#!/usr/bin/env python3
"""MFT Deleted File Recovery Agent - Parses NTFS Master File Table for deleted file artifacts."""

import json
import struct
import os
import logging
import argparse
from datetime import datetime, timedelta

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)

MFT_ENTRY_SIZE = 1024
FILETIME_EPOCH = datetime(1601, 1, 1)


def filetime_to_dt(ft):
    """Convert FILETIME to datetime."""
    if ft == 0:
        return None
    try:
        return FILETIME_EPOCH + timedelta(microseconds=ft // 10)
    except (OverflowError, OSError):
        return None


def parse_mft_entry(data, offset=0):
    """Parse a single MFT entry."""
    if len(data) < offset + 48:
        return None
    signature = data[offset:offset + 4]
    if signature != b"FILE":
        return None

    flags = struct.unpack_from("<H", data, offset + 22)[0]
    seq_number = struct.unpack_from("<H", data, offset + 18)[0]
    first_attr_offset = struct.unpack_from("<H", data, offset + 20)[0]

    entry = {
        "flags": flags,
        "in_use": bool(flags & 0x01),
        "is_directory": bool(flags & 0x02),
        "sequence_number": seq_number,
        "attributes": [],
    }

    attr_offset = offset + first_attr_offset
    while attr_offset + 4 <= len(data):
        attr_type = struct.unpack_from("<I", data, attr_offset)[0]
        if attr_type == 0xFFFFFFFF:
            break
        attr_length = struct.unpack_from("<I", data, attr_offset + 4)[0]
        if attr_length == 0 or attr_offset + attr_length > len(data):
            break

        if attr_type == 0x10:  # $STANDARD_INFORMATION
            if attr_offset + 24 + 32 <= len(data):
                si_offset = attr_offset + struct.unpack_from("<H", data, attr_offset + 20)[0]
                if si_offset + 32 <= len(data):
                    entry["created"] = str(filetime_to_dt(struct.unpack_from("<Q", data, si_offset)[0]))
                    entry["modified"] = str(filetime_to_dt(struct.unpack_from("<Q", data, si_offset + 8)[0]))
                    entry["mft_modified"] = str(filetime_to_dt(struct.unpack_from("<Q", data, si_offset + 16)[0]))
                    entry["accessed"] = str(filetime_to_dt(struct.unpack_from("<Q", data, si_offset + 24)[0]))

        elif attr_type == 0x30:  # $FILE_NAME
            non_res = struct.unpack_from("<B", data, attr_offset + 8)[0]
            if non_res == 0:
                fn_offset = attr_offset + struct.unpack_from("<H", data, attr_offset + 20)[0]
                if fn_offset + 66 <= len(data):
                    parent_ref = struct.unpack_from("<Q", data, fn_offset)[0] & 0xFFFFFFFFFFFF
                    name_len = data[fn_offset + 64] if fn_offset + 64 < len(data) else 0
                    name_ns = data[fn_offset + 65] if fn_offset + 65 < len(data) else 0
                    if fn_offset + 66 + name_len * 2 <= len(data):
                        filename = data[fn_offset + 66:fn_offset + 66 + name_len * 2].decode("utf-16-le", errors="ignore")
                        entry["filename"] = filename
                        entry["parent_ref"] = parent_ref
                        entry["name_type"] = {0: "POSIX", 1: "Win32", 2: "DOS", 3: "Win32+DOS"}.get(name_ns, "Unknown")

        attr_offset += attr_length

    return entry


def parse_mft_file(mft_path):
    """Parse an extracted MFT file."""
    entries = []
    with open(mft_path, "rb") as f:
        data = f.read()

    total_entries = len(data) // MFT_ENTRY_SIZE
    for i in range(total_entries):
        offset = i * MFT_ENTRY_SIZE
        entry = parse_mft_entry(data, offset)
        if entry:
            entry["record_number"] = i
            entries.append(entry)

    logger.info("Parsed %d MFT entries (%d total records)", len(entries), total_entries)
    return entries


def find_deleted_files(entries):
    """Find deleted file entries in MFT."""
    deleted = [e for e in entries if not e["in_use"] and e.get("filename")]
    logger.info("Found %d deleted file entries", len(deleted))
    return deleted


def analyze_deleted_files(deleted):
    """Analyze deleted files for forensic significance."""
    findings = []
    suspicious_extensions = {".exe", ".dll", ".ps1", ".bat", ".cmd", ".vbs", ".js", ".hta", ".scr"}
    for entry in deleted:
        fname = entry.get("filename", "").lower()
        ext = os.path.splitext(fname)[1]
        if ext in suspicious_extensions:
            findings.append({
                "record": entry["record_number"],
                "filename": entry.get("filename"),
                "type": "Deleted executable/script",
                "severity": "high",
                "modified": entry.get("modified"),
            })
    return findings


def generate_report(entries, deleted, findings):
    """Generate MFT analysis report."""
    report = {
        "timestamp": datetime.utcnow().isoformat(),
        "total_entries": len(entries),
        "active_entries": len([e for e in entries if e["in_use"]]),
        "deleted_entries": len(deleted),
        "suspicious_deleted": len(findings),
        "findings": findings[:100],
        "deleted_files": [{"record": d["record_number"], "filename": d.get("filename"), "modified": d.get("modified")} for d in deleted[:200]],
    }
    print(f"MFT REPORT: {len(entries)} entries, {len(deleted)} deleted, {len(findings)} suspicious")
    return report


def main():
    parser = argparse.ArgumentParser(description="MFT Deleted File Recovery Agent")
    parser.add_argument("--mft-file", required=True, help="Path to extracted $MFT file")
    parser.add_argument("--output", default="mft_report.json")
    args = parser.parse_args()

    entries = parse_mft_file(args.mft_file)
    deleted = find_deleted_files(entries)
    findings = analyze_deleted_files(deleted)
    report = generate_report(entries, deleted, findings)
    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    logger.info("Report saved to %s", args.output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
MFT Deleted File Recovery Analyzer

Parses MFT CSV output from MFTECmd to identify deleted files,
detect timestomping, and generate recovery reports.
"""

import csv
import json
import sys
import os
from datetime import datetime
from collections import defaultdict


class MFTDeletedFileAnalyzer:
    """Analyze MFTECmd CSV output for deleted file recovery."""

    def __init__(self, mft_csv_path: str, output_dir: str):
        self.mft_csv_path = mft_csv_path
        self.output_dir = output_dir
        os.makedirs(output_dir, exist_ok=True)
        self.deleted_files = []
        self.timestomped_files = []
        self.all_records = []

    def parse_csv(self):
        """Parse MFTECmd CSV output."""
        with open(self.mft_csv_path, "r", encoding="utf-8-sig") as f:
            reader = csv.DictReader(f)
            for row in reader:
                self.all_records.append(row)
                if row.get("InUse", "").lower() == "false":
                    self.deleted_files.append(row)

    def detect_timestomping(self):
        """Identify files with timestomping indicators."""
        for row in self.all_records:
            si_created = row.get("Created0x10", "")
            fn_created = row.get("Created0x30", "")
            if si_created and fn_created and si_created != fn_created:
                try:
                    si_dt = datetime.fromisoformat(si_created.replace("Z", "+00:00"))
                    fn_dt = datetime.fromisoformat(fn_created.replace("Z", "+00:00"))
                    if si_dt < fn_dt:
                        self.timestomped_files.append({
                            "entry_number": row.get("EntryNumber", ""),
                            "filename": row.get("FileName", ""),
                            "parent_path": row.get("ParentPath", ""),
                            "si_created": si_created,
                            "fn_created": fn_created,
                            "delta_seconds": (fn_dt - si_dt).total_seconds()
                        })
                except (ValueError, TypeError):
                    continue

    def analyze_deleted_by_extension(self) -> dict:
        """Categorize deleted files by extension."""
        by_ext = defaultdict(list)
        for record in self.deleted_files:
            ext = record.get("Extension", "NO_EXT").upper()
            by_ext[ext].append({
                "filename": record.get("FileName", ""),
                "parent_path": record.get("ParentPath", ""),
                "file_size": record.get("FileSize", ""),
                "created": record.get("Created0x10", ""),
                "modified": record.get("LastModified0x10", "")
            })
        return dict(by_ext)

    def generate_report(self) -> str:
        """Generate comprehensive analysis report."""
        self.parse_csv()
        self.detect_timestomping()
        ext_analysis = self.analyze_deleted_by_extension()

        report = {
            "analysis_timestamp": datetime.now().isoformat(),
            "source_file": self.mft_csv_path,
            "total_records": len(self.all_records),
            "deleted_records": len(self.deleted_files),
            "timestomped_records": len(self.timestomped_files),
            "deleted_by_extension": {k: len(v) for k, v in ext_analysis.items()},
            "timestomping_details": self.timestomped_files[:50],
            "notable_deleted_files": [
                {
                    "filename": r.get("FileName", ""),
                    "parent_path": r.get("ParentPath", ""),
                    "file_size": r.get("FileSize", ""),
                    "entry_number": r.get("EntryNumber", "")
                }
                for r in self.deleted_files[:100]
            ]
        }

        report_path = os.path.join(self.output_dir, "mft_deleted_analysis.json")
        with open(report_path, "w") as f:
            json.dump(report, f, indent=2)

        print(f"[*] Total MFT records: {report['total_records']}")
        print(f"[*] Deleted records: {report['deleted_records']}")
        print(f"[*] Timestomped records: {report['timestomped_records']}")
        print(f"[*] Report saved to: {report_path}")
        return report_path


def main():
    if len(sys.argv) < 3:
        print("Usage: python process.py <mft_csv_path> <output_dir>")
        sys.exit(1)

    analyzer = MFTDeletedFileAnalyzer(sys.argv[1], sys.argv[2])
    analyzer.generate_report()


if __name__ == "__main__":
    main()