Files & changes

Directory indexes / $I30

NTFS directory indexes contain entries used to locate children of a directory. Surviving index records or slack can expose historical names and metadata, but stale data needs especially careful attribution.

Listen to the full guide

Speed Download MP33 min · AI narration

Useful for

Support a directory/name association represented by a valid entry.

Important limit

Prove that a slack entry is current or has a complete, trustworthy history.

Location & availability

Directory $INDEX_ROOT and $INDEX_ALLOCATION attributes, commonly named $I30

Requires appropriate raw acquisition. Index slack and current allocated entries are different evidence classes.

Fields to examine

Child name and file reference.
Copied filename metadata within the index entry.
Directory identity and allocated versus slack context.

What it can establish

Support a directory/name association represented by a valid entry.
Provide leads to historical names in surviving slack.

What it cannot prove

Prove that a slack entry is current or has a complete, trustworthy history.
Infer execution or content from a directory-name entry.

Use it in a screenshare

Preserve the relevant filesystem metadata and identify the parent directory.
Use a parser that distinguishes active entries from recovered slack. Keep source offsets and structural validation.
Compare file references and names with $MFT and USN; report stale or unresolved associations separately from current files.

Worked example

A tool-like filename appears only in directory slack. Record it as a historical lead with recovery context. It should not be presented as a currently installed or executed tool without corroboration.

Cross-check the finding

Sources

Choose another artefact →