Tools
Two open-source, pure-Python tools that read a raw ReFS image directly — no driver, no mount, no dependencies — plus worked, end-to-end examples against real disk images.
forefst.py is the forensic tool, the ReFS answer to MFTECmd: a full file listing (CSV / body file / JSON) with deleted-file and copy-on-write recovery, the USN and MLog journals, super-timelines, timestomp detection, security descriptors, reparse points, and stream snapshots. refsanalysis.py is the structural analyser — it decodes one on-disk structure at a time (boot sector, superblock, checkpoint, the B+-tree system tables, the upcase table, and more) and includes a boot-sector inspect/repair mode, for learning the format and validating the forensic tool against new ReFS builds. The Examples below are step-by-step forensic walkthroughs.
ReFS forensic analysis tool. forefst.py produces comprehensive per-file metadata (CSV / JSON / body file) from a raw disk image — and a full forensic suite on top: the USN journal, the MLog transaction log…
ReFS structure and lab analysis tool — boot sector, superblock, checkpoint, object/schema/container tables, the upcase table, parent-child relationships, a lab-format file/attribute browser, and a boot-sector…
Examples
Worked, end-to-end forensic walkthroughs.
Goal: Read every field of a ReFS Volume Boot Record straight out of a raw hexdump -- no parser -- and derive cluster size, container size, version, and checksum mode, then confirm the by-hand values against the tool.
Goal: Decide whether a v3.14 ReFS volume was freshly formatted under Win11 24H2 or upgraded from an older v3.4 volume. Both report version 3.14, so the answer comes from the checkpoint flags and the immutable VBR…
Goal: take a ReFS image, find the files whose creation time was forged into the past, and prove the tampering with an independent anchor rather than a single suspicious timestamp.
Goal: given a ReFS image, recover the complete list of names that point at one physical file — and prove the reconstruction is correct by decoding the on-disk identity fields by hand, because ReFS stores no explicit…
Goal: run every available ReFS deletion-recovery method against one real image and read the results honestly — which method finds what, and why the others come up empty.
Goal: one volume, three questions an investigator actually asks — where are the credentials, including the ones someone tried to hide?, what is in the alternate data streams?, and what did this file say before it was…
Goal: show that a ReFS file's identity — its FileRef (HomeOid, FileId) — stays fixed while its name and directory change, and use that fixed identity to (a) follow the file through the change journal and (b) recognise…