docker_ntdsextract2

Build context for tabledevil/ntdsextract2 — Jan Starke's Rust NTDS.DIT forensic analyser.

Upstream: https://codeberg.org/janstarke/ntdsextract2 (the GitHub mirror at https://github.com/janstarke/ntdsextract2 is archived; same author, same code).

What it does

Offline analysis of an extracted Active Directory database:

subcommand	output
user	account list with SID, RID, status, last logon, password timestamps
group	groups + members
computer	joined hosts with last-logon and OS strings
timeline	bodyfile-format timeline (feed mactime)
tree	the DIT hierarchy
entry	dump a single entry by DN
search	regex search over entries
types	list the AD schema's defined types

Getting the input

NTDS.DIT is locked while AD is running. You need to extract it (and the matching SYSTEM registry hive) via vshadow / a forensic acquisition. tabledevil/vhdi or tabledevil/libewf handle E01/VHDX mounts so you can pull the file off cleanly.

Usage

docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 user /data/ntds.dit
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 timeline /data/ntds.dit > timeline.body

Run with no args for the in-image quick-reference banner.

Build context

The image installs from crates.io (cargo install ntdsextract2) so the build always picks up Jan's latest release. To refresh the published image with a newer version, just rebuild — no Dockerfile edits required.