ImHex Pattern Files - Digital Forensics

Enhanced features of the stock Disk/Filesystem pattern files for forensic review of disk content.

• https://github.com/WerWolv/ImHex
• https://github.com/WerWolv/ImHex-Patterns

Install:

• Create a new folder called "DFIR"
• Add these updated pattern files to "DFIR"

Use:

• Open a physical disk via Raw Provider (read-only)
  • EXAMPLE: /dev/disk6
• Import Pattern File
  • EXAMPLE: DISK_PARSER.hexpat

• DISK_PARSER.hexpat
  • Recognize MBR/GPT Disks and parse MPT/GPT
    • Including Logical Volumes in an Extended Partition (container)
  • Auto load file system patterns for FAT32, exFAT, NTFS formatted volumes
  • Optional Disk Report

DISK > MBR/GPT

DISK > MBR > MPT > 3 Primaries | 2 Logicals in an Extended

• FAT32.hexpat
  • Auto loaded by DISK_PARSER.hexpat
  • Parse VBR, FAT1, FAT2, Root Dir, and 1 level of SubDirs
  • FAT1/FAT2 Cluster chaining with SFN resolution
  • LFN/SFN Alias grouping in Root Dir
  • Recognize deleted entries (xE5)
  • File Content pointer
  • D/T Conversions
  • Optional FAT32 Volume Report

VOLUME > FAT32 > FAT1

VOLUME > FAT32 > Root Dir

VOLUME > FAT32 > Data Pointer

• exFAT.hexpat
  • Auto loaded by DISK_PARSER.hexpat
  • Parse VBR/Boot Sector/Extended Sectors, FAT1, Root Dir
  • Recognize active directory entries (x85, xC0, xC1)
  • Recognize inactive directory entries (x05, x40, x41)
  • xC0/x40 File Content pointer
  • D/T Conversions
  • Optional exFAT Volume Report

VOLUME > exFAT

VOLUME > exFAT > Root Dir > xC0 (Stream Ext)

VOLUME > exFAT > Data Pointer

• NTFS.hexpat
  • Auto loaded by DISK_PARSER.hexpat
  • Parse VBR (Boot Sector), $MFT, Root Dir, and Indexes
  • Recursively parse the $Metadata files, $Attributes, and user files/dirs
    • Added file record | parent [MFT#] [SEQ#] indicators
  • Parse x80/xB0 Data Runs
  • File Content pointer
  • D/T Conversions
  • Optional NTFS Volume Report

VOLUME > NTFS > $MFT > D/T Conversion

VOLUME > NTFS > $MFT > x80 Run List

VOLUME > NTFS > Data Pointer

• Optional Reports

  • Simply copy the console output to a file...

  • To enable/disable the reports:

    • Open each DFIR related .hexpat
    • Find the report constant (near the top)
      • "true" = enabled
      • "false" = disabled

Example Report: GPT > FAT32|exFAT

• exFAT_Report.pdf

Example Report: MBR > 5 Logical Volumes (2 in an Extended) > All FAT32 Volumes

• MBR_5_VOLs.pdf