# docker_ntdsextract2

Build context for `tabledevil/ntdsextract2` — Jan Starke's Rust NTDS.DIT
forensic analyser.

Upstream: <https://codeberg.org/janstarke/ntdsextract2> (the GitHub
mirror at <https://github.com/janstarke/ntdsextract2> is archived; same
author, same code).

## What it does

Offline analysis of an extracted Active Directory database:

| subcommand | output |
|---|---|
| `user` | account list with SID, RID, status, last logon, password timestamps |
| `group` | groups + members |
| `computer` | joined hosts with last-logon and OS strings |
| `timeline` | bodyfile-format timeline (feed `mactime`) |
| `tree` | the DIT hierarchy |
| `entry` | dump a single entry by DN |
| `search` | regex search over entries |
| `types` | list the AD schema's defined types |

## Getting the input

`NTDS.DIT` is locked while AD is running. You need to extract it (and the
matching `SYSTEM` registry hive) via vshadow / a forensic acquisition.
`tabledevil/vhdi` or `tabledevil/libewf` handle E01/VHDX mounts so you can
pull the file off cleanly.

## Usage

```bash
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 user /data/ntds.dit
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 timeline /data/ntds.dit > timeline.body
```

Run with no args for the in-image quick-reference banner.

## Build context

The image installs from crates.io (`cargo install ntdsextract2`) so the
build always picks up Jan's latest release. To refresh the published
image with a newer version, just rebuild — no Dockerfile edits required.