# Analyzing Slack Space And File System Artifacts

Examine file system slack space, MFT entries, USN journal, and alternate data streams...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill analyzing-slack-space-and-file-system-artifacts -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill analyzing-slack-space-and-file-system-artifacts -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill analyzing-slack-space-and-file-system-artifacts -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill analyzing-slack-space-and-file-system-artifacts -g -a gemini-cli -y`

## Description

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Analyzing Slack Space and File System Artifacts

## When to Use
- When searching for hidden or residual data in file system slack space
- For analyzing NTFS Master File Table (MFT) entries for deleted file metadata
- When reconstructing file operations from the USN Change Journal
- For detecting Alternate Data Streams (ADS) used to hide data or malware
- During deep forensic analysis requiring examination beyond standard file recovery

## Prerequisites
- Forensic disk image with NTFS file system
- The Sleuth Kit (TSK) tools: istat, icat, fls, blkls, blkstat
- MFTECmd (Eric Zimmerman) for MFT parsing
- MFTExplorer for interactive MFT analysis
- Understanding of NTFS structures (MFT, $UsnJrnl, $LogFile, ADS)
- Python with analyzeMFT or mft library for automated parsing

## Workflow

### Step 1: Identify and Extract NTFS File System Artifacts

```bash
# Determine partition layout
mmls /cases/case-2024-001/images/evidence.dd

# Extract key NTFS system files
# $MFT - Master File Table
icat -o 2048 /cases/case-2024-001/images/evidence.dd 0 > /cases/case-2024-001/ntfs/MFT

# $UsnJrnl:$J - USN Change Journal
icat -o 2048 /cases/case-2024-001/images/evidence.dd 62-128 > /cases/case-2024-001/ntfs/UsnJrnl_J

# $LogFile - Transaction log
icat -o 2048 /cases/case-2024-001/images/evidence.dd 2 > /cases/case-2024-001/ntfs/LogFile

# Extract all slack space from the volume
blkls -s -o 2048 /cases/case-2024-001/images/evidence.dd > /cases/case-2024-001/ntfs/slack_space.raw

# Get file system information
fsstat -o 2048 /cases/case-2024-001/images/evidence.dd | tee /cases/case-2024-001/ntfs/fs_info.txt
```

### Step 2: Analyze the Master File Table (MFT)

```bash
# Parse MFT with MFTECmd (Eric Zimmerman)
MFTECmd.exe -f "C:\cases\ntfs\MFT" --csv "C:\cases\analysis\" --csvf mft_analysis.csv

# Parse with analyzeMFT (Python)
pip install analyzeMFT

analyzeMFT.py -f /cases/case-2024-001/ntfs/MFT \
   -o /cases/case-2024-001/analysis/mft_analysis.csv \
   -c

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md