Atlant Scalpel

§Overview

Atlant Scalpel loads an NTFS Master File Table ($MFT) and the USN Change Journal ($UsnJrnl:$J), lets you pick a date/time window and narrow by file type, path and filename, and then carves a smaller-but-still-valid binary slice of those artifacts for that window — alongside analyst-ready CSV and timeline exports.

What makes it different: binary carvers filter by structure only; date-range tools emit text or rows only. Scalpel sits at the intersection — it filters by a timestamp window and emits a valid binary artifact that re-parses in MFTECmd, analyzeMFT and The Sleuth Kit without modification. The result is a forensic exhibit that is a fraction of the original size yet defensible in court.

§Requirements & elevation

• OS: Windows 10/11 x64. The build is self-contained — no .NET install is required on the target host.
• Administrator: required only for raw device sources — a live volume (\\.\C:) and VSS shadow copies. The app self-elevates on launch (you will see a UAC prompt).
• No elevation needed for file-based sources: an extracted $MFT/$J or a disk image.

§Quick start

1. Load a source — click Load ▾ and pick an $MFT file, a disk image, or a live volume.
2. Set the window — the From field defaults to the first of the current month; adjust From/To with the calendar pickers, then click Apply window.
3. Narrow it — type file types, paths, or a filename. Use Add filter to stack several conditions (see Compound filters).
4. Review — the grid shows matching records with MACB timestamps and timestomp pills; the counter reads “N of M in window”.
5. Export — Slice… carves the verified binary artifact, or Export CSV… writes a timeline.

1Load a source

Open the Load ▾ menu and choose:

Large volumes take time to parse (a multi-GB $MFT is read and indexed in full). The status bar shows progress; you can cancel a load in flight.

2Time window & density

The From and To fields define an inclusive UTC window. A record is in-window when any of its $STANDARD_INFORMATION timestamps falls inside it. Click each field to pick a date from the calendar, or type yyyy-MM-dd HH:mm:ss directly. Click Apply window to refilter.

• Default on load: From is set to the first of the current month at 00:00:00 UTC and To to the latest activity in the data — so a freshly loaded live host opens on “this month so far”. (If the data predates this month entirely, the window falls back to the data’s own start so it is never empty.)
• Density histogram: the strip above the grid bins event density across the window (log-scaled). Taller bars mean more file activity in that slice of time — a fast way to spot a burst worth zooming into.

3Filters

Three boxes narrow both the on-screen grid and every export. Typing is debounced (a few seconds) so filtering does not run on every keystroke.

FILE TYPES

Comma/space-separated extensions, written bare (exe), dotted (.exe) or as a glob (*.exe). The Include / Exclude pill controls whether the list is an allow-list (show only these) or a block-list (hide these).

The ▾ button beside the box offers one-click presets. Executables fills in binaries, scripts and temp artifacts in one go: exe, dll, sys, scr, com, cpl, ocx, drv, efi, msi, bin, ps1, psm1, vbs, vbe, js, jse, bat, cmd, wsf, wsh, hta, vba, py, tmp, temp.

PATHS

One or more resolved-path prefixes (e.g. \Windows, \Users\bob). Its own Include / Exclude pill makes the list an allow-list or a block-list. Excluding \Windows and \$Extend is a common way to cut OS noise.

FILENAME

A case-insensitive substring matched against each record’s primary name — e.g. svchost or mimikatz.

4Compound filters Add filter

Stack several filter clauses that are AND-combined — a record is kept only when it satisfies every clause. This lets you express constraints a single clause cannot, because each box has only one Include/Exclude mode at a time.

1. Set the File Types / Paths / Filename boxes for your first condition.
2. Click Add filter. The condition is frozen into a clause, shown as a removable chip under ACTIVE FILTERS, and the boxes clear for the next one.
3. Build the next clause and add it. Repeat as needed.
4. Click × on any chip to drop that clause, or Clear all to remove them.

Worked example — “under \Windows but not \Windows\Temp”:

• Clause 1 — PATHS = \Windows, mode Include → Add filter.
• Clause 2 — PATHS = \Windows\Temp, mode Exclude → Add filter.

The grid now shows everything beneath \Windows except the Temp subtree — and the binary slice and CSV exports apply the exact same compound.

5Anomalies only

Toggle Anomalies only to restrict the displayed rows to records carrying a timestomp indicator:

• SI<FN — the $STANDARD_INFORMATION timestamp predates the $FILE_NAME timestamp, a classic sign of back-dating.
• µsec = 0 — sub-second precision zeroed, typical of tools that set times to whole seconds.
• Slot reused (USN / Enriched views) — the journal event refers to a now-overwritten MFT record (sequence-number mismatch).

6MFT / USN / Enriched views

The USN and Enriched views are available only when a $J is present (attached, or read from the volume/image).

The counter under the grid always reads the true number of matching records in the window (and the in-window anomaly count), even when the grid itself is showing a large result set.

§Binary slice Slice…

The headline output. Scalpel writes a new $MFT (and $J, when present) containing only the records your window and filters select — plus everything those records need to stay valid:

• Position-preserving & sparse — records keep their original entry numbers; the gaps between them are written as sparse zero ranges, so the file is small on disk but byte-correct where it matters.
• Retention rule — keeps in-window records, all $FN-parent directories, base/extension record pairs, and the system metafiles (located by walking the $Extend index, never hardcoded). Orphans land in a lost-and-found rather than breaking the slice.
• Verified — the slice is re-parsed and round-trip checked before success is reported. FILE-record fixup arrays are preserved verbatim.
• Provenance — a slice.manifest.json is written beside the slice documenting source, window, counts, verification result and filters, so the derived artifact is defensible.

The completion dialog reports the original vs. slice size (logical and on-disk) so you can show how much was carved away.

§CSV & timeline exports Export CSV…

The export dialog offers five text formats, each honoring the active window, filters and compound clauses:

§Forensic soundness

• Read-only sources. Scalpel opens volumes and images for reading; it never writes to the source.
• Verified output. Binary slices are re-parsed before success is reported — a slice that does not round-trip is a failure, not a silent partial.
• Documented chain of custody. slice.manifest.json records exactly what was produced, from what, over which window, with which filters, and whether verification passed.
• No host contamination. Dependencies load from the application image; nothing is unpacked to %TEMP% on launch.
• Integrity manifest. The distribution ships a SHA256SUMS.txt for every file and a .sha256 sidecar for the package itself — verify before use.

§Troubleshooting

§About & legal

Atlant Scalpel is developed by Atlant Security. Use it only on systems and data you are authorized to examine. The tool is provided for lawful digital-forensics and incident-response work; the operator is responsible for the legality and authorization of every examination.

Provided as-is, without warranty. Verify the package integrity (.sha256 sidecar and SHA256SUMS.txt) before deploying to an examination host. See BUILDINFO.txt in the distribution for exact build provenance.