Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-mft-for-deleted-file-recoverygit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-mft-for-deleted-file-recovery)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-mft-for-deleted-file-recovery"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-mft-for-deleted-file-recovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-mft-for-deleted-file-recovery"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-mft-for-deleted-file-recovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.02180 |
| Opus 5 | $0.00039 | $0.01090 |
| Sonnet 5 | $0.00015 | $0.00436 |
| Haiku 4.5 | $0.00008 | $0.00218 |
Grade A, and why
analyzing-mft-for-deleted-file-recovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
分析 MFT 用于已删除文件恢复
概述
NTFS 主文件表（$MFT）是 NTFS 卷上每个文件和目录的中央元数据存储库。每个文件至少由一条 1024 字节的 MFT 记录表示，其中包含 $STANDARD_INFORMATION（时间戳、权限）、$FILE_NAME（名称、父目录、时间戳）和 $DATA（文件内容或簇运行指针）等属性。文件被删除时，其 MFT 记录被标记为非活动状态（InUse 标志清除），但元数据保留到被新文件的条目覆盖为止。这种持久性使 MFT 分析成为恢复已删除文件证据、重建文件系统时间线以及检测反取证活动（如时间戳篡改）的主要技术。
前置条件
- 取证磁盘镜像（E01、raw/dd、VMDK 或 VHDX 格式）
- MFTECmd（Eric Zimmerman 工具）或 analyzeMFT（基于 Python）
- FTK Imager、Arsenal Image Mounter 或类似工具用于挂载镜像
- Timeline Explorer 或 Excel 用于 CSV 分析
- Python 3.8+ 用于自定义分析脚本
- 了解 NTFS 文件系统内部结构
MFT 结构和记录布局
MFT 记录头部
每条 MFT 记录以签名"FILE"（0x46494C45）开头，包含：
| 偏移量 | 大小 | 字段 |
|---|---|---|
| 0x00 | 4 字节 | 签名（"FILE"） |
| 0x04 | 2 字节 | 更新序列偏移量 |
| 0x06 | 2 字节 | 更新序列大小 |
| 0x08 | 8 字节 | $LogFile 序列号 |
| 0x10 | 2 字节 | 序列号 |
| 0x12 | 2 字节 | 硬链接计数 |
| 0x14 | 2 字节 | 第一个属性偏移量 |
| 0x16 | 2 字节 | 标志（0x01 = 使用中，0x02 = 目录） |
| 0x18 | 4 字节 | MFT 记录已用大小 |
| 0x1C | 4 字节 | MFT 记录已分配大小 |
| 0x20 | 8 字节 | 基础文件记录引用 |
| 0x28 | 2 字节 | 下一个属性 ID |
关键 MFT 属性
| 类型 ID | 名称 | 描述 |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | 时间戳、标志、所有者 ID、安全 ID |
| 0x30 | $FILE_NAME | 文件名、父目录 MFT 引用、时间戳 |
| 0x40 | $OBJECT_ID | 文件的唯一 GUID |
| 0x50 | $SECURITY_DESCRIPTOR | ACL 权限 |
| 0x60 | $VOLUME_NAME | 卷标（仅卷元数据文件） |
| 0x80 | $DATA | 文件内容（小于 700 字节时为驻留型）或簇运行列表 |
| 0x90 | $INDEX_ROOT | 目录的 B 树索引根 |
| 0xA0 | $INDEX_ALLOCATION | 大型目录的 B 树索引条目 |
| 0xB0 | $BITMAP | 索引或 MFT 的分配位图 |
已删除文件恢复技术
技术 1：使用 MFTECmd 进行 MFT 记录分析
# 使用 KAPE 或 FTK Imager 从取证镜像提取 $MFT
# 使用 MFTECmd 解析 $MFT
MFTECmd.exe -f "C:\Evidence\$MFT" --csv C:\Output --csvf mft_full.csv
# 在 Timeline Explorer 中过滤已删除文件（InUse = FALSE）
# 查找 InUse 列为 False 的条目
在 CSV 输出中识别已删除文件：
InUse= False 表示已删除或已重新分配的记录ParentPath显示删除前的原始文件位置FileSize显示原始大小（可能仍可恢复）$STANDARD_INFORMATION和$FILE_NAME属性中的时间戳持续存在
技术 2：USN 日志（$UsnJrnl:$J）分析
USN 日志记录 NTFS 卷上文件的所有更改，包括创建、删除、重命名和数据修改事件。
# 使用 MFTECmd 解析 USN 日志
MFTECmd.exe -f "C:\Evidence\$J" --csv C:\Output --csvf usn_journal.csv
# 删除证据的关键 USN 原因代码:
# USN_REASON_FILE_DELETE = 0x00000200
# USN_REASON_CLOSE = 0x80000000
# USN_REASON_RENAME_OLD_NAME = 0x00001000
# USN_REASON_RENAME_NEW_NAME = 0x00002000
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 189 lines · 77 tokens per session scan A 4826369d1799
analyzing-mft-for-deleted-file-recovery is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (45 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 77 tokens to every session and 2,180 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting…
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.