tabledevil
1a4af6db30
Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with build-base + linux-headers + gettext-dev (libesedb's bundled C tree needs all three). Final image is ~26MB on alpine:3.21.
46 lines
1.5 KiB
Markdown
46 lines
1.5 KiB
Markdown
# docker_ntdsextract2
|
|
|
|
Build context for `tabledevil/ntdsextract2` — Jan Starke's Rust NTDS.DIT
|
|
forensic analyser.
|
|
|
|
Upstream: <https://codeberg.org/janstarke/ntdsextract2> (the GitHub
|
|
mirror at <https://github.com/janstarke/ntdsextract2> is archived; same
|
|
author, same code).
|
|
|
|
## What it does
|
|
|
|
Offline analysis of an extracted Active Directory database:
|
|
|
|
| subcommand | output |
|
|
|---|---|
|
|
| `user` | account list with SID, RID, status, last logon, password timestamps |
|
|
| `group` | groups + members |
|
|
| `computer` | joined hosts with last-logon and OS strings |
|
|
| `timeline` | bodyfile-format timeline (feed `mactime`) |
|
|
| `tree` | the DIT hierarchy |
|
|
| `entry` | dump a single entry by DN |
|
|
| `search` | regex search over entries |
|
|
| `types` | list the AD schema's defined types |
|
|
|
|
## Getting the input
|
|
|
|
`NTDS.DIT` is locked while AD is running. You need to extract it (and the
|
|
matching `SYSTEM` registry hive) via vshadow / a forensic acquisition.
|
|
`tabledevil/vhdi` or `tabledevil/libewf` handle E01/VHDX mounts so you can
|
|
pull the file off cleanly.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 user /data/ntds.dit
|
|
docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 timeline /data/ntds.dit > timeline.body
|
|
```
|
|
|
|
Run with no args for the in-image quick-reference banner.
|
|
|
|
## Build context
|
|
|
|
The image installs from crates.io (`cargo install ntdsextract2`) so the
|
|
build always picks up Jan's latest release. To refresh the published
|
|
image with a newer version, just rebuild — no Dockerfile edits required.
|