ntfstool

NTFS取证工具（解析器、MFT、Bitlocker、已删除文件）

  • 语言C++
  • 默认分支master
  • 大小17.4 MB
  • 更新6月27日
在 GitHub 打开
avatarthewhiteninja
636
1177
MIT License

项目介绍

thewhiteninja/ntfstool 是一个托管在 GitHub 上的开源项目，主要使用 C++ 编写，采用 MIT License 许可证，目前获得 636 个 Star、117 次 Fork。

仓库全名
thewhiteninja/ntfstool
开源许可证
MIT License
Star 数
636
Fork 数
117
未关闭 Issue
7

README 摘要

ntfstool NTFSTool is a forensic tool focused on [NTFS][10] volumes. It supports reading partition info (MBR, partition table, VBR) but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more. Download the latest binaries on AppVeyor or by checking the last GitHub artefacts. See below for some examples of the features! An alternative documentation made by deepwiki…

完整内容见 GitHub 原始 README 或本页 。

常见问题

ntfstool 用什么语言开发？

主要使用 C++ 编写，采用 MIT License 许可证，目前有 636 个 Star。

ntfstool 可以免费商用吗？

仓库采用 MIT License 许可证，可免费使用与修改，商业使用请遵守许可证条款（例如保留版权声明与许可声明）。

如何获取 ntfstool 的源码？

可以直接克隆仓库：git clone https://github.com/thewhiteninja/ntfstool.git，默认分支为 master；安装与运行步骤见仓库 README。

ntfstool 最近还在维护吗？

仓库最近一次更新为 6月27日，当前有 7 个未关闭 Issue；Star 数为 636，可作为社区活跃度的参考。

本页面展示项目元数据与原始 README，GitRead 中文社区 编辑团队负责选题收录。

相关仓库

tensorflow/tensorflow avatar
tensorflowtensorflow
1 小时前
201.4k
78.3k
3.5k

面向所有人的开源机器学习框架

deep-learningdeep-neural-networksdistributed+5
C++
1.4 GB
0
详情
ggml-org/llama.cpp avatar
llama.cppggml-org
2 小时前
133.6k
21.2k
736

C/C++ 中的大语言模型推理

ggml
C++
467.0 MB
3
详情
react/react-native avatar
react-nativereact
6 小时前
126.9k
24.7k
740

使用 React 构建原生应用的框架

androidapp-frameworkcross-platform+5
C++
970.2 MB
0
详情
electron/electron avatar
electronelectron
8 小时前
123.8k
17.5k
619

使用 JavaScript、HTML 和 CSS 构建跨平台桌面应用

electronjavascriptc-plus-plus+6
C++
227.2 MB
0
详情
godotengine/godot avatar
godotgodotengine
1 天前
119.7k
27.4k
19.0k

Godot Engine – 多平台 2D 和 3D 游戏引擎

game-developmentgame-enginegamedev+4
C++
1.8 GB
0
详情
microsoft/terminal avatar
terminalmicrosoft
9 小时前
105.3k
9.6k
1.7k

新的 Windows Terminal 和原始的 Windows 控制台主机，全都集中在这里！

cmdcommand-lineconsole+8
C++
177.4 MB
0
详情
opencv/opencv avatar
opencvopencv
18 小时前
91.5k
57.1k
2.9k

开源计算机视觉库

opencvc-plus-pluscomputer-vision+2
C++
558.2 MB
0
详情
bitcoin/bitcoin avatar
bitcoinbitcoin
17 小时前
90.6k
30.0k
344

Bitcoin Core 集成/暂存树

bitcoinc-plus-pluscryptocurrency+2
C++
324.2 MB
0
详情

关于

GitHub 原始描述（英文）

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

描述取自 GitHub 官方 API，保持仓库作者书写的原文。

简要分析

热度分
891
价值分
418
活跃状态
活跃
bitlockerbtreecompresseddiskefsfvegptlogfilembrmftntfsparserreparsesmartsparseundeleteusnvbrvmkvss
GitHub

语言占比

C
C++

Release

  • v1.72023年7月23日
  • v1.62022年3月31日
  • v1.52022年3月17日
  • v1.42021年10月10日
  • v1.32021年3月10日

贡献者

thewhiteninjathewhiteninjasmkubinsmkubinmitchcappermitchcapperdefiniteIymaybedefiniteIymaybevGimlyvGimly

README

ntfstool

GitHub license Language: C++ x64 x86 v1.6 Build


NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info (MBR, partition table, VBR) but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more.

Download the latest binaries on AppVeyor or by checking the last GitHub artefacts.

See below for some examples of the features!

An alternative documentation made by deepwiki is available here : https://deepwiki.com/thewhiteninja/ntfstool/

Features

Forensics

NTFSTool displays the complete structure of master boot record, volume boot record, partition table and $MFT file record. It is also possible to dump any file (even $MFT or SAM) or parse and analyze USN journal, LogFile including streams from Alternate Data Stream (ADS). $MFT can be dumped as csv or json with Zone.Identifier parsing to quickly identify downloaded files. The undelete command will search for any file record marked as “not in use” and allow you to retrieve the file (or part of the file if it was already rewritten). It support input from image file, live disk or virtual like VeraCrypt and TrueCrypt, but you can also use tools like OSFMount to mount your disk image. Sparse and compressed files (lznt1, xpress) are also supported.

Bitlocker support

For bitlocked partition, it can display FVE records, check a password and key (bek, password, recovery key), extract VMK and FVEK. There is no bruteforce feature because GPU-based cracking is better (see Bitcracker and Hashcat) but you can get the hash for these tools.

EFS support

Masterkeys, private keys and certificates can be listed, displayed and decrypted using needed inputs (SID, password). Certificates with private keys can be exported using the backup command.

Reinmport the backup on another machine to be able to read your encrypted file again! Or you can use the efs.decrypt command to decrypt a file using the backed-up key.

More information on Mimikatz Wiki

USN Journal analysis

USN journal records can be analyzed using custom rules to detect suspicious programs and actions but also to have an overview of the journal (% of file deleted, created …)

Default rules: Rules/default.json

  {
    "id": "lsass-dump",
    "description": "Dumped LSASS.exe process.",
    "severity": "high",
    "rule": {
      "filename": "lsass(\\.(dmp|dump))?"
    }
  }

See an example of run here: usn.analyze

Shell

There is a limited shell with few commands (exit, cd, ls, cat, pwd, cp, quit, rec).

Command rec shows the MFT record details.

Help & Examples

Help command displays description and examples for each command.

Options can be entered as decimal or hex number with “0x” prefix (ex: inode).

ntfstool help [command]
Command Description
info Display information for all disks and volumes
mbr Display MBR structure, code and partitions for a disk
gpt Display GPT structure, code and partitions for a disk
vbr Display VBR structure and code for a specidifed volume (ntfs, fat32, fat1x, bitlocker supported)
extract Extract a file from a volume.
image Create an image file of a disk or volume.
mft.dump Dump $MFT file in specified format: csv, json, raw.
mft.record Display FILE record details for a specified MFT inode. Almost all attribute types supported
mft.btree Display VCN content and Btree index for an inode
bitlocker.info Display information and hash ($bitlocker$) for all VMK. Test a password or recovery key.
bitlocker.decrypt Decrypt a volume to a file using password, recovery key or bek.
bitlocker.fve Display information for the specified FVE block.
efs.backup Export EFS keys in PKCS12 (pfx) format.
efs.decrypt Decrypt EFS encrypted file using keys in PKCS12 (pfx) format.
efs.certificate List, display and export system certificates (SystemCertificates/My/Certificates).
efs.key List, display, decrypt and export private keys (Crypto/RSA).
efs.masterkey List, display and decrypt masterkeys (Protect).
reparse Parse and display reparse points from $Extend$Reparse.
logfile.dump Dump $LogFile file in specified format: csv, json, raw.
usn.analyze Analyze $UsnJrnl file with specified rules. Output : csv or json.
usn.dump Dump $UsnJrnl file in specified format: csv, json, raw.
shadow List volume shadow snapshots from selected disk and volume.
streams Display Alternate Data Streams
undelete Search and extract deleted files for a volume.
shell Start a limited Unix-like shell
smart Display S.M.A.R.T data

Limitations

  • Some unsupported cases. WIP.
  • No documentation :no_mouth:.

Feel free to open an issue or ask for a new feature!

Build

  • Install Visual Studio 2022

  • Install vcpkg (for required third-party libs) as described here: vcpkg#getting-started

    git clone https://github.com/microsoft/vcpkg
.\vcpkg\bootstrap-vcpkg.bat

  • Integrate it to your VisualStudio env:

    vcpkg integrate install

At build time, VisualStudio will detect the vcpkg.json file and install required packages automatically.

Third-party libraries:

  • openssl: OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
  • nlohmann-json: JSON for Modern C++
  • distorm: Powerful Disassembler Library For x86/AMD64
  • cppcoro: A library of C++ coroutine abstractions for the coroutines TS.
  • re2: RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines.

Examples

Info

info
+-------------------------------------------------------------------------------------+
| Id | Model                     | Type      | Partition | Size                       |
+-------------------------------------------------------------------------------------+
| 0  | Samsung SSD 850 EVO 500GB | Fixed SSD | GPT       | 500107862016 (465.76 GiBs) |
| 1  | ST2000DM001-1ER164        | Fixed HDD | GPT       | 2000398934016 (1.82 TiB)   |
| 2  | 15EADS External           | Fixed HDD | MBR       | 1500301910016 (1.36 TiB)   |
| 3  | osfdisk                   | Fixed HDD | MBR       | 536870912 (512.00 MiBs)    |
+-------------------------------------------------------------------------------------+
info disk=3
Model       : osfdisk
Version     : 1
Serial      :
Media Type  : Fixed HDD
Size        : 536870912 (512.00 MiBs)
Geometry    : 512 bytes * 63 sectors * 255 tracks * 65 cylinders
Volume      : MBR

+--------------------------------------------------------------------------------------------------+
| Id | Boot | Label     | Mounted | Filesystem | Offset           | Size                           |
+--------------------------------------------------------------------------------------------------+
| 1  | No   | NTFSDRIVE | F:\     | Bitlocker  | 0000000000000200 | 000000001ffffe00 (512.00 MiBs) |
+--------------------------------------------------------------------------------------------------+
info disk=3 volume=1
Serial Number  : 0000aa60-00002eae
Filesystem     : Bitlocker
Bootable       : False
Type           : Fixed
Label          : NTFSDRIVE
Offset         : 512 (512.00 bytes)
Size           : 536870400 (512.00 MiBs)
Free           : 519442432 (495.38 MiBs)
Mounted        : True (F:\)
Bitlocker      : True (Unlocked)

MBR

mbr disk=2
Disk signature  : e4589462
Reserved bytes  : 0000

Partition table :
+---------------------------------------------------------------------------------------------------+
| Id | Boot | Flags     | Filesystem   | First sector | Last sector | Offset | Sectors  | Size      |
+---------------------------------------------------------------------------------------------------+
| 1  | No   | Principal | NTFS / exFAT | 0 2 3        | 255 254 255 | 128    | 16771072 | 8.00 GiBs |
+---------------------------------------------------------------------------------------------------+

MBR signature  : 55aa

Strings:
    [63] : Invalid partition table
    [7b] : Error loading operating system
    [9a] : Missing operating system

Disassemble Bootstrap Code [y/N] ? y

    0000 : 33c0           : xor ax, ax
    0002 : 8ed0           : mov ss, ax
    0004 : bc007c         : mov sp, 0x7c00
    0007 : 8ec0           : mov es, ax
    0009 : 8ed8           : mov ds, ax
    000b : be007c         : mov si, 0x7c00
    000e : bf0006         : mov di, 0x600
    0011 : b90002         : mov cx, 0x200
...

GPT

gpt disk=1
Signature        : EFI PART
Revision         : 1.0
Header Size      : 92
Header CRC32     : cc72e4d3
Reserved         : 00000000
Current LBA      : 1
Backup LBA       : 3907029167
First Usable LBA : 34
Last Usable LBA  : 3907029134
GUID             : {a21d6495-cd58-4b8d-b968-dc337adcf6ac}
Entry LBA        : 2
Entries Num      : 128
Entries Size     : 128
Partitions CRC32 : 0c9a0a25

Partition table  : 2 entries
+------------------------------------------------------------------------------------------------------------------------+
| Id | Name                         | GUID                                   | First sector | Last sector | Flags        |
+------------------------------------------------------------------------------------------------------------------------+
| 1  | Microsoft reserved partition | {da0ac4a1-a78c-4053-bab5-36c70a71fe63} | 34           | 262177      | 000000000000 |
| 2  | Basic data partition         | {4b4ea4b3-64a1-4c6d-bd4b-1c2b0e4e706f} | 264192       | 3907028991  | 000000000000 |
+------------------------------------------------------------------------------------------------------------------------+

VBR

vbr disk=3 volume=1
Structure :
    Jump             : eb5890 (jmp 0x7c5a)
    OEM id           : -FVE-FS-
    BytePerSector    : 512
    SectorPerCluster : 8
    Reserved Sectors : 0
    Number of FATs   : 0
    Root Max Entries : 0
    Total Sectors    : 0
    Media Type       : f8
    SectorPerFat     : 8160
    SectorPerTrack   : 63
    Head Count       : 255
    FS Offset        : 1
    Total Sectors    : 0
    FAT Flags        : 0000
    FAT Version      : 0000
    Root Cluster     : 0
    FS Info Sector   : 1
    Backup BootSector: 6
    Reserved         : 00000000
    Reserved         : 00000000
    Reserved         : 00000000
    Drive Number     : 80
    Reserved         : 00
    Ext. Boot Sign   : 29
    Serial Number    : 00000000
    Volume Name      : NO NAME
    FileSystem Type  : FAT32
    Volume GUID      : {4967d63b-2e29-4ad8-8399-f6a339e3d001}
    FVE Block 1      : 0000000002100000
    FVE Block 2      : 00000000059e4000
    FVE Block 3      : 00000000092c8000
    End marker       : 55aa

Strings:
    [00] : Remove disks or other media. 
    [1f] : Disk error 
    [2c] : Press any key to restart

Disassemble Bootstrap Code [y/N] ? y

    7c5a : eb58           : jmp 0x7cb4
    7c5c : 90             : nop
    7c5d : 2d4656         : sub ax, 0x5646
    7c60 : 45             : inc bp
    7c61 : 2d4653         : sub ax, 0x5346
    7c64 : 2d0002         : sub ax, 0x200
    ...

Extract

extract disk=0 volume=4 inode=0 output=d:\mymft
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num  : 0 (00000000h)
[-] Destination : d:\mymft
[+] File extracted (5123541 bytes written)
extract disk=3 volume=1 from=\bob.txt output=d:\bob.txt
[+] Opening \\?\Volume{00023d5d-0000-0000-0002-000000000000}\
[-] Record Num  : 47 (0000002fh)
[-] Destination : d:\bob.txt
[+] File extracted (42 bytes written)
extract disk=0 volume=4 --system output=d:\system
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[-] Record Num  : 623636 (00098414h)
[-] Destination : d:\system
[+] File extracted (19398656 bytes written)

Image

image disk=2 volume=2 output=d:\imagevol.raw
[+] Opening \\?\Volume{f095dd1d-f302-4d17-bf68-7cc8c1de3965}\
[-] Size     : 33520128 (31.97 MiBs)
[-] BlockSize: 4096
[+] Copying  : [################################] 100% 0s
[+] Done
image disk=2 output=d:\image.raw
[+] Opening \\.\PhysicalDrive2
[-] Size     : 67108864 (64.00 MiBs)
[-] BlockSize: 4096
[+] Copying  : [################################] 100% 0s
[+] Done

MFT-dump

mft.dump disk=2 volume=2 output=d:\mft.raw
[+] $MFT size   : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.raw
[+] Processing data: 1.00 MiB
[+] Closing volume
mft.dump disk=2 volume=2 output=d:\mft.csv format=csv
[+] $MFT size   : 1.00 MiB
[-] Record size : 1024
[-] Record count: 1024
[+] Creating d:\mft.csv
[+] Processing data: 1.00 MiB
[+] Closing volume
Sample of mft.csv (check the end of the last line for Zone.Identifier data)
RecordIndex,InUse,Type,Filename,Ext,Size,Parents,Time_MFT,Time_Create,Time_Alter,Time_Read,Att_Archive,Att_Compressed,Att_Device,Att_Encrypted,Att_Hidden,Att_Normal,Att_NotIndexed,Att_Offline,Att_Readonly,Att_Reparse,Att_Sparse,Att_System,Att_Temp,USN,Hardlinks,ADS,ZoneId,ReferrerUrl,HostUrl
0,"True","File","$MFT","",1048576,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
1,"True","File","$MFTMirr","",4096,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
2,"True","File","$LogFile","",67108864,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
3,"True","File","$Volume","",0,"5","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","2022-03-17 01:25:10","False","False","False","False","True","False","False","False","False","False","False","True","False",0,1,"","","",""
...
397,"True","File","vswhere.exe",".exe",457824,"103911","2020-10-19 18:42:19","2019-06-11 10:07:50","2019-06-11 10:07:52","2021-12-27 14:54:49","True","False","False","False","False","False","False","False","False","False","False","False","False",35944347632,1,"Zone.Identifier","3","https://github.com/microsoft/vswhere/releases","https://github-production-release-asset-2e65be.s3.amazonaws.com/78482723/06868000-5585-11e9-9001-982f1fcb7ef1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190611T100747Z&X-Amz-Expires=300&X-Amz-Signature=bc494e9edaafb03874097ae46466c5562d34252f14f21140c70e6a1a1fc5e5c4&X-Amz-SignedHeaders=host&actor_id=40250307&response-content-disposition=attachment%3B%20filename%3Dvswhere.exe&response-content-type=application%2Foctet-stream"

MFT-record

mft.record disk=2 volume=1 inode=5 (root folder)
Signature         : FILE
Update Offset     : 48
Update Number     : 3
$LogFile LSN      : 274035114
Sequence Number   : 5
Hardlink Count    : 1
Attribute Offset  : 56
Flags             : In_use | Directory
Real Size         : 704
Allocated Size    : 1024
Base File Record  : 0
Next Attribute ID : 56
MFT Record Index  : 5
Update Seq Number : 4461
Update Seq Array  : 00000000

Attributes:
-----------

+------------------------------------------------------------------------------------------------------------------+
| Id | Type                   | Non-resident | Length | Overview                                                   |
+------------------------------------------------------------------------------------------------------------------+
| 1  | $STANDARD_INFORMATION  | False        | 72     | File Created Time       : 2009-12-02 02:03:31              |
|    |                        |              |        | Last File Write Time    : 2020-02-24 19:42:23              |
|    |                        |              |        | FileRecord Changed Time : 2020-02-24 19:42:23              |
|    |                        |              |        | Last Access Time        : 2020-02-24 19:42:23              |
|    |                        |              |        | Permissions             :                                  |
|    |                        |              |        |   read_only     : 0                                        |
|    |                        |              |        |   hidden        : 1                                        |
|    |                        |              |        |   system        : 1                                        |
|    |                        |              |        |   device        : 0                                        |
|    |                        |              |        |   normal        : 0                                        |
|    |                        |              |        |   temporary     : 0                                        |
|    |                        |              |        |   sparse        : 0                                        |
|    |                        |              |        |   reparse_point : 0                                        |
|    |                        |              |        |   compressed    : 0                                        |
|    |                        |              |        |   offline       : 0                                        |
|    |                        |              |        |   not_indexed   : 1                                        |
|    |                        |              |        |   encrypted     : 0                                        |
|    |                        |              |        | Max Number of Versions  : 0                                |
|    |                        |              |        | Version Number          : 0                                |
+------------------------------------------------------------------------------------------------------------------+
| 2  | $FILE_NAME             | False        | 68     | Parent Dir Record Index : 5                                |
|    |                        |              |        | Parent Dir Sequence Num : 5                                |
|    |                        |              |        | File Created Time       : 2009-12-02 02:03:31              |
|    |                        |              |        | Last File Write Time    : 2011-12-24 03:13:12              |
|    |                        |              |        | FileRecord Changed Time : 2011-12-24 03:13:12              |
|    |                        |              |        | Last Access Time        : 1970-01-01 00:59:59              |
|    |                        |              |        | Allocated Size          : 0                                |
|    |                        |              |        | Real Size               : 0                                |
|    |                        |              |        | ------                                                     |
|    |                        |              |        | Name                    : .                                |
+------------------------------------------------------------------------------------------------------------------+
| 3  | $OBJECT_ID             | False        | 16     | Object Unique ID        : {cce8fec5-9a29-11df-be68-0017f29 |
|    |                        |              |        |                           8268d}                           |
+------------------------------------------------------------------------------------------------------------------+
| 4  | $INDEX_ROOT            | False        | 152    | Attribute Type          : 00000030h                        |
|    |                        |              |        | Collation Rule          : 1                                |
|    |                        |              |        | Index Alloc Entry Size  : 4096                             |
|    |                        |              |        | Cluster/Index Record    : 1                                |
|    |                        |              |        | -----                                                      |
|    |                        |              |        | First Entry Offset      : 16                               |
|    |                        |              |        | Index Entries Size      : 136                              |
|    |                        |              |        | Index Entries Allocated : 136                              |
|    |                        |              |        | Flags                   : Large Index                      |
+------------------------------------------------------------------------------------------------------------------+
| 5  | $INDEX_ALLOCATION      | True         | 12288  | Index                                                      |
|    |                        |              |        |        0000000000000004 : $AttrDef                         |
|    |                        |              |        |        0000000000000008 : $BadClus                         |
|    |                        |              |        |        0000000000000006 : $Bitmap                          |
|    |                        |              |        |        0000000000000007 : $Boot                            |
|    |                        |              |        |        000000000000000b : $Extend                          |
|    |                        |              |        |        0000000000000002 : $LogFile                         |
|    |                        |              |        |        0000000000000000 : $MFT                             |
|    |                        |              |        |        0000000000000001 : $MFTMirr                         |
|    |                        |              |        |        000000000000002d : $RECYCLE.BIN                     |
|    |                        |              |        |        0000000000000009 : $Secure                          |
|    |                        |              |        |        000000000000000a : $UpCase                          |
|    |                        |              |        |        0000000000000003 : $Volume                          |
|    |                        |              |        |        0000000000000005 : .                                |
|    |                        |              |        |        000000000000240c : Dir1                             |
|    |                        |              |        |        0000000000000218 : Dir2                             |
|    |                        |              |        |        000000000000212a : Dir3                             |
|    |                        |              |        |        0000000000000024 : Dir4                             |
|    |                        |              |        |        0000000000000def : RECYCLER                         |
|    |                        |              |        |        000000000000001b : System Volume Information        |
|    |                        |              |        |        000000000000001b : SYSTEM~1                         |
+------------------------------------------------------------------------------------------------------------------+
| 6  | $BITMAP                | False        | 8      | Index Node Used         : 2                                |
+------------------------------------------------------------------------------------------------------------------+

MFT-btree

mft.btree disk=0 volume=1 inode=5 (root folder)
Attributes:
-----------

+-------------------------------------------------------------------------------------------+
| Id | Type              | Non-resident | Length | Overview                                 |
+-------------------------------------------------------------------------------------------+
| 1  | $INDEX_ROOT       | False        | 56     | Attribute Type          : Filename       |
|    |                   |              |        | Collation Rule          : 1              |
|    |                   |              |        | Index Alloc Entry Size  : 4096           |
|    |                   |              |        | Cluster/Index Record    : 1              |
|    |                   |              |        | -----                                    |
|    |                   |              |        | First Entry Offset      : 16             |
|    |                   |              |        | Index Entries Size      : 40             |
|    |                   |              |        | Index Entries Allocated : 40             |
|    |                   |              |        | Flags                   : Large Index    |
+-------------------------------------------------------------------------------------------+
| 2  | $INDEX_ALLOCATION | True         | 20480  | First VCN               : 0x000000000000 |
|    |                   |              |        | Last VCN                : 0x000000000004 |
+-------------------------------------------------------------------------------------------+

$INDEX_ALLOCATION entries:
--------------------------

+--------------------------------------------------------------------------------------------+
| VCN           | Raw address   | Size          | Entries                                    |
+--------------------------------------------------------------------------------------------+
| 000000000000h | 000000024000h | 000000001000h | 000000000004: $AttrDef                     |
|               |               |               | 000000000008: $BadClus                     |
|               |               |               | 000000000006: $Bitmap                      |
						...
|               |               |               | 000000000009: $Secure                      |
|               |               |               | 00000000000a: $UpCase                      |
|               |               |               | 000000000003: $Volume                      |
+--------------------------------------------------------------------------------------------+
| 000000000001h | 000000025000h | 000000001000h | 000000000098: randomfile - Copie (5).accdb |
|               |               |               | 000000000097: randomfile - Copie (5).bat   |
|               |               |               | 000000000095: randomfile - Copie (5).psd   |
|               |               |               | 000000000096: randomfile - Copie (5).txt   |
|               |               |               | 00000000009b: randomfile - Copie (6).accdb |
						...
|               |               |               | 000000000083: randomfile.accdb             |
|               |               |               | 000000000082: randomfile.bat               |
|               |               |               | 000000000084: randomfile.psd               |
|               |               |               | 000000000081: randomfile.txt               |
|               |               |               | 000000000024: System Volume Information    |
+--------------------------------------------------------------------------------------------+
| 000000000002h | 0000007d6000h | 000000001000h |                                            |
+--------------------------------------------------------------------------------------------+
| 000000000003h | 0000007d7000h | 000000001000h | 000000000005: .                            |
|               |               |               | 000000000092: randomfile - Copie (4).txt   |
+--------------------------------------------------------------------------------------------+
| 000000000004h | 0000007d8000h | 000000001000h | 000000000027: random folder                |
|               |               |               | 00000000008c: randomfile - Copie (2).accdb |
|               |               |               | 00000000008b: randomfile - Copie (2).bat   |
|               |               |               | 000000000089: randomfile - Copie (2).psd   |
						...
|               |               |               | 00000000008e: randomfile - Copie (3).txt   |
|               |               |               | 000000000094: randomfile - Copie (4).accdb |
|               |               |               | 000000000093: randomfile - Copie (4).bat   |
|               |               |               | 000000000091: randomfile - Copie (4).psd   |
+--------------------------------------------------------------------------------------------+

B-tree index:
-------------

Root
|- 000000000000:
|---- VCN: 3
	 |- 000000000005: .
	 |---- VCN: 0
		  |- 000000000004: $AttrDef
		  |- 000000000008: $BadClus
		  |- 000000000006: $Bitmap
		  ....
		  |- 000000000009: $Secure
		  |- 00000000000a: $UpCase
		  |- 000000000003: $Volume
	 |- 000000000092: randomfile - Copie (4).txt
	 |---- VCN: 4
		  |- 000000000027: random folder
		  |- 00000000008c: randomfile - Copie (2).accdb
		  |- 00000000008b: randomfile - Copie (2).bat
		  |- 000000000089: randomfile - Copie (2).psd
		  ....
		  |- 000000000094: randomfile - Copie (4).accdb
		  |- 000000000093: randomfile - Copie (4).bat
		  |- 000000000091: randomfile - Copie (4).psd
	 |- 000000000000 (*)
	 |---- VCN: 1
		  |- 000000000098: randomfile - Copie (5).accdb
		  |- 000000000097: randomfile - Copie (5).bat
		  |- 000000000095: randomfile - Copie (5).psd
		  ....
		  |- 000000000084: randomfile.psd
		  |- 000000000081: randomfile.txt
		  |- 000000000024: System Volume Information

Bitlocker-Info

bitlocker.info disk=3 volume=1
FVE Version    : 2
State          : ENCRYPTED
Size           : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm      : AES-XTS-128
Timestamp      : 2020-02-26 16:39:17

Volume Master Keys:
-------------------

+--------------------------------------------------------------------------------------------------------------------+
| Id | Type              | GUID                                   | Details                                          |
+--------------------------------------------------------------------------------------------------------------------+
| 1  | Password          | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | Nonce         : 01d5ecbb00f7155000000003         |
|    |                   |                                        | MAC           : daea96439babc5d1e7f20c8860ff1ee9 |
|    |                   |                                        | Encrypted Key : b76281568419ec3bee89d1eddccf3169 |
|    |                   |                                        |                 59c466b6b392f40f0875e58168d868d7 |
|    |                   |                                        |                 0788bd366bec117b11a9fd6e         |
|    |                   |                                        |                                                  |
|    |                   |                                        | JtR Hash      : $bitlocker$1$16$daea96439babc5d1 |
|    |                   |                                        |                 e7f20c8860ff1ee9$1048576$12$5015 |
|    |                   |                                        |                 f700bbecd50103000000$60$175ec23c |
|    |                   |                                        |                 d799e2bde9d24bf3697919feb7628156 |
|    |                   |                                        |                 8419ec3bee89d1eddccf316959c466b6 |
|    |                   |                                        |                 b392f40f0875e58168d868d70788bd36 |
|    |                   |                                        |                 6bec117b11a9fd6e                 |
+--------------------------------------------------------------------------------------------------------------------+
| 2  | Recovery Password | {19b4a3e2-94b3-452f-a614-6212faeb1b9d} | Nonce         : 01d5ecbb00f7155000000006         |
|    |                   |                                        | MAC           : b9963d29e1bad1f42e60c3bfb6e3bef5 |
|    |                   |                                        | Encrypted Key : 97a43d40c695c6d190eba3956ac7c7b1 |
|    |                   |                                        |                 f5fdbbc7f9a61a77c914fa347479c7ac |
|    |                   |                                        |                 6124ff46865e805367f7bef1         |
|    |                   |                                        |                                                  |
|    |                   |                                        | JtR Hash      : $bitlocker$1$16$b9963d29e1bad1f4 |
|    |                   |                                        |                 2e60c3bfb6e3bef5$1048576$12$5015 |
|    |                   |                                        |                 f700bbecd50106000000$60$3a06a06f |
|    |                   |                                        |                 db044d850ecd6faf5cf2aec997a43d40 |
|    |                   |                                        |                 c695c6d190eba3956ac7c7b1f5fdbbc7 |
|    |                   |                                        |                 f9a61a77c914fa347479c7ac6124ff46 |
|    |                   |                                        |                 865e805367f7bef1                 |
+--------------------------------------------------------------------------------------------------------------------+
bitlocker.info disk=3 volume=1 password=badpassword
FVE Version    : 2
State          : ENCRYPTED
Size           : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm      : AES-XTS-128
Timestamp      : 2020-02-26 16:39:17

Tested Password:
----------------

+--------------------------------------------------------------------------------+
| Id | Type     | GUID                                   | Password    | Result  |
+--------------------------------------------------------------------------------+
| 1  | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | badpassword | Invalid |
+--------------------------------------------------------------------------------+
bitlocker.info disk=3 volume=1 password=123456789
FVE Version    : 2
State          : ENCRYPTED
Size           : 536870400 (512.00 MiBs)
Encrypted Size : 536870400 (512.00 MiBs)
Algorithm      : AES-XTS-128
Timestamp      : 2020-02-26 16:39:17

Tested Password:
----------------

+--------------------------------------------------------------------------------------------------------------+
| Id | Type     | GUID                                   | Password  | Result                                  |
+--------------------------------------------------------------------------------------------------------------+
| 1  | Password | {2dd368f3-37d7-414f-94e6-3c5b86fadd50} | 123456789 | Valid                                   |
|    |          |                                        |           |                                         |
|    |          |                                        |           | VMK  : 751bf363db63ba6f1b36fb2ecd5ff1d8 |
|    |          |                                        |           |        f5eab77e8754a848f2743978c7615f9f |
|    |          |                                        |           | FVEK : 35b8197e6d74d8521f49698d5f556589 |
|    |          |                                        |           |        2cf286ae5323c65631965c905a9d7da4 |
+--------------------------------------------------------------------------------------------------------------+

Bitlocker-Decrypt

bitlocker.decrypt disk=3 volume=1 output=decrypted.img fvek=35b8197e6d74d8521f49698d5f5565892cf286ae5323c65631965c905a9d7da4
[+] Opening \\?\Volume{09a02598-0000-0000-0002-000000000000}\
[+] Reading Bitlocker VBR
[-]   Volume State   : ENCRYPTED
[-]   Size           : 536870400 (512.00 MiBs)
[-]   Encrypted Size : 536870400 (512.00 MiBs)
[-]   Algorithm      : AES-XTS-128
[+] Decrypting sectors
[-]   Processed data size : 512.00 MiBs (100%)
[+] Duration : 7535ms
[+] Closing Volume

Bitlocker-FVE

bitlocker.fve disk=3 volume=1 fve_block=2
Signature             : -FVE-FS-
Size                  : 57
Version               : 2
Current State         : ENCRYPTED (4)
Next State            : ENCRYPTED (4)
Encrypted Size        : 536870400 (512.00 MiBs)
Convert Size          : 0
Backup Sectors        : 16
FVE Block 1           : 0000000002100000
FVE Block 2           : 00000000059e4000
FVE Block 3           : 00000000092c8000
Backup Sectors Offset : 0000000002110000

FVE Metadata Header
-------------------

Size                  : 840
Version               : 1
Header Size           : 48
Copy Size             : 840
Volume GUID           : {70a57ea3-9b98-4034-8b6a-645f731e2d1e}
Next Counter          : 10
Algorithm             : AES-XTS-128 (8004)
Timestamp             : 2020-02-26 16:39:17

FVE Metadata Entries (5)
------------------------

+----------------------------------------------------------------------------------------------------------------+
| Id | Version | Size | Entry Type          | Value Type      | Value                                            |
+----------------------------------------------------------------------------------------------------------------+
| 1  | 1       | 72   | Drive Label         | Unicode         | String        : TWN NTFSDRIVE 26/02/2020         |
+----------------------------------------------------------------------------------------------------------------+
| 2  | 1       | 224  | VMK                 | VMK             | Key ID        : {2dd368f3-37d7-414f-94e6-3c5b86f |
|    |         |      |                     |                 |                 add50}                           |
|    |         |      |                     |                 | Last Change   : 2020-02-26 16:40:00              |
|    |         |      |                     |                 | Protection    : Password                         |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #1 - Stretch Key - 108                  |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Encryption    : STRETCH KEY                      |
|    |         |      |                     |                 | MAC           : daea96439babc5d1e7f20c8860ff1ee9 |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #1.1 - AES-CCM - 80                     |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000002                         |
|    |         |      |                     |                 | MAC           : 1dfebdc79a966e72ca806d6a83d8c7ba |
|    |         |      |                     |                 | Key           : eb51a188df981b54f51698c76d76a8bb |
|    |         |      |                     |                 |                 d22afbbe27603ea6afc34c077726262e |
|    |         |      |                     |                 |                 5ba07482053d3c36fdecf80f         |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #2 - AES-CCM - 80                       |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000003                         |
|    |         |      |                     |                 | MAC           : 175ec23cd799e2bde9d24bf3697919fe |
|    |         |      |                     |                 | Key           : b76281568419ec3bee89d1eddccf3169 |
|    |         |      |                     |                 |                 59c466b6b392f40f0875e58168d868d7 |
|    |         |      |                     |                 |                 0788bd366bec117b11a9fd6e         |
+----------------------------------------------------------------------------------------------------------------+
| 3  | 1       | 316  | VMK                 | VMK             | Key ID        : {19b4a3e2-94b3-452f-a614-6212fae |
|    |         |      |                     |                 |                 b1b9d}                           |
|    |         |      |                     |                 | Last Change   : 2020-02-26 16:40:07              |
|    |         |      |                     |                 | Protection    : Recovery Password                |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #1 - Stretch Key - 172                  |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Encryption    : STRETCH KEY                      |
|    |         |      |                     |                 | MAC           : b9963d29e1bad1f42e60c3bfb6e3bef5 |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #1.1 - AES-CCM - 64                     |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000004                         |
|    |         |      |                     |                 | MAC           : 8064d679c7d8d1fa8ae548b0844882c7 |
|    |         |      |                     |                 | Key           : 18d21021d40e3dc99d38c8dd84faed10 |
|    |         |      |                     |                 |                 370c32095f4f63261ad8ec40         |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #1.2 - AES-CCM - 80                     |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000005                         |
|    |         |      |                     |                 | MAC           : 3d40f2b5fc0091b894b438763fcdf4cd |
|    |         |      |                     |                 | Key           : a0af0aeda32d977d26ac76f9fc429668 |
|    |         |      |                     |                 |                 955d2a6a49fe4e2323751924e47e6c39 |
|    |         |      |                     |                 |                 8c22f7fcd2d4272003cb7a4e         |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #2 - AES-CCM - 80                       |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000006                         |
|    |         |      |                     |                 | MAC           : 3a06a06fdb044d850ecd6faf5cf2aec9 |
|    |         |      |                     |                 | Key           : 97a43d40c695c6d190eba3956ac7c7b1 |
|    |         |      |                     |                 |                 f5fdbbc7f9a61a77c914fa347479c7ac |
|    |         |      |                     |                 |                 6124ff46865e805367f7bef1         |
|    |         |      |                     |                 |                                                  |
|    |         |      |                     |                 | Property #3 - Recovery Backup - 28               |
|    |         |      |                     |                 | --------                                         |
|    |         |      |                     |                 | Location      : File                             |
|    |         |      |                     |                 | Start         : 2022-04-03 12:52:50              |
|    |         |      |                     |                 | End           : 2022-04-03 12:52:50              |
+----------------------------------------------------------------------------------------------------------------+
| 4  | 1       | 80   | FKEV                | AES-CCM         | Nonce as Hex  : 01d5ecbb00f71550                 |
|    |         |      |                     |                 | Nonce as Time : 2020-02-26 16:39:59              |
|    |         |      |                     |                 | Nonce Counter : 00000008                         |
|    |         |      |                     |                 | MAC           : 2ff7d7f79920e3509fb8d20cb15b62c8 |
|    |         |      |                     |                 | Key           : 097169b9a5c41420ed2353a4a4210763 |
|    |         |      |                     |                 |                 a8833d1a4a88c6f7c0c45ec7c0959f25 |
|    |         |      |                     |                 |                 2c8eac3f306e9fd1e693784a         |
+----------------------------------------------------------------------------------------------------------------+
| 5  | 1       | 100  | Volume Header Block | Offset and Size | Offset        : 0000000002110000                 |
|    |         |      |                     |                 | Size          : 0000000000002000                 |
+----------------------------------------------------------------------------------------------------------------+

EFS-backup

efs.backup disk=0 volume=4 password=123456
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
    8 directories found
[+] Searching for certificates
    - 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B
[+] Finding corresponding private keys
    - 5f2870d8a6f1ef6487be2e1aee746fb5_bbc401c6-854a-4d12-9b65-8d52ca66cb6a
[+] Finding corresponding masterkeys
    - 9ac19509-54d3-48bc-8c67-4cfb01d73498
[+] Exporting 1 certificates and keys (pass: backup)
    - ef456e5b-43e4-4eda-a80b-e234611306d4 : Ok
      Exported to 8BB98DE9ED4DBDD09AA1FF467ED71F0F28ACF61B.pfx

EFS-decrypt

efs.decrypt disk=0 volume=4 from=c:\cat.png pfx=z:\my_backup.pfx password=backup output=c:\socute.png
[+] Loading PKCS12 input file
[-] KeyID : 86598de9ed5dbdd00aa2ff467ed71f1f28acf61b
[-] Reading record: 13525
[+] Parsing $EFS streams
[-] 1 data decryption field(s) found
[+] Decrypting FEK
[-] FEK
    +----------------------------------------------------------------------------------+
    | Property      | Value                                                            |
    +----------------------------------------------------------------------------------+
    | Entropy       | 32                                                               |
    | Algorithm     | CALG_AES_256                                                     |
    | Key (256bits) | 5BBBB8A7F9DD9B9FFFDE9E62370254979F32A9CFFDDB74212A0C1AEECCD75B4A |
    +----------------------------------------------------------------------------------+
[+] Decrypting file
[-] Decrypted file written to c:\socute.png (1.94 MiB)

EFS-certificate

README 内容过长，已截取部分内容。完整内容请前往 GitHub 仓库查看。

评论

暂无评论
efs.certificate disk=0 volume=4
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Listing user directories
    8 directories found
[+] Searching for certificates
    8 certificate(s) found
[+] Certificates
    +-----------------------------------------------------------------------------------------------------------------------------------+
    | Id | User  | File                                                | Certificate                                                    |
    +-----------------------------------------------------------------------------------------------------------------------------------+
    |  0 | Bobby | Name     : 02728B6DF5573C5955A4DFF22319441C889C367B | Friendly Name : APNS certificate Direct                        |
    |    |       | Record   : 00000001d2d5h                            |                                                                |
    |    |       | Size     : 850.00 bytes                             |                                                                |
    |    |       |                                                     |                                                                |
    |    |       | Creation : 2019-05-11 15:59:29                      |                                                                |
    +-----------------------------------------------------------------------------------------------------------------------------------+
    |  1 | Bobby | Name     : 14BB7663C51C77FF5CAD89B4DC34495864338C67 | Friendly Name : APNS certificate                               |
    |    |       | Record   : 00000000b5a4h                            |                                                                |
    |    |       | Size     : 824.00 bytes                             |                                                                |
    |    |       |                                                     |                                                                |
    |    |       | Creation : 2021-03-03 18:02:33                      |                                                                |
    +-----------------------------------------------------------------------------------------------------------------------------------+
    |  2 | Bobby | Name     : 564481148D4DBDD09AA1FF467ED71F0F28ACF61B | Container     : ef456e5b-36e4-4eda-a80b-e234611306d4           |
    |    |       | Record   : 00000000ab23h                            | Provider      : Microsoft Enhanced Cryptographic Provider v1.0 |
    |    |       | Size     : 1.15 KiB                                 | Type          : PROV_RSA_FULL                                  |
    |    |       |                                                     | KeySpec       : AT_KEYEXCHANGE                                 |
    |    |       | Creation : 2020-08-17 13:20:03                      |                                                                |
    +-----------------------------------------------------------------------------------------------------------------------------------+
                                                            ..........
efs.certificate disk=0 volume=4 inode=0xb5a4
[+] Opening \\?\Volume{ee732b26-571c-4516-b8fd-32282aa8e66b}\
[+] Reading certificate file record: 46500
[+] Certificate
    +--------------------------------------------------------------------------------------------------------------------------+
    | Id | Property                            | Value                                                                         |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  0 | File                                | Creation : 2021-03-03 18:02:33                                                |
    |    |                                     | Size     : 824.00 bytes                                                       |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  1 | SHA1_HASH_PROP_ID                   | 14A67663C51C66FF5CAD89B4DC34495864338C67                                      |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  2 | FRIENDLY_NAME_PROP_ID               | APNS certificate                                                              |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  3 | KEY_IDENTIFIER_PROP_ID              | 82B87AE4F2251242252A2644D98169F34F909CA8                                      |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  4 | SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID | DB532C4794A15E5D0392C7C605FCBCA8                                              |
    +--------------------------------------------------------------------------------------------------------------------------+
    |  5 | CERTIFICATE_FILE                    | Data:                                                                         |
    |    |                                     |     Version: 3 (0x2)                                                          |
    |    |                                     |     Serial Number:                                                            |
    |    |                                     |         01:20:cb:ab:28:8a:97:ee:99:cc                                         |
    |    |                                     |     Signature Algorithm: sha1WithRSAEncryption                                |
    |    |                                     |     Issuer: C=US, O=Apple Inc., OU=Apple iPhone, CN=Apple iPhone Device CA    |
    |    |                                     |     Validity                                                                  |
    |    |                                     |         Not Before: Mar  3 15:57:33 2021 GMT                                  |
    |    |                                     |         Not After : Mar  3 16:02:33 2022 GMT                                  |
    |    |                                     |     Subject: CN=1A6032AA-91A2-4B1D-B6AF-5509FC173686                          |
    |    |                                     |     Subject Public Key Info:                                                  |
    |    |                                     |         Public Key Algorithm: rsaEncryption                                   |
    |    |                                     |             RSA Public-Key: (1024 bit)                                        |
    |    |                                     |             Modulus:                                                          |
    |    |                                     |                 00:a2:75:db:69:8d:c9:b3:fd:96:4d:28:b9:43:94:                 |
    |    |                                     |                 db:7d:73:53:88:c9:79:e9:fa:de:e4:12:14:2c:de:                 |
                                                      ...
    |    |                                     |                 a7:6b:d0:01:9e:dc:66:27:ef:2e:20:7e:e5:2a:42:                 |
    |    |                                     |                 9e:6f:85:9c:b6:8f:be:d3:05                                    |
    |    |                                     |             Exponent: 65537 (0x10001)                                         |
    |    |                                     |     X509v3 extensions:                                                        |
    |    |                                     |         X509v3 Authority Key Identifier:                                      |
    |    |                                     |             keyid:B2:FE:21:23:44:86:95:6A:79:D5:81:26:8E:73:10:D8:A7:4C:8E:74 |
    |    |                                     |         X509v3 Subject Key Identifier:                                        |
    |    |                                     |             82:B8:7A:E4:F2:25:12:42:25:2A:26:44:D9:81:69:F3:4F:90:9C:A8       |
    |    |                                     |         X509v3 Basic Constraints: critical                                    |
    |    |                                     |             CA:FALSE                                                          |
    |    |                                     |         X509v3 Key Usage: critical                                            |
    |    |                                     |             Digital Signature, Key Encipherment                               |
    |    |                                     |         X509v3 Extended Key Usage: critical                                   |
    |    |                                     |             TLS Web Server Authentication, TLS Web Client Authentication      |
    |    |                                     |         1.2.840.113635.100.6.10.6:                                            |
    |    |                                     |             ..                                                                |
    |    |                                     | Signature Algorithm: sha1WithRSAEncryption                                    |
    |    |                                     |      28:54:6c:d9:4e:97:f5:dd:1f:79:4a:6a:74:42:ad:6e:a1:11:                   |
                                                 ...
    |    |                                     |      27:58:3b:d5:1e:c3:71:af:6b:bd:fe:5d:ad:4d:bd:82:fa:53:                   |
    |    |                                     |      ff:0c                                                                    |
    +--------------------------------------------------------------------------------------------------------------------------+