diogo-fernan/ir-rescue

Large .bin files in fs folder

BustedSec opened this issue · 1 comments

BustedSec commented

I have a few questions. What program created these .bin files, how do you view their contents, and can we disable .bin files from being created somehow?

diogo-fernan commented

The *.bin files contain the:

  • boot sector of the existing drives;
  • Master File Table (MFT) of NTFS partitions;
  • $LogFile of NTFS partitions;
  • $UsnJrnl of NTFS partitions.

These are all binary files and require to be parsed by other tools. Have a look a the filesystem section of the configuration file at https://github.com/diogo-fernan/ir-rescue/blob/master/win/tools-win/cfg/ir-rescue-win.conf#L128 for modifying the acquisition behavior.