each field to pick a date from the calendar, or type `yyyy-MM-dd HH:mm:ss` directly. Click Apply window to refilter.

- Default on load: From is set to the first of the current month at 00:00:00 UTC and To to the latest activity in the data — so a freshly loaded live host opens on “this month so far”. (If the data predates this month entirely, the window falls back to the data’s own start so it is never empty.)
- Density histogram: the strip above the grid bins event density across the window (log-scaled). Taller bars mean more file activity in that slice of time — a fast way to spot a burst worth zooming into.

## 3Filters

Three boxes narrow both the on-screen grid and every export. Typing is debounced (a few seconds) so filtering does not run on every keystroke.

### FILE TYPES

Comma/space-separated extensions, written bare (`exe`), dotted (`.exe`) or as a glob (`*.exe`). The Include / Exclude pill controls whether the list is an allow-list (show only these) or a block-list (hide these).

The ▾ button beside the box offers one-click presets. Executables fills in binaries, scripts and temp artifacts in one go: `exe, dll, sys, scr, com, cpl, ocx, drv, efi, msi, bin, ps1, psm1, vbs, vbe, js, jse, bat, cmd, wsf, wsh, hta, vba, py, tmp, temp`.

### PATHS

One or more resolved-path prefixes (e.g. `\Windows`, `\Users\bob`). Its own Include / Exclude pill makes the list an allow-list or a block-list. Excluding `\Windows` and `\$Extend` is a common way to cut OS noise.

### FILENAME

A case-insensitive substring matched against each record’s primary name — e.g. `svchost` or `mimikatz`.

How they combine Within the live boxes, File Types and Paths and Filename all apply together (a record must satisfy each populated box). To express alternatives a single set of boxes cannot, use compound filters.

## 4Compound filters Add filter

Stack several filter clauses that are AND-combined — a record is kept only when it satisfies every clause. This lets you express constraints a single clause cannot, because each box has only one Include/Exclude mode at a time.

1. Set the File Types / Paths / Filename boxes for your first condition.
2. Click Add filter. The condition is frozen into a clause, shown as a removable chip under ACTIVE FILTERS, and the boxes clear for the next one.
3. Build the next clause and add it. Repeat as needed.
4. Click × on any chip to drop that clause, or Clear all to remove them.

Worked example — “under `\Windows` but not `\Windows\Temp`”:

- Clause 1 — PATHS = `\Windows`, mode Include → Add filter.
- Clause 2 — PATHS = `\Windows\Temp`, mode Exclude → Add filter.

The grid now shows everything beneath `\Windows` except the `Temp` subtree — and the binary slice and CSV exports apply the exact same compound.

What you see is what you cut Compound clauses drive the grid, the binary slice and every CSV/timeline format identically, so the exhibit always matches the preview.

## 5Anomalies only

Toggle Anomalies only to restrict the displayed rows to records carrying a timestomp indicator:

- `SI<FN` — the `$STANDARD_INFORMATION` timestamp predates the `$FILE_NAME` timestamp, a classic sign of back-dating.
- `µsec = 0` — sub-second precision zeroed, typical of tools that set times to whole seconds.
- Slot reused (USN / Enriched views) — the journal event refers to a now-overwritten MFT record (sequence-number mismatch).

View filter, not an export filter “Anomalies only” changes what is shown on screen for triage. It does not reduce the binary slice or CSV — those stay a complete, court-defensible cut of the window so nothing is silently dropped from the exhibit.

## 6MFT / USN / Enriched views

View | Shows
--- | ---
MFT | One row per file record: full path, size, and the eight MACB timestamps (`$SI` and `$FN`), with timestomp pills.
USN | Raw `$UsnJrnl:$J` change-journal events (V2/V3): reason flags, timestamp, file reference.
Enriched | USN events as the spine, each enriched from the MFT with full path, MACB times, size, `SeqMatch`, `SI<FN` and `µsec=0`.

The USN and Enriched views are available only when a `$J` is present (attached, or read from the volume/image).

The counter under the grid always reads the true number of matching records in the window (and the in-window anomaly count), even when the grid itself is showing a large result set.

## §Binary slice Slice…

The headline output. Scalpel writes a new `$MFT` (and `$J`, when present) containing only the records your window and filters select — plus everything those records need to stay valid:

- Position-preserving & sparse — records keep their original entry numbers; the gaps between them are written as sparse zero ranges, so the file is small on disk but byte-correct where it matters.
- Retention rule — keeps in-window records, all `$FN`-parent directories, base/extension record pairs, and the system metafiles (located by walking the `$Extend` index, never hardcoded). Orphans land in a lost-and-found rather than breaking the slice.
- Verified — the slice is re-parsed and round-trip checked before success is reported. FILE-record fixup arrays are preserved verbatim.
- Provenance — a `slice.manifest.json` is written beside the slice documenting source, window, counts, verification result and filters, so the derived artifact is defensible.

The completion dialog reports the original vs. slice size (logical and on-disk) so you can show how much was carved away.

## §CSV & timeline exports Export CSV…

The export dialog offers five text formats, each honoring the active window, filters and compound clauses:

Format | Schema / target tool
--- | ---
MFT CSV | 34-column MFTECmd schema — drops straight into Eric Zimmerman’s Timeline Explorer.
USN CSV | MFTECmd `JEntryOut` schema (USN change-journal events).
Enriched timeline | USN spine enriched with MFT path + MACB + anomaly columns.
Bodyfile | TSK 3.x bodyfile — pipe into `mactime` or log2timeline/plaso.
l2t_csv | log2timeline 17-column CSV — one row per distinct in-window `$SI` MACB event; ingestible by plaso’s `l2tcsv` parser and opens in Timeline Explorer / Excel.

## §Forensic soundness

- Read-only sources. Scalpel opens volumes and images for reading; it never writes to the source.
- Verified output. Binary slices are re-parsed before success is reported — a slice that does not round-trip is a failure, not a silent partial.
- Documented chain of custody. `slice.manifest.json` records exactly what was produced, from what, over which window, with which filters, and whether verification passed.
- No host contamination. Dependencies load from the application image; nothing is unpacked to `%TEMP%` on launch.
- Integrity manifest. The distribution ships a `SHA256SUMS.txt` for every file and a `.sha256` sidecar for the package itself — verify before use.

## §Troubleshooting

Symptom | Cause & fix
--- | ---
“Requires elevation” / cannot open volume | Live-volume and shadow-copy sources need Administrator. Accept the UAC prompt, or relaunch as administrator.
USN / Enriched tabs are empty or disabled | No `$J` is loaded. Attach a journal (Attach $J…) or load a volume/image that has one.
Grid looks empty after loading | The window may be narrower than the data. Widen From/To and click Apply window; watch the density strip for where activity actually is.
Filtering feels delayed | By design — text filters are debounced so they don’t run on every keystroke. Pause briefly, or it applies immediately when you pick a preset or add a clause.
E01 image won’t open | Mount it (FTK Imager / Arsenal Image Mounter) and use Open volume… with the drive letter.

## §About & legal

Atlant Scalpel is developed by Atlant Security. Use it only on systems and data you are authorized to examine. The tool is provided for lawful digital-forensics and incident-response work; the operator is responsible for the legality and authorization of every examination.

Provided as-is, without warranty. Verify the package integrity (`.sha256` sidecar and `SHA256SUMS.txt`) before deploying to an examination host. See `BUILDINFO.txt` in the distribution for exact build provenance.