Tools

The two open-source tools, plus worked end-to-end examples.

forefst.py is the ReFS equivalent of MFTECmd: a forensic file lister with CSV / body-file / JSON output and deleted-file + copy-on-write recovery. refsanalysis.py is the interactive structural analyser — boot / checkpoint / superblock, the B+-tree tables, security, reparse points, the USN journal, the durable log, snapshots, and super-timelines.

The Examples below are step-by-step walkthroughs against real disk images.

forefst.py	forefst.py# ReFS forensic analysis tool. forefst.py is the MFTECmd-equivalent for ReFS — it produces comprehensive per-file metadata (CSV / JSON / body file) from a raw …
refsanalysis.py	refsanalysis.py# ReFS structure and lab analysis tool — boot sector, superblock, checkpoint, object/schema/container tables, the upcase table, parent-child relationships, …

Examples

Worked, end-to-end forensic walkthroughs.

Decode a ReFS VBR by Hand	Decode a ReFS VBR by Hand# Goal: Read every field of a ReFS Volume Boot Record straight out of a raw hexdump – no parser – and derive cluster size, container …
Identify a Native vs Upgraded ReFS Volume	Identify a Native vs Upgraded ReFS Volume# Goal: Decide whether a v3.14 ReFS volume was freshly formatted under Win11 24H2 or upgraded from an older v3.4 volume. Both …
Worked Example: Detecting a Back-Dated (Timestomped) File	Worked Example: Detecting a Back-Dated (Timestomped) File# Goal: take a ReFS image, find the files whose creation time was forged into the past, and prove the tampering …
Worked Example: Enumerate Every Name of One Physical File (a Hard-Link Group)	Worked Example: Enumerate Every Name of One Physical File (a Hard-Link Group)# Goal: given a ReFS image, recover the complete list of names that point at one physical …
Worked Example: Recover a Deleted File from a ReFS Image	Worked Example: Recover a Deleted File from a ReFS Image# Goal: run every available ReFS deletion-recovery method against one real image and read the results honestly — …