---
id: 2040
title: "Collect NTFS forensic information with osquery"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2018/05/28/collect-ntfs-forensic-information-with-osquery/"
published_at: "2018-05-28T16:06:07Z"
tags: ["incident-response", "windows", "digital-forensics", "forensics", "osquery", "ntfs", "alternate-data-streams", "crypsis"]
phying_url: "https://phying.com/item/2040"
lang: en
---

# Collect NTFS forensic information with osquery

## Summary

Built with Crypsis, this osquery extension exposes NTFS forensic artifacts—filename timestamps, security descriptors, Alternate Data Streams, and stale index entries—to incident responders.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2018-05-28T16:06:07Z
- **Original:** https://blog.trailofbits.com/2018/05/28/collect-ntfs-forensic-information-with-osquery/
- **Phying News:** https://phying.com/item/2040