From 76426f286f97fe8ef9463be5947b611430de18a8 Mon Sep 17 00:00:00 2001 From: Jared Atkinson Date: Thu, 29 Dec 2016 12:05:03 -0500 Subject: [PATCH] Updated README to point to svg files instead of PNG --- README.md | 28 +- .../0x10-$STANDARDINFORMATION.svg | 832 -------------- src/NTFS/MFT_Attributes/0x30-$FILENAME.svg | 1011 ----------------- 3 files changed, 14 insertions(+), 1857 deletions(-) delete mode 100644 src/NTFS/MFT_Attributes/0x10-$STANDARDINFORMATION.svg delete mode 100644 src/NTFS/MFT_Attributes/0x30-$FILENAME.svg diff --git a/README.md b/README.md index 235c20b..ea2568b 100644 --- a/README.md +++ b/README.md @@ -2,33 +2,33 @@ ![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/BootSectors/GuidPartitionTable.png?raw=true "Guid Partition Table") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/7_$Boot(VBR).png?raw=true "$Boot (Volume Boot Record)") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/NTFSVolumeBootRecord.svg "$Boot (Volume Boot Record)") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0_MFT.png?raw=true "$MFT (Master File Table)") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MasterFileTable.svg "$MFT (Master File Table)") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x10_$STANDARD_INFORMATION.png?raw=true "$STANDARD_INFORMATION Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x10-%24STANDARD_INFORMATION.svg "$STANDARD_INFORMATION Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x20_$ATTRIBUTE_LIST.png?raw=true "$ATTRIBUTE_LIST Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x20-%24ATTRIBUTE_LIST.svg "$ATTRIBUTE_LIST Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x30_$FILE_NAME.png?raw=true "$FILE_NAME Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x30-%24FILE_NAME.svg "$FILE_NAME Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x60_$VOLUME_NAME.png?raw=true "$VOLUME_NAME Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x60-%24VOLUME_NAME.svg "$VOLUME_NAME Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x70_$VOLUME_INFORMATION.png?raw=true "$VOLUME_INFORMATION Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x70-%24VOLUME_INFORMATION.svg "$VOLUME_INFORMATION Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x80_$DATA.png?raw=true "$DATA Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x80-%24DATA.svg "$DATA Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0x90_$INDEX_ROOT.png?raw=true "$INDEX_ROOT Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0x90-%24INDEX_ROOT.svg "$INDEX_ROOT Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0xA0_$INDEX_ALLOCATION.png?raw=true "$INDEX_ALLOCATION Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/0xA0-%24INDEX_ALLOCATION.svg "$INDEX_ALLOCATION Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/0xXX_NonResident.png?raw=true "Non-Resident Attribute") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/MFT_Attributes/NonResident.svg "Non-Resident Attribute") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/4_$AttrDef.png?raw=true "$AttrDef (Attribute Definition File)") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24AttrDef.svg "$AttrDef (Attribute Definition File)") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/$UsnJrnl_$Max.png?raw=true "$UsnJrnl $Max Data Stream") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24UsnJrnl_%24Max.svg "$UsnJrnl $Max Data Stream") -![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/NTFS/$UsnJrnl_$J.png?raw=true "UsnJrnl $J Data Stream") +![alt text](https://cdn.rawgit.com/Invoke-IR/ForensicPosters/master/src/NTFS/%24UsnJrnl_%24J.svg "UsnJrnl $J Data Stream") ![alt text](https://github.com/Invoke-IR/Forensic-Posters/blob/master/Posters/Registry_Header.png?raw=true "Registry Header") diff --git a/src/NTFS/MFT_Attributes/0x10-$STANDARDINFORMATION.svg b/src/NTFS/MFT_Attributes/0x10-$STANDARDINFORMATION.svg deleted file mode 100644 index 72859bc..0000000 --- a/src/NTFS/MFT_Attributes/0x10-$STANDARDINFORMATION.svg +++ /dev/null @@ -1,832 +0,0 @@ - - - - - - - - - - image/svg+xml - - - - - - - - - - - - 10 00 00 00 60 00 00 0000 00 00 00 00 00 00 00 48 00 00 00 18 00 00 001D 8E 30 3D AE 99 D0 01 4B E8 BA 65 E9 9B D0 014B E8 BA 65 E9 9B D0 01 1D 8E 30 3D AE 99 D0 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 AD 05 00 00 00 00 00 00 00 00 00 00C0 E6 B7 13 00 00 00 00 - - - attribute typetotal sizenon resident flagname lengthname offsetflagsidattribute sizeattribute offsetindex flagborn timemodified timemft change timeaccess timepermissionmax version numberversion numberclass idowner idsecurity idquota chargedusn - - CommonHeader - REsidentHeader - - StandardInformationAttribute - 16 - Standard Info0x600x00 - resident0x000x000x000x000x480x180x005/29/2015 1:24:42 AM5/31/2015 9:33:13 PM5/31/2015 9:33:13 PM5/29/2015 1:24:42 AM0x200x00 - versions disabled0x000x000x000x5AD0x00 - quotas disabled13B7E6C0 - - Fields - - Values - 0x0001 - Read-Only0x0002 - Hidden0x0004 - System0x0020 - Archive0x0040 - Device0x0080 - Normal0x0100 - Temporary0x0200 - Sparse File0x0400 - Reparse Point0x0800 - Compressed0x1000 - Offline0x2000 - Not Content Indexed0x4000 - Encrypted0x10000000 - Directory0x20000000 - Index View - pERMISSIONS - - - - - - - - $STANDARD_INFORMATIONATTRIBUTE - By: Jared AtkinsonTemplate by: Ange Albertini - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/src/NTFS/MFT_Attributes/0x30-$FILENAME.svg b/src/NTFS/MFT_Attributes/0x30-$FILENAME.svg deleted file mode 100644 index b8d9068..0000000 --- a/src/NTFS/MFT_Attributes/0x30-$FILENAME.svg +++ /dev/null @@ -1,1011 +0,0 @@ - - - - - - - - - - image/svg+xml - - - - - - - - - - - - - 30 00 00 00 78 00 00 00 00 00 00 00 00 00 02 005E 00 00 00 18 00 01 00 85 EC 02 00 00 00 3B 001D 8E 30 3D AE 99 D0 01 1D 8E 30 3D AE 99 D0 011D 8E 30 3D AE 99 D0 01 1D 8E 30 3D AE 99 D0 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0020 00 00 00 00 00 00 00 0E 01 68 00 65 00 6C 00 6C 00 6F 00 77 00 6F 00 72 00 6C 00 64 00 2E 00 74 00 78 00 74 00 00 00 - - - attribute typetotal sizenon resident flagname lengthname offsetflagsidattribute sizeattribute offsetindex flagparent record numberparent sequence numberborn timemodified timemft change timeaccess timeallocated sizereal sizeflagsERnamelengthnamespacename - - CommonHeader - REsidentHeader - - fILE_NAMEAttribute - 48 - filename0x780x00 - resident0x000x000x000x020x5E0x180x01191621595/29/2015 1:24:42 AM5/29/2015 1:24:42 AM5/29/2015 1:24:42 AM5/29/2015 1:24:42 AM0x000x000x200x0014 Unicode Characters0x01helloworld.txt - - Fields - - Values - 0x0001 - Read-Only0x0002 - Hidden0x0004 - System0x0020 - Archive0x0040 - Device0x0080 - Normal0x0100 - Temporary0x0200 - Sparse File0x0400 - Reparse Point0x0800 - Compressed0x1000 - Offline0x2000 - Not Content Indexed0x4000 - Encrypted0x10000000 - Directory0x20000000 - Index View - Flags - - 0x00 - POSIX0x01 - Win320x02 - DOS0x03 - Win32 & DOS - File namespaces - - Allocated Size - Size of allocated diskspace. This size will be divisible by thesize of a disk cluster.Real Size - Actual size of file contents.This size is the one referenced by the "dir" command.If real and allocated size are 0, then thefile's contents are contained within aresident data attribute in the file's MFTrecord. - Real vs Allocated Size - - - - - - - - $fILE_nAMEATTRIBUTE - By: Jared AtkinsonTemplate by: Ange Albertini - - - - - - - - - - - - - - - - - - - - - - - - - - -