tabledevil
1a4af6db30
Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with build-base + linux-headers + gettext-dev (libesedb's bundled C tree needs all three). Final image is ~26MB on alpine:3.21.
1.5 KiB
docker_ntdsextract2
Build context for tabledevil/ntdsextract2 — Jan Starke's Rust NTDS.DIT
forensic analyser.
Upstream: https://codeberg.org/janstarke/ntdsextract2 (the GitHub mirror at https://github.com/janstarke/ntdsextract2 is archived; same author, same code).
What it does
Offline analysis of an extracted Active Directory database:
| subcommand | output |
|---|---|
user |
account list with SID, RID, status, last logon, password timestamps |
group |
groups + members |
computer |
joined hosts with last-logon and OS strings |
timeline |
bodyfile-format timeline (feed mactime) |
tree |
the DIT hierarchy |
entry |
dump a single entry by DN |
search |
regex search over entries |
types |
list the AD schema's defined types |
Getting the input
NTDS.DIT is locked while AD is running. You need to extract it (and the
matching SYSTEM registry hive) via vshadow / a forensic acquisition.
tabledevil/vhdi or tabledevil/libewf handle E01/VHDX mounts so you can
pull the file off cleanly.
Usage
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 user /data/ntds.dit
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 timeline /data/ntds.dit > timeline.body
Run with no args for the in-image quick-reference banner.
Build context
The image installs from crates.io (cargo install ntdsextract2) so the
build always picks up Jan's latest release. To refresh the published
image with a newer version, just rebuild — no Dockerfile edits required.